The law on customer data when a data company is sold
7 US and UK rules on the customer data inside a data company that changes hands, read 28 October 2026.
Where the rule applies
What the rule asks of the buyer
Who enforces it
The rule, in its words
All the answers, rule by rule
One rule to a row. Expand an answer for its source sentence, word for word, plus the statute or regulator page and the read date; "not stated" means that statute or regulator page does not cover the question.
| Rule | Where the rule applies | What the rule asks of the buyer | Who enforces it | The rule, in its words |
|---|---|---|---|---|
| California AB 1824, opt-outs in a merger | California | honour opt-outs given to the seller | not statedNot addressed in California bill text | This bill would require a business to which another business transfers the personal… |
| California Civil Code 1798.140, the merger exception to a sale | California | tell the people whose data it takes | not statedNot addressed in California Civil Code | The business transfers to a third party the personal information of a consumer as an… |
| Federal Trade Commission Act, unfair or deceptive practices | US federal | not statedNot addressed in FTC statute page | a regulator | the Commission is empowered, among other things, to (a) prevent unfair methods of… |
| FTC conditions on selling RadioShack customer data | US federal | honour the privacy promises the seller made | a regulator and the courts | The letter recommends that consumer information be sold only to another entity that is in… |
| FTC letter on Facebook's acquisition of WhatsApp | US federal | honour the privacy promises the seller made | a regulator | The letter notes that before making any material changes to how they use data already… |
| ICO data sharing code: databases and lists | United Kingdom | check the data in due diligence | not statedNot addressed in ICO data sharing code of practice | The transfer of databases or lists of individuals is a form of data sharing, whether for… |
| ICO data sharing code: mergers and acquisitions | United Kingdom | check the data in due diligence | not statedNot addressed in ICO data sharing code of practice | This includes establishing the purposes for which the data was originally obtained, your… |
The 28 sentences the answers come from
- California AB 1824, opt-outs in a merger, California bill text, read 2026-10-28, Where the rule applies:
California Consumer Privacy Act of 2018: opt out right: mergers.
- California AB 1824, opt-outs in a merger, California bill text, read 2026-10-28, What the rule asks of the buyer:
to comply with a consumer’s opt out direction to the transferor
- California AB 1824, opt-outs in a merger, California bill text, read 2026-10-28, Who enforces it: Left open by the statute or regulator page (7,510 characters, read in full 2026-10-28).
- California AB 1824, opt-outs in a merger, California bill text, read 2026-10-28, The rule, in its words:
This bill would require a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all or part of the transferor to comply with a consumer’s opt out direction to the transferor.
- California Civil Code 1798.140, the merger exception to a sale, California Civil Code, read 2026-10-08, Where the rule applies:
California Code, CIV 1798.140
- California Civil Code 1798.140, the merger exception to a sale, California Civil Code, read 2026-10-08, What the rule asks of the buyer:
it shall provide prior notice of the new or changed practice to the consumer
- California Civil Code 1798.140, the merger exception to a sale, California Civil Code, read 2026-10-08, Who enforces it: Left open by the statute or regulator page (36,374 characters, read in full 2026-10-08).
- California Civil Code 1798.140, the merger exception to a sale, California Civil Code, read 2026-10-08, The rule, in its words:
The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title.
- Federal Trade Commission Act, unfair or deceptive practices, FTC statute page, read 2026-10-28, Where the rule applies:
The Federal Trade Commission Act is the primary statute of the Commission.
- Federal Trade Commission Act, unfair or deceptive practices, FTC statute page, read 2026-10-28, What the rule asks of the buyer: Left open by the statute or regulator page (3,279 characters, read in full 2026-10-28).
- Federal Trade Commission Act, unfair or deceptive practices, FTC statute page, read 2026-10-28, Who enforces it:
the Commission is empowered, among other things, to (a) prevent unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce
- Federal Trade Commission Act, unfair or deceptive practices, FTC statute page, read 2026-10-28, The rule, in its words:
the Commission is empowered, among other things, to (a) prevent unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce
- FTC conditions on selling RadioShack customer data, FTC press release, 2015, read 2026-10-22, Where the rule applies:
Federal Trade Commission Consumer Protection Director Jessica Rich recommended conditions the court could place on the sale of consumers’ personal information
- FTC conditions on selling RadioShack customer data, FTC press release, 2015, read 2026-10-22, What the rule asks of the buyer:
that the buyer agree to be bound by the RadioShack privacy policies that were in place when the consumers’ data was collected
- FTC conditions on selling RadioShack customer data, FTC press release, 2015, read 2026-10-22, Who enforces it:
recommended conditions the court could place on the sale of consumers’ personal information to protect their privacy
- FTC conditions on selling RadioShack customer data, FTC press release, 2015, read 2026-10-22, The rule, in its words:
The letter recommends that consumer information be sold only to another entity that is in substantially the same line of business as RadioShack
- FTC letter on Facebook's acquisition of WhatsApp, FTC press release, 2014, read 2026-10-28, Where the rule applies:
both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act
- FTC letter on Facebook's acquisition of WhatsApp, FTC press release, 2014, read 2026-10-28, What the rule asks of the buyer:
regardless of the acquisition, WhatsApp must continue to honor these promises to consumers
- FTC letter on Facebook's acquisition of WhatsApp, FTC press release, 2014, read 2026-10-28, Who enforces it:
both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act and, potentially, the FTC’s order against Facebook
- FTC letter on Facebook's acquisition of WhatsApp, FTC press release, 2014, read 2026-10-28, The rule, in its words:
The letter notes that before making any material changes to how they use data already collected from WhatsApp subscribers, the companies must get affirmative consent.
- ICO data sharing code: databases and lists, ICO data sharing code of practice, read 2026-10-28, Where the rule applies:
check what information was given to individuals in accordance with Article 14 of the UK GDPR
- ICO data sharing code: databases and lists, ICO data sharing code of practice, read 2026-10-28, What the rule asks of the buyer:
What must we do to ensure the database or list we are receiving is being shared in compliance with the law?
- ICO data sharing code: databases and lists, ICO data sharing code of practice, read 2026-10-28, Who enforces it: Left open by the statute or regulator page (8,921 characters, read in full 2026-10-28).
- ICO data sharing code: databases and lists, ICO data sharing code of practice, read 2026-10-28, The rule, in its words:
The transfer of databases or lists of individuals is a form of data sharing, whether for money or other consideration, and whether for profit or not.
- ICO data sharing code: mergers and acquisitions, ICO data sharing code of practice, read 2026-10-27, Where the rule applies:
Under the UK GDPR you are required to keep individual data subjects informed about certain changes relating to the processing of their data
- ICO data sharing code: mergers and acquisitions, ICO data sharing code of practice, read 2026-10-27, What the rule asks of the buyer:
you must consider data sharing as part of the due diligence you carry out when taking on the organisation and its obligations
- ICO data sharing code: mergers and acquisitions, ICO data sharing code of practice, read 2026-10-27, Who enforces it: Left open by the statute or regulator page (7,339 characters, read in full 2026-10-27).
- ICO data sharing code: mergers and acquisitions, ICO data sharing code of practice, read 2026-10-27, The rule, in its words:
This includes establishing the purposes for which the data was originally obtained, your lawful basis for sharing it, and whether these have changed following the merger or acquisition.
Documents we read but did not count
3 named documents were read but are not the kind of document this board answers from; see why below. They are counted and never answered.
- FTC: data in merger review: an FTC competition blog post on big data in merger analysis; it states no rule on the customer data in a sale
- UK GDPR Article 6 (legislation.gov.uk): a general UK GDPR article; the board records the ICO's merger and database guidance that applies it to a sale (sources 8 and 9)
- UK GDPR Article 14 (legislation.gov.uk): a general UK GDPR article; the board records the ICO's merger and database guidance that applies it to a sale (sources 8 and 9)
The method in full
Each rule's own US and UK statutes, regulations and regulators' guidance were read through estate-fetch and stored whole (sha256 on every row).
For every statute or regulator page, four questions were answered from its own words: where the rule applies, what the rule asks of the buyer, who enforces it, the rule, in its words.
Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the statute or regulator page read does not address the question.
A rule with several statute and regulator pages reads 'varies' where they disagree.
7 rules, 7 statute and regulator pages.
1 named document has not been read and is excluded from the counts.
Where we looked (11)
- FTC: Facebook and WhatsApp notified of privacy obligations in the acquisition (cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance)
- FTC business blog: privacy promises prevail (not yet read)
- FTC: RadioShack bankruptcy and customer data (cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance)
- FTC: data in merger review (read, set aside)
- FTC Act (cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance)
- California Civil Code 1798.140 (CCPA definitions) (cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance)
- California AB 1824 (2024) (cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance)
- ICO: due diligence when sharing data following mergers and acquisitions (cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance)
- ICO: sharing personal data in databases and lists (cited for reporting; the publisher's own US and UK statutes, regulations and regulators' guidance)
- UK GDPR Article 6 (legislation.gov.uk) (read, set aside)
- UK GDPR Article 14 (legislation.gov.uk) (read, set aside)
Cite it or embed it
7 US and UK rules on the customer data inside a data company that changes hands, read 28 October 2026.
Where the rule applies, by rule: US federal 3 of 7, California 2 of 7, United Kingdom 2 of 7 (7 rules, read 28 October 2026).
What the rule asks of the buyer, by rule: check the data in due diligence 2 of 7, honour the privacy promises the seller made 2 of 7, honour opt-outs given to the seller 1 of 7, not stated 1 of 7, tell the people whose data it takes 1 of 7 (7 rules, read 28 October 2026).
Who enforces it, by rule: not stated 4 of 7, a regulator 2 of 7, a regulator and the courts 1 of 7 (7 rules, read 28 October 2026).
The rule, in its words, by rule: stated 7 of 7 (7 rules, read 28 October 2026).
Credit as: "The law on customer data when a data company is sold", updated 2026-10-28, https://selldatacompany.com/datasets/data-company-sale-privacy-law/.
Download as CSV (28 answers as of 2026-10-28)