When a Business Is Sold: What Happens to Consent and Customer Data
Every acquisition includes a quiet asset: the customer list and the consent records behind it. Sellers describe it as data the business owns; customers experience it as their details turning up in a stranger marketing. The gap between those views is where complaints, regulator interest, and destroyed trust live.
This guide covers what happens to consent in a sale: what transfers and what does not, the buyer inherited duties, the announcements people are owed, and the uses that no deal structure can authorise without going back and asking.
The promises travel with the data
Consent was given to a described set of purposes under a described privacy notice. A sale changes the company behind the notice, not the purposes people agreed to. Buyers who treat an acquired list as a fresh asset with no history routinely break this in the first campaign: mailing people who opted out under the old owner, or using purchase data for a new product line the original notice never mentioned. Due diligence should include the consent records themselves: how opt ins were captured, what wording was used, and how clean the opt out history is.
Opt outs are inherited, not negotiable
Every suppression and withdrawal recorded by the seller binds the buyer from the first send. That means the suppression lists are not a courtesy export; they are a core part of the asset, and migrating them accurately matters more than migrating the marketable names. Test the merged lists before any campaign with known opted out addresses as controls. A single mail to a person who withdrew consent two years ago, from a brand they never heard of, produces the kind of complaint that arrives with screenshots and a regulator copied in.
Tell people, plainly and early
Customers should hear about the change of control from the companies involved, in normal language, before the new owner starts communicating as if it had always held the relationship. The notice should say what is changing, what is not, what data moves, and how to opt out or close an account. Burying the change in updated terms nobody reads is legally convenient and practically corrosive. Handled openly, most customers accept a sale; handled silently, the first marketing email from the new name does the damage.
New uses need new consent
The line a buyer cannot cross by contract alone is purpose. Using the acquired data for the same business the customers signed up for is one thing; feeding it into a parent company broader profiling, sharing it across a group portfolio, or marketing unrelated products is another. Those uses need their own basis and usually fresh consent, asked for honestly in the new owner name. Deals that price a list on uses the consent does not support are pricing an asset that does not exist, and the correction arrives as unsubscribes and enforcement rather than revenue.
Related reading
These earlier guides cover connected questions in more depth: Consent for SMS Marketing: Text Messages Are Not Small Emails, First Party Data Still Needs a Receipt: Consent for What You Collect Yourself, and Consent and Cookies on Healthcare Sites and Patient Portals.
Frequently asked questions
Can a buyer email an acquired list without new consent?
Generally yes for the same purposes the list was built for, provided the original consent was valid, opt outs are honoured, and the change of ownership was communicated. New or broader purposes are where fresh consent becomes necessary.
What if the seller consent records are a mess?
Then the list is worth less and should be treated that way in the deal. Options include re permissioning campaigns to the clean segment, or restricting use to service messages until a proper basis exists for each contact.
Do customers have to be asked before their data transfers?
Rules vary by market and deal structure, but notice is expected almost everywhere and consent is required in some cases, particularly where the transfer changes purposes. Even where notice alone suffices, giving people a working opt out is the practical standard.
What happens to consent receipts in a sale?
They transfer as part of the records and the buyer must keep them on their original retention schedule. Losing the receipts in migration means losing the proof for every claim the list depends on.