Transferring customer data when you sell your business

When you sell your business, customer data can usually go with it if the buyer takes over the business and keeps the promises made to customers. California’s privacy law says transferring personal information to a third party as an asset in a merger, acquisition, bankruptcy or similar transaction, where that party assumes control of all or part of the business, is not a “sale” (Cal. Civ. Code 1798.140(ad)(2)(C)). If the buyer later uses the data in a way materially inconsistent with what customers were promised, it must give them prior notice. The FTC has taken a similar line for decades.

The rules in short

Rule	What it says
CCPA “sell”	Selling, renting, disclosing or otherwise making personal information available to a third party for money or other valuable consideration (1798.140(ad)(1))
CCPA exception	A transfer as an asset in a merger, acquisition, bankruptcy or other transaction where the third party assumes control of all or part of the business is not a sale (1798.140(ad)(2)(C))
Buyer’s duty	If it materially changes how it uses or shares the data, inconsistent with the promises at collection, it gives prior notice, prominently enough for consumers to use their rights
FTC, RadioShack (2015)	Data bundled with other assets, sold only to a buyer in substantially the same line of business, bound by the original privacy policies
FTC, Toysmart (2000)	Customer list sold only with the whole site, to a buyer in a related market that follows the privacy statement

A checklist for the deal

1. Collect every version of your privacy policy and when each applied.
2. Map customer data: CRM, billing, support, marketing tools, backups.
3. Check B2B contracts for clauses on assignment and confidentiality of customer information.
4. Put the privacy terms in the agreement: what the buyer receives and what it promises to honour.
5. Delete what neither side needs. The FTC’s guidance for businesses is to keep only what you need.

De-identified records are a separate question

Some sellers license de-identified operational records, such as email, tickets and documents, to AI developers before or alongside a sale. That is not a transfer of the business, so the CCPA exception above does not cover it. Agree it with the buyer, check your privacy policy and contracts, and have counsel review it. See data as an asset when you sell your business.