Inventory the promised uses before valuing the list
A buyer may describe a customer database as an immediate cross-selling opportunity. The seller should verify which information can actually support that opportunity before the price assumes unrestricted use. Customer records arrive with a history: the privacy notice displayed when information was collected, contractual restrictions, choices customers exercised, and representations made by employees or in marketing materials. Transferring the business does not make that history disappear.
The FTC’s published guidance concerning the Facebook and WhatsApp acquisition explains that privacy promises remain relevant after an acquisition. It describes materially inconsistent uses without affirmative express consumer consent as potentially unfair under Section 5 of the FTC Act. That guidance arose from particular facts and an existing order; it is not a substitute for examining the proposed transaction. Its practical lesson for a seller is to identify collection promises before representing that the buyer can deploy every record for a new purpose.
Ask the diligence team to distinguish ordinary service continuation from proposed changes such as combining datasets, sharing records with additional companies, or targeting unrelated products. These are separate use cases requiring their own assessment. A generic statement that the buyer will continue operating the business does not resolve all of them.
Model value from eligible records
Consider a hypothetical sale with 30,000 customer records. The buyer’s model assumes that 20% will generate a $70 contribution from a new offer, producing $420,000 of projected contribution before integration expenses. Diligence identifies only 12,000 records with a supported basis for the contemplated campaign, while the remaining records require further analysis or a new consent process. Applying the same purely illustrative response assumption to 12,000 records produces $168,000, a $252,000 difference.
That difference does not establish a legal penalty or automatically reduce the enterprise price by the same amount. It reveals that a forecast depends on permissions rather than merely database size. A new consent request may also produce a response rate materially different from the buyer’s sales conversion assumption. Separate those two rates and identify the evidence supporting each.
The seller can respond by correcting the usable-record representation, changing the integration plan, or negotiating a contingent value mechanism tied to an appropriately permitted outcome. Do not promise to obtain consent from every customer if the seller cannot control whether customers respond. Avoid a purchase price formula that rewards practices the parties have not cleared.
Control disclosure during diligence and integration
Prepare a record inventory by source, collection period, information type, notice version, customer choice, retention status, and intended buyer use. Preserve screenshots or archived copies of notices rather than relying on the version currently displayed on the website. A policy changed last month may not describe promises made to customers five years earlier.
The diligence process itself needs a disclosure plan. Determine what information is necessary to evaluate the business and whether aggregated or appropriately limited information answers the question. Assign access through the agreed transaction process, and document who may export records. A commercial confidentiality agreement is useful, but it does not independently resolve every privacy obligation attached to the underlying information.
Before closing, create an integration matrix assigning each proposed dataset and use to an accountable owner. Include any required notices, consents, restrictions, system changes, and release conditions. The technical team should know which records remain restricted when systems merge. A limitation buried in the purchase agreement will be ineffective operationally if the migration script places all customers in the same marketing audience.
Retain the evidence and define the limits
Keep the notice history, consent records, opt-out information, data inventory, diligence disclosure log, integration approvals, and contractual allocation of responsibility. Reconcile the delivered database against the described population so that missing choices or labels are detected before a campaign launches. Where records must remain segregated, specify how the buyer will preserve that segregation and test the result.
The FTC acquisition guidance addresses a federal consumer protection issue. State privacy statutes, sector-specific confidentiality rules, customer contracts, foreign laws, and existing regulatory orders can impose additional requirements. The transaction team should identify the applicable regimes from actual customers, information, activities, and geography. An asset sale, stock sale, and insolvency transaction can also present different transfer questions.
A useful closing deliverable is therefore a supported data-use schedule, not a categorical warranty that all information is freely reusable. State the records covered, the authorized operational purpose, unresolved populations, and the actions required before expansion. This turns an uncertain customer asset into a reviewable integration decision and gives both parties a way to check the assumptions underlying the price.
Sources & further reading
Consult the original guidance and its effective dates. These references support the educational discussion; their application depends on the specific facts.