Data Acquired Through a Merger or Asset Sale: Checking Title Before You License It

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

Why acquired data needs its own title check

Acquired data needs a separate check because the supplier's ownership rests on a transaction document, not on having collected the data itself. Every link in the chain of title for AI training data has to hold, and an acquisition adds a link that buyers often accept on assertion alone. Law-firm guidance on AI acquisitions now treats datasets as deal assets that call for ownership and provenance diligence, starting with a full dataset inventory and how each dataset was obtained [1].

The failure modes are concrete. A stock purchase moves the whole entity, contracts included. An asset purchase moves only what the schedules list. A bankruptcy sale adds court conditions, and a carve-out can split one database between buyer and seller. Each structure changes which documents prove title.

Deal structure decides which documents prove title

The structure of the transaction determines where to look for the transfer of data rights. Use this table to match the deal type the supplier describes to the evidence you should see.

Illustrative example: invented to show structure; it does not describe an available dataset.

If the supplier is the entity that originally collected the data and only its parent changed, the check is lighter. If a different legal entity now holds the data, the transfer document is the core of your review.

What the purchase agreement must actually say

The purchase agreement must name the data and the rights in it, not just the infrastructure that stored it. In an APA, look at the definition of "Purchased Assets," the IP schedule, and any "Excluded Assets" list. A schedule that transfers "all servers and the CRM system" may move hardware and software licenses while leaving the records themselves, or the seller's copyright in compiled business records, in doubt. See copyright in operational business records for why that copyright question matters.

Read the representations and covenants next. A seller representation that it "has the right to use" the data says nothing about whether that right transferred. Look for:

• An assignment of all right, title and interest in named datasets and associated IP.
• A list of inbound licenses, including data feeds, SaaS terms and third-party content, with notes on which were assigned.
• Any license-back, field-of-use limit or non-compete that restricts the acquirer's use.
• Surviving seller covenants on privacy, such as a promise to process customer data only as the original notices allow.

Inbound licenses deserve particular attention. In bankruptcy, 11 U.S.C. 365(c) has long limited assignment of some executory IP licenses without the licensor's consent [3]. Outside bankruptcy, anti-assignment clauses in licenses for third-party data can mean that data never transferred at all.

Privacy promises generally follow the data

Privacy promises made by the acquired company generally continue to govern the data after an acquisition. FTC staff have taken the position for years that a change of ownership does not cancel promises made to users, and that materially new uses of previously collected data generally call for fresh notice and consent; have counsel confirm how that applies to your dataset.

That principle lands directly on AI training. FTC technologists warned in 2024 that companies may face liability under FTC-enforced laws if they use customer data for undisclosed purposes, such as training models [2]. A notice the target published in 2019 that said data would be used "to provide and improve our services" is a different instrument from a notice that discloses model training or licensing to third parties.

Ask for every version of the target's privacy notice in effect during the collection window, with dates. Map each dataset's collection dates to the notice version. Our guide to consent and notice records explains how to check that mapping.

Customer contracts and sector rules travel too

Business-to-business promises bind the data much like consumer notices do. If the acquired company held its customers' data under master services agreements and data processing agreements (DPAs), those contracts usually limit use to providing the service. Assignment of the contracts to the acquirer does not widen them. See customer contracts and DPAs and client data held by service providers for the clause-level review.

Sector rules add their own limits:

• Financial data. A company that received nonpublic personal information from a nonaffiliated financial institution under a Regulation P exception may reuse it only for the purpose it was received [4]. Ask whether the acquired data includes such records.
• Health data. For records that are protected health information, use as training data generally depends on HIPAA de-identification through Safe Harbor or Expert Determination [5]. An acquisition does not by itself change the status of the data.
• Education, biometric and children's data. Check FERPA, BIPA and COPPA exposure separately, since each has its own consent and transfer rules.

Bankruptcy sales: read the sale order, not just the APA

When data comes out of a bankruptcy, the court's sale order sets the use limits that matter most. The Bankruptcy Code restricts sales of personally identifiable information that conflict with the debtor's privacy policy, and courts can appoint a consumer privacy ombudsman to advise on such sales; confirm the current provisions and case law with bankruptcy counsel. Which version of a policy governs, when it changed shortly before the filing, is a recurring question.

In practice, sale orders sometimes require the buyer to honor the debtor's policy or to limit use to a similar line of business. Ask for the sale order, the ombudsman's report if one exists, and any later notice the acquirer sent to affected individuals. Then check whether licensing the data to a third party for model training fits those conditions.

A document request for acquired-company data

Send a single request that covers title, inherited promises and current controls. The template below shows the fields to ask a supplier for, per dataset.

Illustrative example: invented to show structure; it does not describe an available dataset.

dataset_id: acq-support-tickets-2017-2022
original_collector: "Target Co. (legal entity name, state of formation)"
current_holder: "Acquirer Inc. subsidiary holding the records"
transaction:
  type: asset_purchase        # stock_purchase | merger | asset_purchase | sec_363_sale | carve_out
  closing_date: "YYYY-MM-DD"
  transfer_clause: "APA s.2.1(f) and Schedule 2.1(f)-3 (data and IP)"
  excluded_assets_checked: true
  license_back_or_tsa_reservations: none
inbound_licenses:
  - name: "third-party enrichment feed"
    assigned_with_consent: false     # if false, exclude these fields
privacy_terms:
  notice_versions: ["2016-03 notice", "2019-08 notice"]
  ai_training_disclosed: false
  bankruptcy_sale_order_conditions: not_applicable
customer_contracts:
  dpa_limits_use_to_service: true
  customer_consents_collected: "list or none"
sector_flags: [financial_glba, none_health]
deidentification:
  method: "pseudonymized identifiers; method documented"
  sample_checked: true

Treat any "false" or "unknown" as a gate, not a footnote. Data that fails a field can often still be licensed in part, for example by dropping records collected under a narrower notice or fields that came from an unassigned feed. Record the result in your AI training data use register.

Red flags that should stop or reshape the deal

Some findings mean the supplier cannot grant the rights you need without more work. Pause when you see:

• The licensor is not the legal entity named in the transfer documents, and no intercompany assignment exists.
• APA schedules exclude "customer data" or route it to the seller under a TSA.
• The target's notices promised not to share data with third parties, and no new consent was collected.
• A sale order limits use to the debtor's original business purposes.
• Data from a defunct company is offered by a former employee or a liquidator without a sale document.

The last case is common enough to have its own answer: see can I license data from a company I no longer own. Data that passed through several hands before reaching the supplier also needs multi-hop provenance tracing.

How this affects your own disclosures

Your downstream obligations depend on being able to say where training data came from. California AB 2013 requires developers of generative AI systems made available to Californians to post documentation about training data, and, as of October 2026, postings were due January 1, 2026 [6]. A clean acquisition file lets you describe acquired data accurately rather than as an unexplained purchase. For the broader framework, start at the provenance hub or the AI data compliance guide.

Suppliers on the other side of these deals can read licensing data from a company you acquired and licensing data after an acquisition.

Sourcing acquired-company records with a rights review

SourceX sources operational datasets from US companies on request, and every dataset is rights-reviewed for ownership and consents before it is delivered under a license that defines records, uses, term and delivery. Diligence materials covering source, rights, preparation and allowed use are prepared per dataset, and personal details are removed or replaced before delivery, with the method recorded. If you need records from an acquired or merged business, you can describe the data you need to SourceX.

Describe the acquired-company data you need

Tell us what records you need and how you plan to use them; SourceX looks for US businesses that hold that data, and every release is approved by the supplying company. Nothing is contracted until a supplier agrees, and a request does not guarantee a match. Start a buyer request.