Can You Transfer Customer Data When Selling Your Business?

When you're selling a business, there's usually a lot to think about. Between finalizing contracts, agreeing on a price and preparing for the handover, it's easy for certain details to get overlooked. Sometimes, those smaller details can raise much bigger legal questions later on.

One of those details is customer information.

Over time, your business might have collected hundreds or even thousands of customer records, from contact details and purchase histories to account information and ongoing service agreements. These records can be valuable to a potential buyer, particularly if they're planning to continue running the business.

But can you simply hand over that information when the sale goes through? Do customers need to be notified, or even give their consent?

In the US, privacy laws and existing customer agreements can affect how information is transferred during a business sale. The requirements may also differ depending on which states are involved and how the information was originally collected.

Let's look at what sellers and buyers should consider.

Can You Transfer Customer Data When Selling a Business?

Yes, customer data can form part of a business sale. However, whether you can legally transfer particular records depends on the transaction, applicable privacy laws and any existing promises you've made to customers.

The structure of the sale can make a difference.

In a stock or equity sale, the buyer purchases ownership interests in the business, such as corporate shares or LLC membership interests. The business generally remains the same legal entity and continues holding its customer information.

In an asset sale, the buyer purchases particular assets, potentially including customer databases, contracts and intellectual property. This may involve transferring personal information to a different legal entity.

For example, selling shares in your company doesn't necessarily involve disclosing customer data to another business. However, selling a customer database as part of an asset purchase can raise additional privacy considerations.

Neither structure automatically removes the need to comply with applicable privacy laws or contractual restrictions.

What Privacy Laws Apply When Selling a Business?

Unlike some other jurisdictions, the US doesn't have one comprehensive federal privacy law governing every business that collects or transfers customer information.

Instead, businesses may need to consider a combination of federal and state laws.

At the federal level, the Federal Trade Commission (FTC) can take action against unfair or deceptive business practices under Section 5 of the FTC Act. This includes certain misleading representations about how customer information will be handled.

State privacy laws can impose additional requirements relating to the collection, disclosure, sale and use of personal data.

For example, the California Consumer Privacy Act (CCPA), as amended, gives California residents covered by the law certain rights over their personal information and imposes obligations on businesses meeting its applicability requirements.

Other states, including Virginia, Colorado and Connecticut, have their own comprehensive consumer privacy laws.

These laws don't apply to every business in the same way. Whether they apply can depend on factors such as revenue, the amount of personal data processed and the nature of the business's activities.

Certain types of information can also attract additional protections. For example, health information, children's personal information and financial records may be subject to specific federal or state requirements.

Before transferring customer records, it's important to understand which laws apply to the information and the proposed transaction.

What if Your Privacy Policy Doesn't Allow Customer Data to Be Sold?

This is one of the most important questions for US businesses.

A privacy policy isn't simply a document sitting on your website. It can contain promises about how customer information will be collected, used and shared.

If your business has told customers that their information won't be sold or disclosed to third parties, transferring it to a buyer may create legal issues.

A well-known example involves electronics retailer RadioShack.

In 2015, during RadioShack's bankruptcy proceedings, the FTC raised concerns about a proposed sale of customer information because the company had previously promised customers that their information wouldn't be sold.

The FTC recommended safeguards, including restrictions on who could purchase the information and how it could be used, to protect customers' existing privacy expectations.

This doesn't mean every business sale requires customer consent. However, it demonstrates why businesses should review existing privacy promises before agreeing to transfer customer records.

It's worth checking what customers were told when their information was collected, whether your policy addresses business transfers and how the buyer intends to use the information.

Simply updating a privacy policy immediately before the sale doesn't necessarily resolve restrictions arising from earlier promises.

Can You Share Customer Information With a Potential Buyer Before the Sale?

Privacy obligations can arise before the transaction is completed, particularly during due diligence.

A prospective buyer may want to inspect customer agreements, transaction histories or subscription records to understand the value of the business.

However, that doesn't necessarily mean they need unrestricted access to identifiable customer information.

For example, a buyer considering purchasing a subscription business might want to know how many customers renew each year and how much recurring revenue they generate.

The seller may be able to provide this information without revealing individual customer identities.

Where identifiable information genuinely needs to be shared, the seller should consider applicable privacy laws, existing customer commitments and confidentiality obligations.

A Non-Disclosure Agreement, secure data room or restricted document access can help protect confidential information. However, these arrangements don't override applicable privacy laws.

The buyer should also investigate how the information was originally collected, whether the seller has experienced previous data breaches and whether customer privacy choices have been properly recorded.

If negotiations fall through, the parties should follow their agreed arrangements for returning or securely deleting information, subject to any applicable retention requirements.

Do You Need Customer Consent or Have to Notify Them?

Not every US business sale requires customers to give consent before their information can be transferred.

However, that doesn't mean consent or notification will never be necessary.

The answer depends on applicable federal and state requirements, the information involved and any existing privacy promises.

When Might Customer Consent Be Required?

Some privacy laws impose specific consent requirements for particular uses or categories of personal information. Others provide consumers with rights to opt out of certain disclosures.

Importantly, selling a business and selling personal information aren't always treated as the same activity under state privacy laws.

California provides a useful example.

Under the CCPA, transferring personal information as part of a merger, acquisition, bankruptcy or similar transaction may fall outside the statutory definition of selling personal information, provided the relevant conditions are satisfied.

However, that doesn't give the buyer unlimited rights to use the information.

If the buyer materially changes how the information is used or shared in a way that conflicts with previous privacy promises, California law can require prior notice that gives consumers a meaningful opportunity to exercise their choices.

Businesses should therefore check the specific requirements applying to the transaction rather than assuming customer consent is either always necessary or never required.

Do You Have to Notify Customers About the Sale?

There isn't a universal federal requirement to notify every customer whenever a business changes ownership.

However, applicable state laws, contractual arrangements and existing privacy commitments may create notification obligations.

For example, if the buyer intends to use customer information for substantially different purposes, the parties should consider whether additional notice, consent or other requirements apply.

Even where a particular notification isn't mandatory, informing customers about the new ownership and how their information will be handled can help make the transition clearer.

Importantly, notifying customers doesn't automatically authorize an otherwise unlawful transfer or use of their information.

What Should the Business Sale Agreement Say About Customer Data?

A Business Sale Agreement should establish what is being transferred and each party's responsibilities before and after closing.

Where customer information is involved, the agreement should also address how those records will be handled.

Depending on the transaction, this may include:

• Scope of the transfer: Which customer databases and records are included, and whether particular information should be excluded.
• Privacy compliance: Each party's responsibilities for complying with applicable federal and state requirements.
• Customer notices and consent: Who is responsible for obtaining required permissions or providing notifications.
• Security and handover: How information will be transferred and who will have access to it.
• Representations, warranties and indemnities: How risks relating to previous data breaches, privacy compliance and customer complaints will be allocated.
• Retention and deletion: What information the seller can retain and what must be returned or deleted.

For example, a buyer might discover that the seller has experienced a data breach or cannot establish how certain customer information was originally collected.

These issues could affect whether the buyer can use that information as intended and what contractual protections it requires.

It's also important to remember that transferring customer data doesn't necessarily transfer the underlying customer contracts. Depending on their terms, the agreements may require assignment, consent or other arrangements before the buyer can take them over.

Addressing these matters before closing can help avoid disputes after the handover.

Can the Buyer Use the Customer Database After the Sale?

Receiving customer information doesn't automatically give the buyer unrestricted permission to use it however they choose.

The buyer should consider existing privacy promises, applicable consumer privacy laws and any restrictions contained in customer agreements.

For example, information transferred to help fulfill existing customer orders may not automatically be available for unrelated advertising or disclosure to other businesses.

Where state privacy laws apply, the buyer may also need to respect applicable consumer rights concerning access, deletion, correction and opting out of certain uses of personal information.

Can the Buyer Use Customer Details for Marketing?

Marketing is particularly important when a business sale includes customer email addresses or contact lists.

At the federal level, the CAN-SPAM Act regulates commercial email messages.

Unlike some other jurisdictions, CAN-SPAM generally doesn't require advance opt-in consent before sending ordinary commercial marketing emails.

However, businesses must comply with requirements including accurate sender information, non-deceptive subject lines, appropriate identification of advertising messages, a valid physical postal address and a functioning unsubscribe mechanism.

Valid unsubscribe requests must generally be honored within 10 business days.

There's also an important consideration when acquiring an existing mailing list: email addresses belonging to people who have opted out generally cannot be sold or transferred, except for limited compliance-related purposes.

For example, imagine purchasing an online retailer with 2,000 customer email addresses.

Before sending promotional emails, you'll need to consider applicable privacy restrictions, existing marketing preferences and whether the proposed messages comply with CAN-SPAM.

Marketing by text message or automated calls can raise separate requirements under the Telephone Consumer Protection Act (TCPA) and related rules.

The buyer should therefore review existing marketing permissions, suppression lists and customer preferences before using the acquired contact information.

What Happens to Customer Records After Closing?

Once the sale is completed, both parties may still have responsibilities concerning customer information.

For the buyer, this includes maintaining appropriate security, reviewing privacy notices and respecting applicable consumer privacy rights.

For the seller, an important question is what happens to any customer information remaining in their possession.

If the customer database formed part of the transaction, the seller shouldn't assume they can keep copies or continue using the information for another business.

The sale agreement may require certain records to be deleted, system access to be removed and the handover to be confirmed.

However, some information may need to be retained for tax, accounting, legal or other permitted purposes.

The parties should establish what information each can retain, why it's needed and what restrictions apply after closing.

Need Help With the Legal Side of Selling Your Business?

Customer information can be a valuable part of a business sale, but transferring it involves more than handing over a database.

Before closing, it's important to review existing privacy commitments, understand which laws apply and make sure the transaction documents properly address how customer information will be handled.

Sprintlaw can help you scope your legal needs and arrange support with Business Sale Agreements and relevant data and privacy documentation.

Contact us at team@sprintlaw.com or call (888) 449-8437 to discuss how we can help.