# The law on customer data when a data company is sold

> 7 US and UK rules on the customer data inside a data company that changes hands, read 28 October 2026.

Sell Data Company · https://selldatacompany.com/datasets/data-company-sale-privacy-law/ · computed 2026-10-28

**Rules on the register:** 7 rules (7 statute and regulator pages read; 11 named).

## The answers, question by question

- **Where the rule applies:** US federal 3, California 2, United Kingdom 2
- **What the rule asks of the buyer:** honour the privacy promises the seller made 2, check the data in due diligence 2, honour opt-outs given to the seller 1, tell the people whose data it takes 1, not stated 1
- **Who enforces it:** not stated 4, a regulator 2, a regulator and the courts 1
- **The rule, in its words:** stated 7

## Every rule

| Rule | Where the rule applies | What the rule asks of the buyer | Who enforces it | The rule, in its words |
|---|---|---|---|---|
| California AB 1824, opt-outs in a merger | California | honour opt-outs given to the seller | not stated | This bill would require a business to which another business transfers the personal… |
| California Civil Code 1798.140, the merger exception to a sale | California | tell the people whose data it takes | not stated | The business transfers to a third party the personal information of a consumer as an… |
| Federal Trade Commission Act, unfair or deceptive practices | US federal | not stated | a regulator | the Commission is empowered, among other things, to (a) prevent unfair methods of… |
| FTC conditions on selling RadioShack customer data | US federal | honour the privacy promises the seller made | a regulator and the courts | The letter recommends that consumer information be sold only to another entity that is in… |
| FTC letter on Facebook's acquisition of WhatsApp | US federal | honour the privacy promises the seller made | a regulator | The letter notes that before making any material changes to how they use data already… |
| ICO data sharing code: databases and lists | United Kingdom | check the data in due diligence | not stated | The transfer of databases or lists of individuals is a form of data sharing, whether for… |
| ICO data sharing code: mergers and acquisitions | United Kingdom | check the data in due diligence | not stated | This includes establishing the purposes for which the data was originally obtained, your… |

## The sentence each answer rests on (28)

- California AB 1824, opt-outs in a merger, [California bill text](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB1824), read 2026-10-28, Where the rule applies: "California Consumer Privacy Act of 2018: opt out right: mergers."
- California AB 1824, opt-outs in a merger, [California bill text](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB1824), read 2026-10-28, What the rule asks of the buyer: "to comply with a consumer’s opt out direction to the transferor"
- California AB 1824, opt-outs in a merger, [California bill text](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB1824), read 2026-10-28, Who enforces it: Left open by the statute or regulator page (7,510 characters, read in full 2026-10-28).
- California AB 1824, opt-outs in a merger, [California bill text](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB1824), read 2026-10-28, The rule, in its words: "This bill would require a business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all or part of the transferor to comply with a consumer’s opt out direction to the transferor."
- California Civil Code 1798.140, the merger exception to a sale, [California Civil Code](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, Where the rule applies: "California Code, CIV 1798.140"
- California Civil Code 1798.140, the merger exception to a sale, [California Civil Code](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, What the rule asks of the buyer: "it shall provide prior notice of the new or changed practice to the consumer"
- California Civil Code 1798.140, the merger exception to a sale, [California Civil Code](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, Who enforces it: Left open by the statute or regulator page (36,374 characters, read in full 2026-10-08).
- California Civil Code 1798.140, the merger exception to a sale, [California Civil Code](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, The rule, in its words: "The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title."
- Federal Trade Commission Act, unfair or deceptive practices, [FTC statute page](https://www.ftc.gov/legal-library/browse/statutes/federal-trade-commission-act), read 2026-10-28, Where the rule applies: "The Federal Trade Commission Act is the primary statute of the Commission."
- Federal Trade Commission Act, unfair or deceptive practices, [FTC statute page](https://www.ftc.gov/legal-library/browse/statutes/federal-trade-commission-act), read 2026-10-28, What the rule asks of the buyer: Left open by the statute or regulator page (3,279 characters, read in full 2026-10-28).
- Federal Trade Commission Act, unfair or deceptive practices, [FTC statute page](https://www.ftc.gov/legal-library/browse/statutes/federal-trade-commission-act), read 2026-10-28, Who enforces it: "the Commission is empowered, among other things, to (a) prevent unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce"
- Federal Trade Commission Act, unfair or deceptive practices, [FTC statute page](https://www.ftc.gov/legal-library/browse/statutes/federal-trade-commission-act), read 2026-10-28, The rule, in its words: "the Commission is empowered, among other things, to (a) prevent unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce"
- FTC conditions on selling RadioShack customer data, [FTC press release, 2015](https://www.ftc.gov/news-events/news/press-releases/2015/05/ftc-requests-bankruptcy-court-take-steps-protect-radioshack-consumers-personal-information), read 2026-10-22, Where the rule applies: "Federal Trade Commission Consumer Protection Director Jessica Rich recommended conditions the court could place on the sale of consumers’ personal information"
- FTC conditions on selling RadioShack customer data, [FTC press release, 2015](https://www.ftc.gov/news-events/news/press-releases/2015/05/ftc-requests-bankruptcy-court-take-steps-protect-radioshack-consumers-personal-information), read 2026-10-22, What the rule asks of the buyer: "that the buyer agree to be bound by the RadioShack privacy policies that were in place when the consumers’ data was collected"
- FTC conditions on selling RadioShack customer data, [FTC press release, 2015](https://www.ftc.gov/news-events/news/press-releases/2015/05/ftc-requests-bankruptcy-court-take-steps-protect-radioshack-consumers-personal-information), read 2026-10-22, Who enforces it: "recommended conditions the court could place on the sale of consumers’ personal information to protect their privacy"
- FTC conditions on selling RadioShack customer data, [FTC press release, 2015](https://www.ftc.gov/news-events/news/press-releases/2015/05/ftc-requests-bankruptcy-court-take-steps-protect-radioshack-consumers-personal-information), read 2026-10-22, The rule, in its words: "The letter recommends that consumer information be sold only to another entity that is in substantially the same line of business as RadioShack"
- FTC letter on Facebook's acquisition of WhatsApp, [FTC press release, 2014](https://www.ftc.gov/news-events/news/press-releases/2014/04/ftc-notifies-facebook-whatsapp-privacy-obligations-light-proposed-acquisition), read 2026-10-28, Where the rule applies: "both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act"
- FTC letter on Facebook's acquisition of WhatsApp, [FTC press release, 2014](https://www.ftc.gov/news-events/news/press-releases/2014/04/ftc-notifies-facebook-whatsapp-privacy-obligations-light-proposed-acquisition), read 2026-10-28, What the rule asks of the buyer: "regardless of the acquisition, WhatsApp must continue to honor these promises to consumers"
- FTC letter on Facebook's acquisition of WhatsApp, [FTC press release, 2014](https://www.ftc.gov/news-events/news/press-releases/2014/04/ftc-notifies-facebook-whatsapp-privacy-obligations-light-proposed-acquisition), read 2026-10-28, Who enforces it: "both companies could be in violation of Section 5 of the Federal Trade Commission (FTC) Act and, potentially, the FTC’s order against Facebook"
- FTC letter on Facebook's acquisition of WhatsApp, [FTC press release, 2014](https://www.ftc.gov/news-events/news/press-releases/2014/04/ftc-notifies-facebook-whatsapp-privacy-obligations-light-proposed-acquisition), read 2026-10-28, The rule, in its words: "The letter notes that before making any material changes to how they use data already collected from WhatsApp subscribers, the companies must get affirmative consent."
- ICO data sharing code: databases and lists, [ICO data sharing code of practice](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/), read 2026-10-28, Where the rule applies: "check what information was given to individuals in accordance with Article 14 of the UK GDPR"
- ICO data sharing code: databases and lists, [ICO data sharing code of practice](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/), read 2026-10-28, What the rule asks of the buyer: "What must we do to ensure the database or list we are receiving is being shared in compliance with the law?"
- ICO data sharing code: databases and lists, [ICO data sharing code of practice](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/), read 2026-10-28, Who enforces it: Left open by the statute or regulator page (8,921 characters, read in full 2026-10-28).
- ICO data sharing code: databases and lists, [ICO data sharing code of practice](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/), read 2026-10-28, The rule, in its words: "The transfer of databases or lists of individuals is a form of data sharing, whether for money or other consideration, and whether for profit or not."
- ICO data sharing code: mergers and acquisitions, [ICO data sharing code of practice](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/), read 2026-10-27, Where the rule applies: "Under the UK GDPR you are required to keep individual data subjects informed about certain changes relating to the processing of their data"
- ICO data sharing code: mergers and acquisitions, [ICO data sharing code of practice](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/), read 2026-10-27, What the rule asks of the buyer: "you must consider data sharing as part of the due diligence you carry out when taking on the organisation and its obligations"
- ICO data sharing code: mergers and acquisitions, [ICO data sharing code of practice](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/), read 2026-10-27, Who enforces it: Left open by the statute or regulator page (7,339 characters, read in full 2026-10-27).
- ICO data sharing code: mergers and acquisitions, [ICO data sharing code of practice](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/), read 2026-10-27, The rule, in its words: "This includes establishing the purposes for which the data was originally obtained, your lawful basis for sharing it, and whether these have changed following the merger or acquisition."

## Read and set aside

- [FTC: data in merger review](https://www.ftc.gov/enforcement/competition-matters/2015/06/not-so-big-news-about-big-data): an FTC competition blog post on big data in merger analysis; it states no rule on the customer data in a sale
- [UK GDPR Article 6 (legislation.gov.uk)](https://www.legislation.gov.uk/eur/2016/679/article/6): a general UK GDPR article; the board records the ICO's merger and database guidance that applies it to a sale (sources 8 and 9)
- [UK GDPR Article 14 (legislation.gov.uk)](https://www.legislation.gov.uk/eur/2016/679/article/14): a general UK GDPR article; the board records the ICO's merger and database guidance that applies it to a sale (sources 8 and 9)

## Methodology

Each rule's own US and UK statutes, regulations and regulators' guidance were read through estate-fetch and stored whole (sha256 on every row). For every statute or regulator page, four questions were answered from its own words: where the rule applies, what the rule asks of the buyer, who enforces it, the rule, in its words. Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the statute or regulator page read does not address the question. A rule with several statute and regulator pages reads 'varies' where they disagree. 7 rules, 7 statute and regulator pages.

## Sources

- [FTC: Facebook and WhatsApp notified of privacy obligations in the acquisition](https://www.ftc.gov/news-events/news/press-releases/2014/04/ftc-notifies-facebook-whatsapp-privacy-obligations-light-proposed-acquisition) (read)
- [FTC business blog: privacy promises prevail](https://www.ftc.gov/news-events/blogs/business-blog/2014/04/ftc-staff-facebook-whatsapp-privacy-promises-prevail) (unread)
- [FTC: RadioShack bankruptcy and customer data](https://www.ftc.gov/news-events/news/press-releases/2015/05/ftc-requests-bankruptcy-court-take-steps-protect-radioshack-consumers-personal-information) (read)
- [FTC: data in merger review](https://www.ftc.gov/enforcement/competition-matters/2015/06/not-so-big-news-about-big-data) (not-terms)
- [FTC Act](https://www.ftc.gov/legal-library/browse/statutes/federal-trade-commission-act) (read)
- [California Civil Code 1798.140 (CCPA definitions)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140) (read)
- [California AB 1824 (2024)](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB1824) (read)
- [ICO: due diligence when sharing data following mergers and acquisitions](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/) (read)
- [ICO: sharing personal data in databases and lists](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/) (read)
- [UK GDPR Article 6 (legislation.gov.uk)](https://www.legislation.gov.uk/eur/2016/679/article/6) (not-terms)
- [UK GDPR Article 14 (legislation.gov.uk)](https://www.legislation.gov.uk/eur/2016/679/article/14) (not-terms)

## Cite or embed

- 7 US and UK rules on the customer data inside a data company that changes hands, read 28 October 2026.
- Where the rule applies, by rule: US federal 3 of 7, California 2 of 7, United Kingdom 2 of 7 (7 rules, read 28 October 2026).
- What the rule asks of the buyer, by rule: check the data in due diligence 2 of 7, honour the privacy promises the seller made 2 of 7, honour opt-outs given to the seller 1 of 7, not stated 1 of 7, tell the people whose data it takes 1 of 7 (7 rules, read 28 October 2026).
- Who enforces it, by rule: not stated 4 of 7, a regulator 2 of 7, a regulator and the courts 1 of 7 (7 rules, read 28 October 2026).
- The rule, in its words, by rule: stated 7 of 7 (7 rules, read 28 October 2026).

Cite as: "The law on customer data when a data company is sold", updated 2026-10-28, https://selldatacompany.com/datasets/data-company-sale-privacy-law/.

CSV: https://selldatacompany.com/datasets/data-company-sale-privacy-law.csv
JSON: https://selldatacompany.com/datasets/data-company-sale-privacy-law.json
Embed (plain HTML, static link back): see https://selldatacompany.com/datasets/data-company-sale-privacy-law/#lead