{
 "name": "The law on customer data when a data company is sold",
 "title": "The law on customer data when a data company is sold",
 "kind": "terms-board",
 "url": "https://selldatacompany.com/datasets/data-company-sale-privacy-law/",
 "csv": "https://selldatacompany.com/datasets/data-company-sale-privacy-law.csv",
 "markdown": "https://selldatacompany.com/datasets/data-company-sale-privacy-law/index.md",
 "computed_at": "2026-10-28",
 "license": "https://selldatacompany.com/terms",
 "headline": "7 US and UK rules on the customer data inside a data company that changes hands, read 28 October 2026.",
 "quotes": [
  "7 US and UK rules on the customer data inside a data company that changes hands, read 28 October 2026.",
  "Where the rule applies, by rule: US federal 3 of 7, California 2 of 7, United Kingdom 2 of 7 (7 rules, read 28 October 2026).",
  "What the rule asks of the buyer, by rule: check the data in due diligence 2 of 7, honour the privacy promises the seller made 2 of 7, honour opt-outs given to the seller 1 of 7, not stated 1 of 7, tell the people whose data it takes 1 of 7 (7 rules, read 28 October 2026).",
  "Who enforces it, by rule: not stated 4 of 7, a regulator 2 of 7, a regulator and the courts 1 of 7 (7 rules, read 28 October 2026).",
  "The rule, in its words, by rule: stated 7 of 7 (7 rules, read 28 October 2026)."
 ],
 "citation": "\"The law on customer data when a data company is sold\", updated 2026-10-28, https://selldatacompany.com/datasets/data-company-sale-privacy-law/.",
 "national": {
  "n": 7,
  "unit": "rules",
  "documents": 7,
  "published_sources": 7,
  "named_sources": 11
 },
 "board": {
  "type": "clauses",
  "noun": {
   "one": "rule",
   "many": "rules"
  },
  "document": {
   "one": "statute or regulator page",
   "many": "statute and regulator pages"
  },
  "fields": [
   {
    "id": "jurisdiction",
    "label": "Where the rule applies",
    "counts": {
     "california": 2,
     "us-federal": 3,
     "uk": 2
    },
    "values": [
     {
      "value": "us-federal",
      "text": "US federal"
     },
     {
      "value": "california",
      "text": "California"
     },
     {
      "value": "uk",
      "text": "United Kingdom"
     }
    ]
   },
   {
    "id": "buyer_duty",
    "label": "What the rule asks of the buyer",
    "counts": {
     "honour-opt-outs": 1,
     "tell-individuals": 1,
     "not-stated": 1,
     "honour-promises": 2,
     "due-diligence": 2
    },
    "values": [
     {
      "value": "honour-promises",
      "text": "honour the privacy promises the seller made"
     },
     {
      "value": "honour-opt-outs",
      "text": "honour opt-outs given to the seller"
     },
     {
      "value": "lawful-basis",
      "text": "have a lawful basis for the data it takes"
     },
     {
      "value": "tell-individuals",
      "text": "tell the people whose data it takes"
     },
     {
      "value": "due-diligence",
      "text": "check the data in due diligence"
     }
    ]
   },
   {
    "id": "enforced_by",
    "label": "Who enforces it",
    "counts": {
     "not-stated": 4,
     "regulator": 2,
     "regulator-and-court": 1
    },
    "values": [
     {
      "value": "regulator",
      "text": "a regulator"
     },
     {
      "value": "court",
      "text": "a court"
     },
     {
      "value": "regulator-and-court",
      "text": "a regulator and the courts"
     }
    ]
   },
   {
    "id": "clause",
    "label": "The rule, in its words",
    "counts": {
     "stated": 7
    },
    "values": [
     {
      "value": "stated",
      "text": "stated"
     }
    ],
    "clause": true
   }
  ],
  "lead": {
   "type": "count",
   "field": null,
   "value": null,
   "n": 7,
   "of": 7,
   "label": "Rules on the register"
  },
  "vendors": [
   {
    "name": "California AB 1824, opt-outs in a merger",
    "answers": {
     "jurisdiction": {
      "value": "california",
      "text": "California",
      "documents": [
       {
        "document": "California bill text",
        "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB1824",
        "value": "california",
        "quote": "California Consumer Privacy Act of 2018: opt out right: mergers."
       }
      ]
     },
     "buyer_duty": {
      "value": "honour-opt-outs",
      "text": "honour opt-outs given to the seller",
      "documents": [
       {
        "document": "California bill text",
        "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB1824",
        "value": "honour-opt-outs",
        "quote": "to comply with a consumer’s opt out direction to the transferor"
       }
      ]
     },
     "enforced_by": {
      "value": "not-stated",
      "text": "not stated",
      "documents": [
       {
        "document": "California bill text",
        "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB1824",
        "value": "not-stated",
        "quote": ""
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "This bill would require a business to which another business transfers the personal…",
      "documents": [
       {
        "document": "California bill text",
        "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB1824",
        "value": "stated",
        "quote": "This bill would require a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all or part of the transferor to comply with a consumer’s opt out direction to the transferor."
       }
      ]
     }
    }
   },
   {
    "name": "California Civil Code 1798.140, the merger exception to a sale",
    "answers": {
     "jurisdiction": {
      "value": "california",
      "text": "California",
      "documents": [
       {
        "document": "California Civil Code",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
        "value": "california",
        "quote": "California Code, CIV 1798.140"
       }
      ]
     },
     "buyer_duty": {
      "value": "tell-individuals",
      "text": "tell the people whose data it takes",
      "documents": [
       {
        "document": "California Civil Code",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
        "value": "tell-individuals",
        "quote": "it shall provide prior notice of the new or changed practice to the consumer"
       }
      ]
     },
     "enforced_by": {
      "value": "not-stated",
      "text": "not stated",
      "documents": [
       {
        "document": "California Civil Code",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
        "value": "not-stated",
        "quote": ""
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "The business transfers to a third party the personal information of a consumer as an…",
      "documents": [
       {
        "document": "California Civil Code",
        "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
        "value": "stated",
        "quote": "The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title."
       }
      ]
     }
    }
   },
   {
    "name": "Federal Trade Commission Act, unfair or deceptive practices",
    "answers": {
     "jurisdiction": {
      "value": "us-federal",
      "text": "US federal",
      "documents": [
       {
        "document": "FTC statute page",
        "url": "https://www.ftc.gov/legal-library/browse/statutes/federal-trade-commission-act",
        "value": "us-federal",
        "quote": "The Federal Trade Commission Act is the primary statute of the Commission."
       }
      ]
     },
     "buyer_duty": {
      "value": "not-stated",
      "text": "not stated",
      "documents": [
       {
        "document": "FTC statute page",
        "url": "https://www.ftc.gov/legal-library/browse/statutes/federal-trade-commission-act",
        "value": "not-stated",
        "quote": ""
       }
      ]
     },
     "enforced_by": {
      "value": "regulator",
      "text": "a regulator",
      "documents": [
       {
        "document": "FTC statute page",
        "url": "https://www.ftc.gov/legal-library/browse/statutes/federal-trade-commission-act",
        "value": "regulator",
        "quote": "the Commission is empowered, among other things, to (a) prevent unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "the Commission is empowered, among other things, to (a) prevent unfair methods of…",
      "documents": [
       {
        "document": "FTC statute page",
        "url": "https://www.ftc.gov/legal-library/browse/statutes/federal-trade-commission-act",
        "value": "stated",
        "quote": "the Commission is empowered, among other things, to (a) prevent unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce"
       }
      ]
     }
    }
   },
   {
    "name": "FTC conditions on selling RadioShack customer data",
    "answers": {
     "jurisdiction": {
      "value": "us-federal",
      "text": "US federal",
      "documents": [
       {
        "document": "FTC press release, 2015",
        "url": "https://www.ftc.gov/news-events/news/press-releases/2015/05/ftc-requests-bankruptcy-court-take-steps-protect-radioshack-consumers-personal-information",
        "value": "us-federal",
        "quote": "Federal Trade Commission Consumer Protection Director Jessica Rich recommended conditions the court could place on the sale of consumers’ personal information"
       }
      ]
     },
     "buyer_duty": {
      "value": "honour-promises",
      "text": "honour the privacy promises the seller made",
      "documents": [
       {
        "document": "FTC press release, 2015",
        "url": "https://www.ftc.gov/news-events/news/press-releases/2015/05/ftc-requests-bankruptcy-court-take-steps-protect-radioshack-consumers-personal-information",
        "value": "honour-promises",
        "quote": "that the buyer agree to be bound by the RadioShack privacy policies that were in place when the consumers’ data was collected"
       }
      ]
     },
     "enforced_by": {
      "value": "regulator-and-court",
      "text": "a regulator and the courts",
      "documents": [
       {
        "document": "FTC press release, 2015",
        "url": "https://www.ftc.gov/news-events/news/press-releases/2015/05/ftc-requests-bankruptcy-court-take-steps-protect-radioshack-consumers-personal-information",
        "value": "regulator-and-court",
        "quote": "recommended conditions the court could place on the sale of consumers’ personal information to protect their privacy"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "The letter recommends that consumer information be sold only to another entity that is in…",
      "documents": [
       {
        "document": "FTC press release, 2015",
        "url": "https://www.ftc.gov/news-events/news/press-releases/2015/05/ftc-requests-bankruptcy-court-take-steps-protect-radioshack-consumers-personal-information",
        "value": "stated",
        "quote": "The letter recommends that consumer information be sold only to another entity that is in substantially the same line of business as RadioShack"
       }
      ]
     }
    }
   },
   {
    "name": "FTC letter on Facebook's acquisition of WhatsApp",
    "answers": {
     "jurisdiction": {
      "value": "us-federal",
      "text": "US federal",
      "documents": [
       {
        "document": "FTC press release, 2014",
        "url": "https://www.ftc.gov/news-events/news/press-releases/2014/04/ftc-notifies-facebook-whatsapp-privacy-obligations-light-proposed-acquisition",
        "value": "us-federal",
        "quote": "both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act"
       }
      ]
     },
     "buyer_duty": {
      "value": "honour-promises",
      "text": "honour the privacy promises the seller made",
      "documents": [
       {
        "document": "FTC press release, 2014",
        "url": "https://www.ftc.gov/news-events/news/press-releases/2014/04/ftc-notifies-facebook-whatsapp-privacy-obligations-light-proposed-acquisition",
        "value": "honour-promises",
        "quote": "regardless of the acquisition, WhatsApp must continue to honor these promises to consumers"
       }
      ]
     },
     "enforced_by": {
      "value": "regulator",
      "text": "a regulator",
      "documents": [
       {
        "document": "FTC press release, 2014",
        "url": "https://www.ftc.gov/news-events/news/press-releases/2014/04/ftc-notifies-facebook-whatsapp-privacy-obligations-light-proposed-acquisition",
        "value": "regulator",
        "quote": "both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act and, potentially, the FTC’s order against Facebook"
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "The letter notes that before making any material changes to how they use data already…",
      "documents": [
       {
        "document": "FTC press release, 2014",
        "url": "https://www.ftc.gov/news-events/news/press-releases/2014/04/ftc-notifies-facebook-whatsapp-privacy-obligations-light-proposed-acquisition",
        "value": "stated",
        "quote": "The letter notes that before making any material changes to how they use data already collected from WhatsApp subscribers, the companies must get affirmative consent."
       }
      ]
     }
    }
   },
   {
    "name": "ICO data sharing code: databases and lists",
    "answers": {
     "jurisdiction": {
      "value": "uk",
      "text": "United Kingdom",
      "documents": [
       {
        "document": "ICO data sharing code of practice",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
        "value": "uk",
        "quote": "check what information was given to individuals in accordance with Article 14 of the UK GDPR"
       }
      ]
     },
     "buyer_duty": {
      "value": "due-diligence",
      "text": "check the data in due diligence",
      "documents": [
       {
        "document": "ICO data sharing code of practice",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
        "value": "due-diligence",
        "quote": "What must we do to ensure the database or list we are receiving is being shared in compliance with the law?"
       }
      ]
     },
     "enforced_by": {
      "value": "not-stated",
      "text": "not stated",
      "documents": [
       {
        "document": "ICO data sharing code of practice",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
        "value": "not-stated",
        "quote": ""
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "The transfer of databases or lists of individuals is a form of data sharing, whether for…",
      "documents": [
       {
        "document": "ICO data sharing code of practice",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
        "value": "stated",
        "quote": "The transfer of databases or lists of individuals is a form of data sharing, whether for money or other consideration, and whether for profit or not."
       }
      ]
     }
    }
   },
   {
    "name": "ICO data sharing code: mergers and acquisitions",
    "answers": {
     "jurisdiction": {
      "value": "uk",
      "text": "United Kingdom",
      "documents": [
       {
        "document": "ICO data sharing code of practice",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
        "value": "uk",
        "quote": "Under the UK GDPR you are required to keep individual data subjects informed about certain changes relating to the processing of their data"
       }
      ]
     },
     "buyer_duty": {
      "value": "due-diligence",
      "text": "check the data in due diligence",
      "documents": [
       {
        "document": "ICO data sharing code of practice",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
        "value": "due-diligence",
        "quote": "you must consider data sharing as part of the due diligence you carry out when taking on the organisation and its obligations"
       }
      ]
     },
     "enforced_by": {
      "value": "not-stated",
      "text": "not stated",
      "documents": [
       {
        "document": "ICO data sharing code of practice",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
        "value": "not-stated",
        "quote": ""
       }
      ]
     },
     "clause": {
      "value": "stated",
      "text": "This includes establishing the purposes for which the data was originally obtained, your…",
      "documents": [
       {
        "document": "ICO data sharing code of practice",
        "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
        "value": "stated",
        "quote": "This includes establishing the purposes for which the data was originally obtained, your lawful basis for sharing it, and whether these have changed following the merger or acquisition."
       }
      ]
     }
    }
   }
  ]
 },
 "subject_kind": "rule",
 "rows": [
  {
   "subject": "California AB 1824, opt-outs in a merger",
   "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB1824",
   "document": "California bill text",
   "question": "jurisdiction",
   "answer": "california",
   "answer_text": "California",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "California Consumer Privacy Act of 2018: opt out right: mergers.",
   "text_sha256": "fb833bad7fe4959697be92fa611857707a136e898cf455fb77743168fc8914fa"
  },
  {
   "subject": "California AB 1824, opt-outs in a merger",
   "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB1824",
   "document": "California bill text",
   "question": "buyer_duty",
   "answer": "honour-opt-outs",
   "answer_text": "honour opt-outs given to the seller",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "to comply with a consumer’s opt out direction to the transferor",
   "text_sha256": "fb833bad7fe4959697be92fa611857707a136e898cf455fb77743168fc8914fa"
  },
  {
   "subject": "California AB 1824, opt-outs in a merger",
   "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB1824",
   "document": "California bill text",
   "question": "enforced_by",
   "answer": "not-stated",
   "answer_text": "not stated",
   "status": "not-stated",
   "retrieved_at": "2026-10-28",
   "quote": "Left open by the statute or regulator page (7,510 characters, read in full 2026-10-28).",
   "text_sha256": "fb833bad7fe4959697be92fa611857707a136e898cf455fb77743168fc8914fa"
  },
  {
   "subject": "California AB 1824, opt-outs in a merger",
   "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB1824",
   "document": "California bill text",
   "question": "clause",
   "answer": "stated",
   "answer_text": "This bill would require a business to which another business transfers the personal…",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "This bill would require a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all or part of the transferor to comply with a consumer’s opt out direction to the transferor.",
   "text_sha256": "fb833bad7fe4959697be92fa611857707a136e898cf455fb77743168fc8914fa"
  },
  {
   "subject": "California Civil Code 1798.140, the merger exception to a sale",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
   "document": "California Civil Code",
   "question": "jurisdiction",
   "answer": "california",
   "answer_text": "California",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "California Code, CIV 1798.140",
   "text_sha256": "e3c6e568a063521dc4d2277af4c0e193823b014d89f6df49ee26845afb13a82b"
  },
  {
   "subject": "California Civil Code 1798.140, the merger exception to a sale",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
   "document": "California Civil Code",
   "question": "buyer_duty",
   "answer": "tell-individuals",
   "answer_text": "tell the people whose data it takes",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "it shall provide prior notice of the new or changed practice to the consumer",
   "text_sha256": "e3c6e568a063521dc4d2277af4c0e193823b014d89f6df49ee26845afb13a82b"
  },
  {
   "subject": "California Civil Code 1798.140, the merger exception to a sale",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
   "document": "California Civil Code",
   "question": "enforced_by",
   "answer": "not-stated",
   "answer_text": "not stated",
   "status": "not-stated",
   "retrieved_at": "2026-10-08",
   "quote": "Left open by the statute or regulator page (36,374 characters, read in full 2026-10-08).",
   "text_sha256": "e3c6e568a063521dc4d2277af4c0e193823b014d89f6df49ee26845afb13a82b"
  },
  {
   "subject": "California Civil Code 1798.140, the merger exception to a sale",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
   "document": "California Civil Code",
   "question": "clause",
   "answer": "stated",
   "answer_text": "The business transfers to a third party the personal information of a consumer as an…",
   "status": "stated",
   "retrieved_at": "2026-10-08",
   "quote": "The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title.",
   "text_sha256": "e3c6e568a063521dc4d2277af4c0e193823b014d89f6df49ee26845afb13a82b"
  },
  {
   "subject": "Federal Trade Commission Act, unfair or deceptive practices",
   "url": "https://www.ftc.gov/legal-library/browse/statutes/federal-trade-commission-act",
   "document": "FTC statute page",
   "question": "jurisdiction",
   "answer": "us-federal",
   "answer_text": "US federal",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "The Federal Trade Commission Act is the primary statute of the Commission.",
   "text_sha256": "e5dbf13905cef353ce9e89e5a16b6bd162a10ca5b3f2c7f85d14befb76b1fc2d"
  },
  {
   "subject": "Federal Trade Commission Act, unfair or deceptive practices",
   "url": "https://www.ftc.gov/legal-library/browse/statutes/federal-trade-commission-act",
   "document": "FTC statute page",
   "question": "buyer_duty",
   "answer": "not-stated",
   "answer_text": "not stated",
   "status": "not-stated",
   "retrieved_at": "2026-10-28",
   "quote": "Left open by the statute or regulator page (3,279 characters, read in full 2026-10-28).",
   "text_sha256": "e5dbf13905cef353ce9e89e5a16b6bd162a10ca5b3f2c7f85d14befb76b1fc2d"
  },
  {
   "subject": "Federal Trade Commission Act, unfair or deceptive practices",
   "url": "https://www.ftc.gov/legal-library/browse/statutes/federal-trade-commission-act",
   "document": "FTC statute page",
   "question": "enforced_by",
   "answer": "regulator",
   "answer_text": "a regulator",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "the Commission is empowered, among other things, to (a) prevent unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce",
   "text_sha256": "e5dbf13905cef353ce9e89e5a16b6bd162a10ca5b3f2c7f85d14befb76b1fc2d"
  },
  {
   "subject": "Federal Trade Commission Act, unfair or deceptive practices",
   "url": "https://www.ftc.gov/legal-library/browse/statutes/federal-trade-commission-act",
   "document": "FTC statute page",
   "question": "clause",
   "answer": "stated",
   "answer_text": "the Commission is empowered, among other things, to (a) prevent unfair methods of…",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "the Commission is empowered, among other things, to (a) prevent unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce",
   "text_sha256": "e5dbf13905cef353ce9e89e5a16b6bd162a10ca5b3f2c7f85d14befb76b1fc2d"
  },
  {
   "subject": "FTC conditions on selling RadioShack customer data",
   "url": "https://www.ftc.gov/news-events/news/press-releases/2015/05/ftc-requests-bankruptcy-court-take-steps-protect-radioshack-consumers-personal-information",
   "document": "FTC press release, 2015",
   "question": "jurisdiction",
   "answer": "us-federal",
   "answer_text": "US federal",
   "status": "stated",
   "retrieved_at": "2026-10-22",
   "quote": "Federal Trade Commission Consumer Protection Director Jessica Rich recommended conditions the court could place on the sale of consumers’ personal information",
   "text_sha256": "721fc8aaeed881edf1dcc4262569a93041f52e32d4b28dab7ad9f9673c1cb171"
  },
  {
   "subject": "FTC conditions on selling RadioShack customer data",
   "url": "https://www.ftc.gov/news-events/news/press-releases/2015/05/ftc-requests-bankruptcy-court-take-steps-protect-radioshack-consumers-personal-information",
   "document": "FTC press release, 2015",
   "question": "buyer_duty",
   "answer": "honour-promises",
   "answer_text": "honour the privacy promises the seller made",
   "status": "stated",
   "retrieved_at": "2026-10-22",
   "quote": "that the buyer agree to be bound by the RadioShack privacy policies that were in place when the consumers’ data was collected",
   "text_sha256": "721fc8aaeed881edf1dcc4262569a93041f52e32d4b28dab7ad9f9673c1cb171"
  },
  {
   "subject": "FTC conditions on selling RadioShack customer data",
   "url": "https://www.ftc.gov/news-events/news/press-releases/2015/05/ftc-requests-bankruptcy-court-take-steps-protect-radioshack-consumers-personal-information",
   "document": "FTC press release, 2015",
   "question": "enforced_by",
   "answer": "regulator-and-court",
   "answer_text": "a regulator and the courts",
   "status": "stated",
   "retrieved_at": "2026-10-22",
   "quote": "recommended conditions the court could place on the sale of consumers’ personal information to protect their privacy",
   "text_sha256": "721fc8aaeed881edf1dcc4262569a93041f52e32d4b28dab7ad9f9673c1cb171"
  },
  {
   "subject": "FTC conditions on selling RadioShack customer data",
   "url": "https://www.ftc.gov/news-events/news/press-releases/2015/05/ftc-requests-bankruptcy-court-take-steps-protect-radioshack-consumers-personal-information",
   "document": "FTC press release, 2015",
   "question": "clause",
   "answer": "stated",
   "answer_text": "The letter recommends that consumer information be sold only to another entity that is in…",
   "status": "stated",
   "retrieved_at": "2026-10-22",
   "quote": "The letter recommends that consumer information be sold only to another entity that is in substantially the same line of business as RadioShack",
   "text_sha256": "721fc8aaeed881edf1dcc4262569a93041f52e32d4b28dab7ad9f9673c1cb171"
  },
  {
   "subject": "FTC letter on Facebook's acquisition of WhatsApp",
   "url": "https://www.ftc.gov/news-events/news/press-releases/2014/04/ftc-notifies-facebook-whatsapp-privacy-obligations-light-proposed-acquisition",
   "document": "FTC press release, 2014",
   "question": "jurisdiction",
   "answer": "us-federal",
   "answer_text": "US federal",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act",
   "text_sha256": "84243f9a1d622621a53cc27a7daa03e646646250d4143f199b126a857d048733"
  },
  {
   "subject": "FTC letter on Facebook's acquisition of WhatsApp",
   "url": "https://www.ftc.gov/news-events/news/press-releases/2014/04/ftc-notifies-facebook-whatsapp-privacy-obligations-light-proposed-acquisition",
   "document": "FTC press release, 2014",
   "question": "buyer_duty",
   "answer": "honour-promises",
   "answer_text": "honour the privacy promises the seller made",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "regardless of the acquisition, WhatsApp must continue to honor these promises to consumers",
   "text_sha256": "84243f9a1d622621a53cc27a7daa03e646646250d4143f199b126a857d048733"
  },
  {
   "subject": "FTC letter on Facebook's acquisition of WhatsApp",
   "url": "https://www.ftc.gov/news-events/news/press-releases/2014/04/ftc-notifies-facebook-whatsapp-privacy-obligations-light-proposed-acquisition",
   "document": "FTC press release, 2014",
   "question": "enforced_by",
   "answer": "regulator",
   "answer_text": "a regulator",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act and, potentially, the FTC’s order against Facebook",
   "text_sha256": "84243f9a1d622621a53cc27a7daa03e646646250d4143f199b126a857d048733"
  },
  {
   "subject": "FTC letter on Facebook's acquisition of WhatsApp",
   "url": "https://www.ftc.gov/news-events/news/press-releases/2014/04/ftc-notifies-facebook-whatsapp-privacy-obligations-light-proposed-acquisition",
   "document": "FTC press release, 2014",
   "question": "clause",
   "answer": "stated",
   "answer_text": "The letter notes that before making any material changes to how they use data already…",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "The letter notes that before making any material changes to how they use data already collected from WhatsApp subscribers, the companies must get affirmative consent.",
   "text_sha256": "84243f9a1d622621a53cc27a7daa03e646646250d4143f199b126a857d048733"
  },
  {
   "subject": "ICO data sharing code: databases and lists",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
   "document": "ICO data sharing code of practice",
   "question": "jurisdiction",
   "answer": "uk",
   "answer_text": "United Kingdom",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "check what information was given to individuals in accordance with Article 14 of the UK GDPR",
   "text_sha256": "45491c28b98ddd7acdad6a36815ee82783f486edff845354d2a3a590a138bf0f"
  },
  {
   "subject": "ICO data sharing code: databases and lists",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
   "document": "ICO data sharing code of practice",
   "question": "buyer_duty",
   "answer": "due-diligence",
   "answer_text": "check the data in due diligence",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "What must we do to ensure the database or list we are receiving is being shared in compliance with the law?",
   "text_sha256": "45491c28b98ddd7acdad6a36815ee82783f486edff845354d2a3a590a138bf0f"
  },
  {
   "subject": "ICO data sharing code: databases and lists",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
   "document": "ICO data sharing code of practice",
   "question": "enforced_by",
   "answer": "not-stated",
   "answer_text": "not stated",
   "status": "not-stated",
   "retrieved_at": "2026-10-28",
   "quote": "Left open by the statute or regulator page (8,921 characters, read in full 2026-10-28).",
   "text_sha256": "45491c28b98ddd7acdad6a36815ee82783f486edff845354d2a3a590a138bf0f"
  },
  {
   "subject": "ICO data sharing code: databases and lists",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
   "document": "ICO data sharing code of practice",
   "question": "clause",
   "answer": "stated",
   "answer_text": "The transfer of databases or lists of individuals is a form of data sharing, whether for…",
   "status": "stated",
   "retrieved_at": "2026-10-28",
   "quote": "The transfer of databases or lists of individuals is a form of data sharing, whether for money or other consideration, and whether for profit or not.",
   "text_sha256": "45491c28b98ddd7acdad6a36815ee82783f486edff845354d2a3a590a138bf0f"
  },
  {
   "subject": "ICO data sharing code: mergers and acquisitions",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
   "document": "ICO data sharing code of practice",
   "question": "jurisdiction",
   "answer": "uk",
   "answer_text": "United Kingdom",
   "status": "stated",
   "retrieved_at": "2026-10-27",
   "quote": "Under the UK GDPR you are required to keep individual data subjects informed about certain changes relating to the processing of their data",
   "text_sha256": "67a3c3febd20283f7ac3164789c886a6edb6c8a205cf23205c85f527d32f8b27"
  },
  {
   "subject": "ICO data sharing code: mergers and acquisitions",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
   "document": "ICO data sharing code of practice",
   "question": "buyer_duty",
   "answer": "due-diligence",
   "answer_text": "check the data in due diligence",
   "status": "stated",
   "retrieved_at": "2026-10-27",
   "quote": "you must consider data sharing as part of the due diligence you carry out when taking on the organisation and its obligations",
   "text_sha256": "67a3c3febd20283f7ac3164789c886a6edb6c8a205cf23205c85f527d32f8b27"
  },
  {
   "subject": "ICO data sharing code: mergers and acquisitions",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
   "document": "ICO data sharing code of practice",
   "question": "enforced_by",
   "answer": "not-stated",
   "answer_text": "not stated",
   "status": "not-stated",
   "retrieved_at": "2026-10-27",
   "quote": "Left open by the statute or regulator page (7,339 characters, read in full 2026-10-27).",
   "text_sha256": "67a3c3febd20283f7ac3164789c886a6edb6c8a205cf23205c85f527d32f8b27"
  },
  {
   "subject": "ICO data sharing code: mergers and acquisitions",
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
   "document": "ICO data sharing code of practice",
   "question": "clause",
   "answer": "stated",
   "answer_text": "This includes establishing the purposes for which the data was originally obtained, your…",
   "status": "stated",
   "retrieved_at": "2026-10-27",
   "quote": "This includes establishing the purposes for which the data was originally obtained, your lawful basis for sharing it, and whether these have changed following the merger or acquisition.",
   "text_sha256": "67a3c3febd20283f7ac3164789c886a6edb6c8a205cf23205c85f527d32f8b27"
  }
 ],
 "sources": [
  {
   "url": "https://www.ftc.gov/news-events/news/press-releases/2014/04/ftc-notifies-facebook-whatsapp-privacy-obligations-light-proposed-acquisition",
   "label": "FTC: Facebook and WhatsApp notified of privacy obligations in the acquisition",
   "license": "cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.ftc.gov/news-events/blogs/business-blog/2014/04/ftc-staff-facebook-whatsapp-privacy-promises-prevail",
   "label": "FTC business blog: privacy promises prevail",
   "license": "cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance",
   "class": "primary-government",
   "status": "unread"
  },
  {
   "url": "https://www.ftc.gov/news-events/news/press-releases/2015/05/ftc-requests-bankruptcy-court-take-steps-protect-radioshack-consumers-personal-information",
   "label": "FTC: RadioShack bankruptcy and customer data",
   "license": "cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.ftc.gov/enforcement/competition-matters/2015/06/not-so-big-news-about-big-data",
   "label": "FTC: data in merger review",
   "license": "cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance",
   "class": "primary-government",
   "status": "not-terms",
   "why": "an FTC competition blog post on big data in merger analysis; it states no rule on the customer data in a sale"
  },
  {
   "url": "https://www.ftc.gov/legal-library/browse/statutes/federal-trade-commission-act",
   "label": "FTC Act",
   "license": "cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140",
   "label": "California Civil Code 1798.140 (CCPA definitions)",
   "license": "cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB1824",
   "label": "California AB 1824 (2024)",
   "license": "cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/",
   "label": "ICO: due diligence when sharing data following mergers and acquisitions",
   "license": "cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/",
   "label": "ICO: sharing personal data in databases and lists",
   "license": "cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance",
   "class": "primary-government",
   "status": "read"
  },
  {
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/6",
   "label": "UK GDPR Article 6 (legislation.gov.uk)",
   "license": "cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance",
   "class": "primary-government",
   "status": "not-terms",
   "why": "a general UK GDPR article; the board records the ICO's merger and database guidance that applies it to a sale (sources 8 and 9)"
  },
  {
   "url": "https://www.legislation.gov.uk/eur/2016/679/article/14",
   "label": "UK GDPR Article 14 (legislation.gov.uk)",
   "license": "cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance",
   "class": "primary-government",
   "status": "not-terms",
   "why": "a general UK GDPR article; the board records the ICO's merger and database guidance that applies it to a sale (sources 8 and 9)"
  }
 ],
 "methodology": "Each rule's own US and UK statutes, regulations and regulators' guidance were read through estate-fetch and stored whole (sha256 on every row). For every statute or regulator page, four questions were answered from its own words: where the rule applies, what the rule asks of the buyer, who enforces it, the rule, in its words. Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the statute or regulator page read does not address the question. A rule with several statute and regulator pages reads 'varies' where they disagree. 7 rules, 7 statute and regulator pages.",
 "embed": "<figure style=\"margin:0;padding:16px;border:1px solid #d0d0d0;background:#ffffff\"><blockquote style=\"margin:0 0 8px;background:#ffffff\">7 US and UK rules on the customer data inside a data company that changes hands, read 28 October 2026.</blockquote><figcaption style=\"background:#ffffff\"><a href=\"https://selldatacompany.com/datasets/data-company-sale-privacy-law/\" style=\"background:#ffffff\">The law on customer data when a data company is sold, selldatacompany.com</a></figcaption></figure>"
}