What Happens to Your Data When a Tech Company Gets Acquired

When a tech company is acquired, the personal data it collected, names, emails, location histories, health records, biometric profiles, and behavioural logs generally transfer to the acquiring company as a business asset.

Regulators in the United States and the European Union require the new owner to honour the original privacy promises unless it obtains fresh consent to change them. Still, enforcement gaps, bankruptcy loopholes, and vague consent language mean that, in practice, protection is far weaker than most users assume.

That gap between legal theory and operational reality is where almost every consumer horror story about acquired data originates.

A privacy policy is a contract, but contracts get reinterpreted, sold in pieces, and occasionally tested in bankruptcy court, where the normal rules bend in ways most users never anticipate.

Data Is Treated as a Business Asset, Not a Personal Possession

The first thing to understand, and the fact that most coverage of this topic glosses over, is that user data sits on a company’s balance sheet much like inventory or intellectual property.

In an asset purchase, a stock purchase, or a full merger, the database of names, purchase histories, and account credentials is one of the line items being valued, transferred, and warrantied between buyer and seller.

This is not a loophole.

It is the explicit design of how corporate transactions work. At closing, the purchaser typically expects to receive all personal data related to the acquired business, and, depending on the deal structure, that data may remain hosted on the very systems being sold as part of the transaction.

What changes hands varies by deal structure, and the distinction matters more than most acquisition announcements let on:

Stock or equity acquisitions. The legal entity itself does not change. The company that collected the data is still, technically, the same company; only its ownership has shifted. Data obligations, contracts, and privacy commitments carry forward largely intact because nothing has formally changed hands.

Asset acquisitions. The buyer purchases specific assets, such as the customer database, while leaving liabilities behind in the old entity.

This structure is common in distressed sales and is precisely where privacy advocates raise the most concern, because a buyer can sometimes acquire the valuable data asset while sidestepping liabilities tied to how that data was originally handled.

Bankruptcy sales under Section 363. This is the structure that produces the most consumer anxiety, and for good reason. Section 363(b) of the Bankruptcy Code looks to the company’s privacy policy to determine whether it can sell or lease the personal information it holds, and most state comprehensive privacy laws exempt bankruptcy transfers from the definition of a data sale, which means the usual notice-and-opt-out machinery that would normally kick in does not apply in the same way.

The Regulatory Baseline: Promises Survive the Sale, in Theory

Anyone researching this topic will quickly encounter the same foundational principle, repeated in nearly every legal analysis: a change in ownership does not erase the privacy commitments made when the data was collected.

The Federal Trade Commission has enforced this position for more than two decades, and the doctrine traces back further than most people realize.

The FTC’s position has precedent in its 2004 case against Gateway Learning Corp., where the agency challenged the company for renting out personal information after promising it would never share data with third parties without explicit consent. That case established the template the agency still applies today: a privacy policy is an enforceable promise, not marketing copy.

The doctrine was tested more publicly when Facebook acquired WhatsApp in 2014. The FTC’s Bureau of Consumer Protection wrote directly to both companies, noting that WhatsApp had made commitments about the limited nature of its data collection that exceeded what Facebook promised its own users, and that those commitments had to survive the acquisition regardless of the change in ownership.

The letter made explicit that any material change in how the acquired data would be used required affirmative opt-in consent from the people it belonged to, not a buried update to a terms-of-service page.

That episode produced a now-standard piece of boilerplate. In the wake of the FTC’s 2000 case against Toysmart, which alleged the company violated the law by offering customer data for sale despite promising it never would, businesses quickly began rewriting their privacy policies to explicitly anticipate future mergers and acquisitions, with Amazon adding language stating that customer information would be treated as a transferred business asset in the event of a sale or acquisition.

That single clause, now copied into privacy policies across the industry, is the legal mechanism that makes most data transfers in acquisitions lawful from day one. Users consented to the transfer the moment they accepted the policy, often years before any acquisition was a possibility.

The FTC has since articulated three concrete options available to an acquiring company, and understanding them is the single most practical thing a reader can take from this topic: continue honoring the target’s existing privacy promises without modification, obtain affirmative opt-in consent before changing how previously collected data is used, or provide prominent notice (with an opt-out, though not necessarily opt-in consent) for data collected after the deal closes under new terms.

Why the GDPR Framework Forces a Sharper Conversation

European regulation approaches the same problem from a different angle, and the contrast is instructive. Under the GDPR, a change in ownership makes the acquiring company the new data controller. That shift in legal status means the acquirer generally must reconfirm consent where the existing legal basis for processing does not survive the transaction.

Consent, under European law, has to be freely given and specific to a stated purpose. A new owner with new commercial intentions for the same dataset cannot simply inherit consent obtained for a different purpose by a different controller.

In practice, deal teams handle this by mapping every category of personal data against one of the six lawful bases for processing recognized under Article 6, which include consent, contractual necessity, legal obligation, vital interests, public interest, and the legitimate interests of the controller, before a transaction even closes.

A data processing inventory, formally known as a Record of Processing Activities under GDPR Article 30, is the foundational document that catalogs what data exists, why it was collected, and which legal basis the buyer can rely on going forward.

Acquisitions that skip this step, or that discover during integration that the target’s consent records do not hold up, are where the costliest post-merger privacy liabilities tend to surface, often a year or more after the ink has dried.

The Bankruptcy Exception Nobody Plans For

The single biggest misconception in public conversation about acquired data is the assumption that ordinary privacy protections always apply. They do not, and the 23andMe collapse is the clearest case study available, precisely because it unfolded in full public view across 2025.

When the genetic testing company filed for Chapter 11 protection in March 2025, the filing potentially set in motion the sale of genetic data collected from more than 15 million people, and a wave of state attorneys general urged customers to delete their accounts before any sale could close.

A bankruptcy judge ruled within days that 23andMe had the legal right to sell customers’ medical and ancestry data to potential bidders, a decision that startled many observers who assumed genetic information carried special protection that ordinary purchase history did not.

It largely does not, at least not under federal bankruptcy law. Section 363(b)(1)(B) of the Bankruptcy Code offers some protection for personally identifiable information by requiring a court-appointed consumer privacy ombudsman when a sale would violate the seller’s existing privacy policy.

Still, the statute does not expressly reference genetic data as a distinct category, leaving a gap that current law was never written to anticipate. Regeneron Pharmaceuticals initially won the bidding process with a commitment to honour the company’s existing privacy practices, but the final buyer turned out to be different.

A nonprofit called the TTAM Research Institute, founded and led by 23andMe co-founder Anne Wojcicki, ultimately won court approval for the acquisition, with the presiding judge writing that the deal’s structure involved a sale of customer data only in a technical sense.

The mechanics of that final ruling matter for anyone trying to understand what protection actually looks like in practice. Roughly eighty percent of 23andMe’s customer base had already agreed to allow their data to be used for research.

The new institute pledged to maintain the company’s existing privacy policies, continue allowing customers to delete their data at will, and operate under the same cybersecurity protections and management as before, an outcome that satisfied most, though not all, of the state attorneys general who had challenged the sale.

The lesson for any reader navigating an acquisition involving a company that holds their data: the existence of a strong privacy policy does not guarantee the company behind it will remain solvent, and insolvency proceedings operate under a different rulebook than ordinary commercial transactions. A privacy policy promise is only as durable as the company’s balance sheet.

What Actually Happens, Step by Step

Setting aside edge cases like bankruptcy, the standard acquisition follows a fairly consistent sequence, and knowing where in that sequence user data sits explains a lot about why announcements feel reassuring. At the same time, practical changes still creep in months later.

During due diligence, before any deal closes. The acquiring company’s legal and technical teams review the target’s data infrastructure inside a secure virtual data room.

This review typically covers a data map outlining where information is stored and how it is secured, the company’s privacy policies and external-facing notices, and the specific rules governing how personal information is collected, used, shared, retained, and ultimately destroyed.

Buyers are, in effect, pricing in the risk that the data they are acquiring comes with hidden compliance liabilities, expired consent, undocumented vendor relationships, and regulatory exposure in jurisdictions where they have not previously operated.

This stage is also where deals quietly die or get repriced. A target whose data practices do not match its public privacy policy, or whose consent records cannot be located, represents a contingent liability that shows up in the purchase price, the escrow terms, or the indemnification clauses, long before any customer notices a thing.

At signing and closing. The contracts that transfer ownership specify exactly what happens to the data asset, and increasingly include explicit representations and warranties about privacy compliance, breach history, and regulatory standing. Sophisticated buyers now build remediation plans directly into the deal terms rather than treating privacy as a closing condition to check off and forget.

During integration, the part users actually experience. This is where databases are merged, systems are consolidated, and, critically, a company decides whether it can simply absorb the acquired data under its existing practices or needs to go back to users for fresh permission.

Integration is also when security posture often temporarily weakens. A large acquiring company may have well-established cybersecurity defences.

Still, those defences are not always extended quickly or completely to a smaller acquired division during the integration window, creating a period of elevated vulnerability that outlasts the press release announcing the deal.

Common Misconceptions Worth Correcting

A few assumptions show up repeatedly in how people talk about this topic, and most of them do not hold up.

“My data gets deleted if I never agreed to be acquired.” There is no such consent requirement, and no general legal right that triggers automatic deletion simply because ownership changed.

The relevant question is always whether the new owner intends to use the data differently from what was promised, not whether the user specifically blessed the transaction itself.

“Anonymized data is safe regardless of who buys it.” This assumption has aged badly. The FTC’s enforcement posture in 2025 and 2026 has explicitly established that certain categories of data, particularly precise location information, are treated as inherently sensitive regardless of whether the dataset has been anonymized or whether individual names are attached, because that data can still reveal visits to medical facilities, religious institutions, or other sensitive locations when combined with other available information.

Re-identification risk does not disappear just because a spreadsheet has had names stripped out before a sale.

“A company can quietly start selling data it always kept private, as long as it updates the privacy policy first.” This is precisely the misreading that the FTC’s Gateway and Toysmart precedents were designed to foreclose.

A retroactive policy change does not retroactively authorize new uses of data already collected under a stricter promise; the agency’s consistent position is that the original promise governs the data collected under it, unless affected users are given a genuine choice to accept the new terms.

“Smaller acquisitions fly under the radar of these protections.” Deal size affects antitrust scrutiny far more than it affects baseline privacy obligations.

The Gateway case that established the modern doctrine involved a homework-software company, not a tech giant. The legal exposure scales with the sensitivity of the data and the clarity of the original promise, not with the size of the transaction.

What Users Can Actually Do

The honest answer is that consumer leverage in these situations is limited, but not zero, and the available options are worth knowing before a deal is announced rather than after.

Read the acquisition notice for any mention of a material change in data practices, as that language triggers a consent requirement under FTC doctrine. A notice that announces new ownership without describing a change in practices generally means the existing privacy policy still governs.

Exercise deletion rights immediately if the acquired company is in financial distress, rather than waiting for a sale to be finalized. In the 23andMe case, the surviving entity continued to allow customers to delete their data at will even after the sale closed. Still, that option remains at the discretion of the entity that ultimately owns the platform. A deletion request submitted before closing is unambiguously cleaner than one submitted after.

Check whether the data category involved qualifies as sensitive under applicable state law. Comprehensive state privacy laws, including California’s CCPA and Washington’s My Health My Data Act, generally classify genetic and health information as sensitive and grant consumers a right to delete it, though most of these laws specifically exempt bankruptcy transfers from the rules that would otherwise apply to a data sale.

The protections that exist in an ordinary commercial sale frequently evaporate the moment a company files for Chapter 11.

Watch the regulatory environment, not just the company’s own statements. The FTC’s current enforcement priorities, which include youth privacy, AI companion products, and a continued focus on data brokers under the Protecting Americans’ Data from Foreign Adversaries Act, shape how aggressively any given acquisition will be scrutinized after the fact.

The Practical Bottom Line

Tech acquisitions do not, as a rule, strip away the privacy commitments a company made before it was bought.

What they do is create a moment of maximum ambiguity, where the old promises technically still apply, the new owner has every commercial incentive to change them eventually, and the mechanism for enforcing the difference depends heavily on whether the user is paying close enough attention to the announcement’s fine print.

The strongest practical safeguard is not a feature of the law at all: it is reading the specific language a company uses when it announces who is buying it, since that language, more than the brand name on the press release, determines what happens next.

What People Ask