You might assume that when a remote company gets acquired, your data and the privacy promises attached to it simply transfer to the new owner intact. That’s partly true, but the full picture is more layered — and the protections you have depend heavily on the structure of the deal, whether the company is solvent when it changes hands, and how closely you read the fine print in the acquisition announcement. Most of what follows about acquisition mechanics comes from TheCityCeleb’s reporting, which traces how data changes ownership in practice, so I’ll be leaning on that as the backbone for the legal side of things.
Company Acquisitions
Remote Work Security
The Data Asset Nobody Talks About
In an acquisition, user data isn’t a byproduct of the deal — it’s a line item. Names, emails, purchase histories, account credentials, location logs, and in some cases health records or biometric profiles are valued, transferred, and warrantied between buyer and seller just like any other business asset. The acquiring company typically expects to receive all personal data related to the business it’s buying, and that data may remain hosted on systems that are being sold as part of the transaction.
But the way the deal is structured matters a great deal for what happens to your data afterward. In a stock or equity acquisition, the legal entity that collected your data doesn’t change — only ownership shifts. That means the company’s existing privacy commitments and contracts carry forward largely intact because the same legal entity remains responsible for them. In an asset acquisition, the buyer purchases specific assets — including the customer database — while leaving liabilities behind in the old entity. This structure is common in distressed sales, and it means the buyer can acquire a valuable data asset while sidestepping liabilities tied to how that data was originally handled.
The practical difference isn’t academic. A stock sale means the promises made when you signed up are more likely to stick because the same company — now under new ownership — remains legally bound by them. An asset sale, especially in a distressed scenario, creates a cleaner break: the buyer gets your data but not the obligations that came with collecting it, unless regulators step in.
A Promise Is Still a Promise (Until It Isn’t)
The Federal Trade Commission has held for over two decades that a change in ownership does not erase the privacy commitments a company made when it collected your data. The 2004 case against Gateway Learning Corp. established this principle: the company had promised users it would never share their personal information with third parties without explicit consent, then rented out that data anyway. The FTC said that a privacy policy is an enforceable promise, not marketing copy.
That doctrine was tested again in 2014 when the FTC’s Bureau of Consumer Protection wrote directly to Facebook and WhatsApp ahead of their merger, making clear that WhatsApp’s commitments about limited data collection had to survive the acquisition regardless of who owned the company. Any material change in how previously collected data would be used required affirmative opt-in consent — not a buried update to terms of service. The agency articulated three options for any acquiring company: continue honoring the target’s existing privacy promises without modification; obtain affirmative opt-in consent before changing how previously collected data is used; or provide prominent notice with an opt-out for data collected after the deal closes under new terms.
There’s a catch, and it’s a big one. After the Toysmart case in 2000 — where the FTC alleged the company violated the law by offering customer data for sale despite promising it never would — businesses across the industry rewrote their privacy policies to explicitly anticipate mergers and acquisitions. Amazon added language stating that customer information would be treated as a transferred business asset in the event of a sale or acquisition. That clause, now standard across the tech industry, is the legal mechanism that makes most data transfers in acquisitions lawful from day one. You consented to that transfer when you accepted the policy, often years before any deal was announced.
The clause that allows your data to be transferred in an acquisition is already in the privacy policy you agreed to — probably since before the company was even thinking about selling. That doesn’t make it deceptive, but it does mean the “notice” you get at acquisition time is often just confirming what you already consented to. The real question is whether the new owner plans to use your data differently than the original company promised.
The Bankruptcy Wild Card
All of those protections weaken significantly when a company files for bankruptcy. Section 363 of the U.S. Bankruptcy Code allows a court to approve the sale of customer data as part of a debtor’s assets, and most state comprehensive privacy laws explicitly exempt bankruptcy transfers from the notice-and-opt-out rules that would normally apply to a data sale.
The 23andMe case is the clearest recent example. When the company filed for Chapter 11 in March 2025, the bankruptcy judge ruled that it had the legal right to sell customers’ medical and ancestry data to bidders — data from over 15 million people. State attorneys general urged customers to delete their accounts before the sale could go through. The winning bidder was TTAM Research Institute, a nonprofit founded and led by 23andMe’s co-founder, which pledged to maintain the existing privacy policies, continue allowing customers to delete data at will, and operate under the same cybersecurity protections. The judge noted that the deal’s structure involved a sale of customer data “only in a technical sense.”
The lesson here isn’t that privacy policies are meaningless — it’s that they’re only as durable as the company’s balance sheet. Roughly 80% of 23andMe’s customer base had agreed to allow their data to be used for research, and the new entity promised to honor those choices. But the fact that a bankruptcy court even had to weigh the question at all reveals a gap in the legal framework: federal bankruptcy law does not explicitly reference genetic data as a protected category, leaving a lot of room for interpretation when a company’s debts outpace its promises.
What You Can Actually Do About It
There’s no general legal requirement that a company delete your data before a sale or merger closes. Your data is an asset, and the new owner is buying it. But you do have options, and the timing matters.
- Read the acquisition notice for language about changed data practices. If the announcement only mentions new ownership without describing a change in how your data will be used, the existing privacy policy still governs. If it mentions a material change, that triggers a consent requirement under FTC doctrine.
- Exercise deletion rights immediately if the company is in financial distress. Before a sale closes, your deletion request is cleaner and harder for the company to ignore. After the sale, the new owner may still honor deletion requests — as TTAM Research Institute did with 23andMe — but that’s at their discretion, not your right.
- Check whether your data category qualifies as sensitive under your state’s law. California’s CCPA and Washington’s My Health My Data Act classify genetic and health information as sensitive and grant you a right to delete. But most of these laws exempt bankruptcy transfers, so the protections that apply in an ordinary commercial sale can evaporate upon a Chapter 11 filing.
The strongest practical safeguard is reading the specific language a company uses when it announces a buyer. That language determines what happens next — whether the existing privacy policy carries forward, whether you’ll be asked for fresh consent, or whether the company is signaling that data practices are about to change. If you’re a user of a service that’s been acquired, that announcement is the single most important document you’ll see.
The Remote Work Blind Spot
If you work for a remote company that gets acquired, there’s another layer to watch. During the integration period after a deal closes — when databases are being merged, systems consolidated, and security protocols aligned — the security posture of the acquired division often temporarily weakens. A large acquiring company’s cybersecurity defenses don’t always extend quickly or completely to a smaller acquired unit, creating a window of elevated vulnerability that can outlast the press release announcing the deal.
This is where the broader remote work privacy risks that researchers track come into sharp focus. Employees working from home may be using personal devices, connecting through unsecured home networks, or relying on AI tools that weren’t vetted by the acquiring company’s security team. The National Law Review’s privacy practice group has noted that companies acquiring a remote workforce often inherit a patchwork of device policies, data storage practices, and third-party vendor relationships that weren’t designed to withstand the scrutiny of a post-acquisition audit.
If you’re an employee of a company being acquired, this is the moment to pay attention to access permissions, device management policies, and any new tools being rolled out during the transition. The acquiring company’s privacy team is likely doing a data map and reviewing consent records, but that process can take months — and in the meantime, the data is flowing through the same channels it always did, just under new ownership with potentially different expectations about how it should be handled.
If your employer is acquired, your work data — client lists, internal communications, project files — becomes part of the asset transfer just like customer data does. The acquiring company’s policies around monitoring, AI tool usage, and data retention may differ from what you’re used to. It’s worth reviewing the new company’s privacy policies, especially if you use personal devices for work or access company systems from shared household networks.
The system works best when enough people pay attention to the fine print. Privacy policies are promises, but they’re only as durable as the company that made them and the regulators willing to enforce them. The most practical safeguard is reading the specific language a company uses when it announces a buyer — because that language determines whether your data will be used the same way tomorrow as it was yesterday. And if the company is in financial distress, the time to act is before the sale closes, not after.