Selling Customer Data When Selling a Business: The Merger Carve-Out in 23 State Privacy Laws (2026)

Selling customer data when selling a business: all 23 laws carve it out of 'sale'

Every state comprehensive privacy law in our registry treats a transfer of customer data that is part of a merger or acquisition as something other than a 'sale' of personal data. The carve-out sits inside each law's definition of 'sale', not in its exemptions section.

We read the 'sale of personal data' definition and the applicability section of 23 state laws on 2026-11-02, from legislature or agency texts saved with this report. In each law, the definition lists things that are not a sale, and one item on every list is the disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition or similar transaction.

Sale of personal data: In 15 of the laws, the exchange of personal data for monetary or other valuable consideration; in 7 laws (including Virginia, Utah, Iowa and Kentucky), only an exchange for monetary consideration. Alabama counts other consideration only where the seller gets a material benefit and the recipient's later use is unrestricted.

Florida's Digital Bill of Rights also excludes a transfer 'as part of a merger or an acquisition', but it reaches only controllers with more than $1 billion in global gross annual revenue (Fla. Stat. 501.702), so it is listed for reference and left out of the counts.

California is the only state that puts conditions on the buyer

The brief for this report expected several states to attach conditions to the carve-out. The statute text supports one: California. The other 22 state the carve-out without conditions inside the definition.

Under Cal. Civ. Code 1798.140(ad)(2)(C), a transfer in a merger, acquisition, bankruptcy or other transaction is not a sale 'provided that information is used or shared consistently with this title'. If the buyer later materially changes how it uses the data in a way materially inconsistent with the promises made at collection, it must give consumers prior notice of the new practice.

A second California rule follows the data to the buyer: Civ. Code 1798.120(a)(2) requires a business that receives personal information in such a transaction to comply with an opt-out direction the consumer gave the seller. California's statute uses the same carve-out for 'sharing' (cross-context advertising) as for 'sale'.

Wording differs at the edges. Texas names only 'a merger or acquisition'. Utah names a merger, an acquisition or a bankruptcy and has no catch-all for other transactions. Louisiana says 'merger, acquisition, or similar activity' and does not require the buyer to assume control of the seller's assets. A share purchase, an asset purchase of part of a business, and a transfer in bankruptcy can fall on different sides of these lines; the statutes do not define the terms.

Eighteen laws also cover a deal that has not closed

Most sellers open their books to a buyer before closing. 18 of the 22 laws read from statute text extend the carve-out to a 'proposed' transaction; four cover only a completed one. This count is SMBB's own coding and is not published elsewhere that we found.

Colorado, Connecticut, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Kentucky, Rhode Island, Oklahoma, Alabama and Vermont use the words 'proposed or actual' or 'proposed or completed'. Utah's text reads 'a proposed or actual merger, an acquisition, or a bankruptcy', and Louisiana's reads 'a proposed merger, acquisition, or similar activity'.

• California: completed merger, acquisition, bankruptcy or other transaction only (Civ. Code 1798.140(ad)(2)(C)).
• Virginia: completed transaction only (Va. Code 59.1-575).
• Texas: 'a merger or acquisition' only (HB 4, Bus. & Com. Code 541.001(28)).
• Tennessee: completed transaction only (Pub. Ch. 408 of 2023).

In these four states the statute text does not say how a disclosure to a prospective buyer during due diligence is treated. A disclosure for no consideration is not a 'sale' under any of the definitions, and Virginia and Tennessee count only monetary consideration; whether data access in a letter-of-intent stage is 'other valuable consideration' in California or Texas is a question for counsel.

Does a small business even meet the thresholds?

Coverage, not the carve-out, is where state laws differ most for a small seller. 17 of 23 laws can reach a business of any revenue through a count of state residents whose data it holds or processes.

Most laws count a resident once their data is controlled or processed during the year, and Connecticut's definition of processing includes storage (Conn. Gen. Stat. 42-515). A customer database built over many years can therefore count toward a threshold even in a slow sales year.

Translated into daily terms, 35,000 consumers is about 95.9 distinct residents a day for a year and 100,000 is about 274.0. A retailer, clinic or online shop selling mostly into one state can reach the lower lines; a business-to-business firm with a few hundred client contacts usually cannot. Three states add routes with smaller numbers or none: Connecticut covers any business that controls sensitive data or offers personal data for sale, Vermont will cover sensitive data of 3,000 consumers, and Alabama covers any business deriving more than 25 percent of revenue from data sales regardless of consumer count.

Most laws also exempt data or entities covered by federal sector rules, such as financial institutions subject to the Gramm-Leach-Bliley Act and HIPAA covered entities (for example, Va. Code 59.1-576(B)). A medical practice or insurance agency should check those exemptions before relying on the thresholds.

Connecticut, Montana and Delaware have lowered the bar

The newest amendments push thresholds down, which brings more small and mid-size sellers inside the laws over time.

Connecticut's cut from 100,000 to 35,000 consumers (65.0 percent) took effect 2026-07-01. Montana's line fell from 50,000 to 25,000 (50.0 percent) under Chapter 567, Laws of 2025. Delaware's falls from 35,000 to 10,000 (71.4 percent) on 2027-01-01, and from that date Delaware's law also applies to 'third parties who acquire personal data from a controller', which can include a buyer.

Fifteen of the 23 laws take effect in 2025 or later

Most of these laws are new. 19 were in force on 2026-11-02 and 4 enacted in 2026 take effect in 2027 or 2028, so a sale signed now can close under a different rulebook than the one in force at signing.

The privacy notice travels with the customer list

The carve-out keeps a business sale out of the 'sale' rules. It does not cancel what the seller told customers when it collected their data.

The Federal Trade Commission's staff wrote in 2014 that, absent affirmative express consent, a company may not use data in a manner materially inconsistent with promises made when the data was collected, and that doing so could be an unfair practice under Section 5 of the FTC Act. California writes the same idea into its carve-out by requiring prior notice before a materially inconsistent new use.

In practice, a seller's privacy notice is part of the asset being sold. If it promised never to share customer data, the buyer inherits that promise. A buyer that meets a state's threshold, or falls within Delaware's buyer route from 2027, owes that state's consumer rights to the customers it acquires.

Points to raise with a broker or attorney before sharing the customer file

These questions follow from the coding above; they are prompts for advisers, not answers.

• In which states do our customers live, and do we pass any state's consumer count, including stored records?
• Does our privacy notice say anything about a sale or merger of the business?
• If customers live in California, Virginia, Texas or Tennessee, how will data be shared during due diligence before closing?
• Will the buyer keep using the data as described in our notice, and who sends notice if that changes?
• Is any of the data health, financial or children's data covered by a federal rule or a sensitive-data consent rule?

For where these questions fit in a sale, see how a sale moves through six stages and questions to ask a broker.

Ratios behind the comparison

Download the calculations (CSV)

Where the numbers diverge

1. Every one of the 23 state comprehensive privacy laws coded on 2026-11-02 excludes a transfer of personal data that is part of a merger or acquisition from the definition of 'sale'.^{[1][3][6][7][9][11][12][14][17][19][21][24][25][26][27][29][32][33][36][38][40][41][43]}
2. 22 of 23 laws state the carve-out without conditions inside the 'sale' definition; California alone conditions it (Cal. Civ. Code 1798.140(ad)(2)(C)).^[1]
3. Under the CCPA text effective 2026-01-01, a California buyer must comply with opt-out directions consumers gave the seller (Cal. Civ. Code 1798.120(a)(2), statute effective 2026-01-01).^[1]
4. 18 of 22 laws read from statute text (81.8 percent) cover a proposed or actual transaction; Virginia, Tennessee, California and Texas cover completed transactions only.^{[3][26][1][11]}
5. Texas excludes only a transfer 'as an asset that is part of a merger or acquisition' (Tex. Bus. & Com. Code 541.001(28), HB 4 enrolled, effective 2024-07-01).^[11]
6. Louisiana's carve-out covers a 'merger, acquisition, or similar activity' and drops the usual test that the buyer assumes control of the seller's assets (Act 502 of 2026).^[41]
7. 15 laws use a consumer count with no revenue test and no size exemption, and California and Louisiana add a revenue-only trigger beside the count, so 17 of 23 laws can reach a business of any revenue.^[4][1][41]
8. Utah and Tennessee apply only to businesses with $25,000,000 or more in revenue that also meet a consumer count (Utah Code 13-61-102; Tenn. Pub. Ch. 408).^[9][26]
9. Texas, Nebraska and Minnesota exempt businesses that are small under the U.S. Small Business Administration standard, except that they may not sell sensitive data without consent.^[11][22][27]
10. Alabama's law, effective 2027-05-01, exempts businesses with fewer than 500 employees that do not sell personal data (HB 351 section 4).^[40]
11. The median headline consumer threshold across the 21 laws that use one is 100,000 consumers; 9 laws set it below 100,000.^{[4][7][15][30]}
12. Montana's 25,000-consumer threshold is the lowest in force on 2026-11-02; it was 50,000 when the law was enacted in 2023.^[15][16]
13. Connecticut's 35,000-consumer threshold took effect 2026-07-01, a 65.0 percent cut from 100,000.^[7][8]
14. 7 laws count only a cash exchange as a 'sale', while 15 count any valuable consideration, which matters for list swaps or data handed over in exchange for services.^[3][7]

Summary

• All 23 state comprehensive privacy laws coded here say that transferring personal data as an asset in a merger or acquisition is not a 'sale' of personal data (statutes checked 2026-11-02).
• California is the only state that attaches conditions: the buyer must use the data consistently with the CCPA, give prior notice of a materially inconsistent new use, and honor opt-outs consumers gave the seller (Cal. Civ. Code 1798.140(ad)(2)(C) and 1798.120(a)(2)).
• 18 of the 22 laws read from statute text extend the carve-out to proposed deals; California, Virginia, Texas and Tennessee name completed transactions only.
• Texas uses the narrowest wording, 'a merger or acquisition', with no mention of bankruptcy, other transactions or proposed deals.
• 17 of 23 laws (73.9 percent) can cover a business of any revenue once it holds enough residents' data; Utah and Tennessee require $25,000,000 in revenue, and Texas, Nebraska, Minnesota and Alabama exempt most small firms.
• Thresholds are falling: Connecticut cut its line from 100,000 to 35,000 consumers on 2026-07-01, Montana from 50,000 to 25,000, and Delaware's drops from 35,000 to 10,000 on 2027-01-01.
• 15 of the 23 laws (65.2 percent) take effect in 2025 or later, and 4 enacted in 2026 (Oklahoma, Louisiana, Alabama, Vermont) are not yet in force.
• The carve-out removes a deal from the 'sale' rules only; privacy promises made at collection still bind the data, as the Federal Trade Commission's staff stated in 2014.

Frequently asked questions

Related guides, services and research

• Questions to ask a business broker
• How a business sale works
• Contractor License Qualifier Rules: What Happens to the License When You Sell a Contracting Business (2026)
• How Many Businesses Close Each Year? Firm Closures by Age, State and Industry (2026)
• How Many ESOP Companies Are There? 6,231 Employee-Owned Sponsors by State, Industry and Size (Plan Year 2024)
• How Many Small Businesses Are There in the US? State Counts by Size (2026)
• All business sale research

Reproduce this analysis

Every figure comes from the files below. The scripts that pulled and computed them are kept with the report and can be re-run.

Data quality and exclusions

• Universe: 24 laws found; Florida's Digital Bill of Rights (1) is listed for reference and removed from every count because it applies only to controllers with more than $1 billion in global revenue, leaving 23.
• Archived copies: 7 laws (Colorado, Oregon, Nebraska, New Hampshire, New Jersey, Tennessee, Rhode Island) were coded from Internet Archive captures of the official page because the state host timed out from our network; each capture URL and date is in raw/wayback_captures.log.
• Indiana (1): iga.in.gov returned an empty JavaScript shell for every code and bill URL, so Indiana is coded from the Attorney General's official guide and marked 'interpretation needed'; it is left out of the proposed-deal count, which therefore uses 22 laws.
• Texas and Colorado (2): coded from the enrolled or signed bill because the codified text was not retrievable; later amendments to the sale definition or applicability section were not checked for these two.
• California: leginfo.legislature.ca.gov returned HTTP 403; the statute was read from the California Privacy Protection Agency's posted text effective 2026-01-01.
• Enactment dates (14 rows) are shown as the session year where the approval date is not printed in a document we opened; effective dates were all read from the act or code history.

Methodology

Selection: we included every state law commonly described as a comprehensive consumer privacy law that we could confirm from an official enactment or code text as of 2026-11-02, a total of 23, and listed Florida's Digital Bill of Rights separately because its $1 billion revenue test excludes small businesses. Sector laws (health data, biometrics, children's codes) are out of scope.

Sources: each row is coded from the state legislature's code or session-law text, or an agency's posted statute text, saved in raw/. Where a state host timed out from our network we used an Internet Archive capture of the official page and labelled it. Law-firm and vendor summaries were not used as evidence for any row; three are listed as pages compared against.

Coding: for each law we recorded the effective date, the headline consumer threshold, any sale-of-data route and revenue test, any small-business exemption, whether the 'sale' definition excludes a business-sale transfer, whether that exclusion names proposed transactions, any condition attached, and the consideration that makes a transfer a 'sale'. Confidence is 'clear text' where the official text was read and 'interpretation needed' for Indiana, coded from Attorney General guidance.

Conflicts: where a later version of a section is already printed with a future effective date (Connecticut 2026-07-01, Delaware 2027-01-01, Utah 2027-01-01, Kentucky 2027-07-01), the registry shows the version in force on 2026-11-02 and notes the change.

Derived metrics: counts and shares are computed in scripts/build.py from scripts/laws_data.py; per-day figures divide each annual threshold by 365. All formulas and the fact-sheet rows used are in derived_metrics.csv.

Last update: 2026-11-02. We plan to re-check after each legislative session. Owners who want help finding a broker can use the broker match form; it is not part of this research.

This report presents published data with its limitations. It is not legal, financial or investment advice.

Sources, ranked by quality

Tier 1: primary and official sources (49)

• [1] California Privacy Protection Agency. California Consumer Privacy Act of 2018 (Civ. Code 1798.100 et seq.), statute effective 01/01/2026. Statute as in effect 2026-01-01, posted December 2025. Accessed 2026-11-02.
• [2] California Privacy Protection Agency. California Consumer Privacy Act Monetary Thresholds (CPI adjustment). Effective 2025-01-01; posted 2024-12-17. Accessed 2026-11-02.
• [3] Virginia Legislative Information System. Va. Code 59.1-575, Definitions (Consumer Data Protection Act). Law as read 2026-11-02. Accessed 2026-11-02.
• [4] Virginia Legislative Information System. Va. Code 59.1-576, Scope; exemptions. Law as read 2026-11-02. Accessed 2026-11-02.
• [5] Virginia Legislative Information System (archived). Acts of Assembly 2021 Special Session I, Chapter 35 (HB 2307), Internet Archive copy. Approved 2021-03-02. Accessed 2026-11-02.
• [6] Colorado General Assembly (archived). Senate Bill 21-190, Colorado Privacy Act, signed act, Internet Archive copy. Act as signed, 2021. Accessed 2026-11-02.
• [7] Connecticut General Assembly. Conn. Gen. Stat. Chapter 743jj, Data Privacy and Security, 2026 Supplement. Revised to January 1, 2026, with July 1, 2026 versions. Accessed 2026-11-02.
• [8] Connecticut General Assembly. Public Act No. 25-113 (Substitute Senate Bill 1295). Approved 2025-06-24. Accessed 2026-11-02.
• [9] Utah State Legislature. Utah Code 13-61-101 and 13-61-102 (Utah Consumer Privacy Act), current and 2027 versions. Law as read 2026-11-02. Accessed 2026-11-02.
• [10] Utah State Legislature. S.B. 227 Consumer Privacy Act (2022 General Session) status page. Signed 2022-03-24; effective 2023-12-31. Accessed 2026-11-02.
• [11] Texas Legislature Online. H.B. No. 4, 88th Legislature, enrolled (Texas Data Privacy and Security Act). Enrolled 2023; effective 2024-07-01. Accessed 2026-11-02.
• [12] Oregon State Legislature (archived). Oregon Revised Statutes chapter 646A (2025 edition), ORS 646A.570 to 646A.589, Internet Archive copy. ORS 2025 edition, captured 2026-10-31. Accessed 2026-11-02.
• [13] Oregon State Legislature (archived). Senate Bill 619 (2023), enrolled, Internet Archive copy. Enrolled 2023. Accessed 2026-11-02.
• [14] Montana Legislature. Mont. Code Ann. 30-14-2802, Definitions. Law as read 2026-11-02. Accessed 2026-11-02.
• [15] Montana Legislature. Mont. Code Ann. 30-14-2803, Applicability. Law as read 2026-11-02. Accessed 2026-11-02.
• [16] Montana Legislature (archived). Senate Bill 384 (2023), enrolled, Internet Archive copy. Enrolled bill, captured 2023-05-22. Accessed 2026-11-02.
• [17] Iowa Legislature. Iowa Code 2026, Chapter 715D, Consumer Data Protection. Iowa Code 2026. Accessed 2026-11-02.
• [18] Iowa Legislature. 2023 Iowa Acts, Chapter 17 (SF 262). Approved 2023-03-28. Accessed 2026-11-02.
• [19] Delaware Code Online. Delaware Code Title 6, Chapter 12D, Delaware Personal Data Privacy Act. Current text with versions effective 2027-01-01. Accessed 2026-11-02.
• [20] Delaware Code Online, session laws. 84 Del. Laws c. 197 (HB 154). Approved 2023-09-11. Accessed 2026-11-02.
• [21] Nebraska Legislature (archived). Neb. Rev. Stat. 87-1102, Terms, defined, Internet Archive copy. Captured 2026-10-18. Accessed 2026-11-02.
• [22] Nebraska Legislature (archived). Neb. Rev. Stat. 87-1103, Applicability of act, Internet Archive copy. Captured 2026-10-18. Accessed 2026-11-02.
• [23] Nebraska Legislature (archived). Legislative Bill 1074 (2024) slip law, Internet Archive copy. Approved 2024-04-17. Accessed 2026-11-02.
• [24] New Hampshire General Court (archived). N.H. RSA Chapter 507-H, Expectation of Privacy, Internet Archive copy. Captured 2026-10-18. Accessed 2026-11-02.
• [25] New Jersey Legislature (archived). P.L.2023, Chapter 266 (New Jersey), Internet Archive copy. Approved 2024-01-16. Accessed 2026-11-02.
• [26] Tennessee Secretary of State (archived). Public Chapter No. 408 (HB 1181, 2023), Tennessee Information Protection Act, Internet Archive copy. Passed 2023-04-21; effective 2025-07-01. Accessed 2026-11-02.
• [27] Minnesota Office of the Revisor of Statutes. Minnesota Statutes Chapter 325M (full text). Law as read 2026-11-02. Accessed 2026-11-02.
• [28] Minnesota Office of the Revisor of Statutes. Laws of Minnesota 2024, Chapter 121. Session law 2024. Accessed 2026-11-02.
• [29] Maryland General Assembly. Md. Code, Commercial Law 14-4701, Definitions (Maryland Online Data Privacy Act). Law as read 2026-11-02. Accessed 2026-11-02.
• [30] Maryland General Assembly. Md. Code, Commercial Law 14-4702, Applicability. Law as read 2026-11-02. Accessed 2026-11-02.
• [31] Maryland General Assembly. Chapter 455 of 2024 (SB 541). Approved 2024-05-09. Accessed 2026-11-02.
• [32] Indiana Office of the Attorney General. Indiana Consumer Data Protection: Consumer Bill of Rights and Q&A. Agency guidance on the law effective 2026-01-01. Accessed 2026-11-02.
• [33] Kentucky General Assembly. KRS 367.3611, Definitions (effective until July 1, 2027). Law as read 2026-11-02. Accessed 2026-11-02.
• [34] Kentucky General Assembly. KRS 367.3613, Application. Effective 2026-01-01. Accessed 2026-11-02.
• [35] Kentucky General Assembly. 24 RS HB 15, enrolled (Kentucky Consumer Data Protection Act). Enrolled 2024. Accessed 2026-11-02.
• [36] State of Rhode Island General Assembly (archived). R.I. Gen. Laws 6-48.1-2, Definitions, Internet Archive copy. Captured 2026-10-12. Accessed 2026-11-02.
• [37] State of Rhode Island General Assembly (archived). R.I. Gen. Laws 6-48.1-4, thresholds and controller duties, Internet Archive copy. Captured 2026-09-30. Accessed 2026-11-02.
• [38] Oklahoma Legislature. Enrolled Senate Bill No. 546 (2026). Enrolled 2026. Accessed 2026-11-02.
• [39] Oklahoma Legislature. Bill information: SB 546 (2026 session). Approved by Governor 2026-03-20. Accessed 2026-11-02.
• [40] Alabama Legislature. HB351 Enrolled (2026 Regular Session), Alabama Personal Data Protection Act. Enrolled 2026. Accessed 2026-11-02.
• [41] Louisiana State Legislature. Act No. 502 (SB 386), 2026 Regular Session, Louisiana Data Privacy Act. Act 502 of 2026. Accessed 2026-11-02.
• [42] Louisiana State Legislature. SB 386 bill history (2026 Regular Session). Signed 05/29/2026. Accessed 2026-11-02.
• [43] Vermont General Assembly. Act No. 145 of 2026 (S.71), as enacted. Signed 2026-06-16; effective 2028-01-01. Accessed 2026-11-02.
• [44] Florida Legislature. Fla. Stat. 501.702, Definitions (Florida Digital Bill of Rights). Law as read 2026-11-02. Accessed 2026-11-02.
• [45] Florida Senate. CS/CS/SB 262 (2023), enrolled. Enrolled 2023; effective 2024-07-01. Accessed 2026-11-02.
• [46] California Privacy Protection Agency. CCPA Updates, Cybersecurity Audits, Risk Assessments, ADMT and Insurance Regulations. Approved by OAL 2025-09-22; effective 2026-01-01. Accessed 2026-11-02.
• [47] Federal Trade Commission. FTC staff to Facebook and WhatsApp: Privacy promises prevail (Business Blog). Published 2014-04-10. Accessed 2026-11-02.
• [48] Kentucky General Assembly. KRS 367.3611, Definitions (effective July 1, 2027). Version effective 2027-07-01. Accessed 2026-11-02.
• [52] California Privacy Protection Agency. Regulations (CCPA statute, thresholds and rulemaking index). Page read 2026-11-02. Accessed 2026-11-02.

Tier 3: journalism and expert commentary (3)

• [49] Rocket Lawyer. Is It Legal to Sell My Business's Client List?. Last reviewed 2023-11-23. Accessed 2026-11-02.
• [50] Pillsbury Winthrop Shaw Pittman. Transferring Customer Data in an Asset Sale. 2015 advisory. Accessed 2026-11-02.
• [51] Kelley Drye (Ad Law Access). Privacy vs. Bankruptcy: Case Lesson on When Customer Data is Not for Sale. Published 2011-09-23. Accessed 2026-11-02.