Rights and contracts
Can you sell or license your customer database when you close the business?
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
You can sometimes sell a customer database when you close a business, but privacy policy promises, state privacy laws, customer contracts and bankruptcy rules may limit who can buy it. Licensing de-identified operational records, such as job histories and support tickets with names removed, is a different transaction with fewer constraints. Decide which asset you are selling before subscriptions lapse.
Key takeaways
- A customer list is personal information, and what customers were told at collection follows it to any buyer.
- Transfers to a successor that keeps serving the same customers are usually cleaner than a standalone list sale.
- De-identified operational records are a different asset from a customer list, with different buyers and constraints.
- A non-exclusive license of de-identified records rarely blocks a later sale of the book, but it should be disclosed.
- Export system histories before field service, CRM and help desk subscriptions are cancelled.
Can you sell your customer database when you close?#
Selling a customer database when you close is possible in some situations, but it is one of the more restricted assets a closing business holds. Names, addresses, phone numbers, emails and purchase histories are personal information, and what you told customers when you collected them follows the data to any buyer.
Owners often picture a competitor paying for the list. In practice the cleanest transfers go to a successor that will keep serving the same customers, such as a business taking over the service agreements or the whole book, because that matches what customers would reasonably expect and what many privacy policies already allow. A competitor that only wants contact details for marketing is the hardest buyer to accommodate.
State privacy laws may apply depending on where customers live and how much data you hold, and the FTC has long treated broken privacy promises as a consumer protection problem. In the 2015 RadioShack bankruptcy, the FTC's consumer protection director recommended that customer data not be sold as a standalone asset and go only to a buyer in substantially the same line of business that agreed to be bound by the privacy policy. These questions are assessed deal by deal with counsel, so the privacy policy is the first document to pull.
Three different assets: the list, the book and the records#
Closing owners often bundle three different assets under the words customer data. Each has different buyers, different constraints and a different effect on the rest of the wind-down.
The third asset is not a customer list at all. Once names, contact details and other identifiers are removed, the value lies in what the records show about diagnosing problems, pricing work and resolving complaints, not in who the customers were.
| Asset | What it contains | Who usually wants it | Main constraints |
|---|---|---|---|
| Customer list | Names, contact details, addresses, purchase history | Competitors, successors, marketers | Privacy policy, state privacy laws, marketing consent rules, contracts |
| Book of business | Service agreements, relationships and goodwill, with the list as part of the deal | A successor that keeps serving customers | Assignment clauses, business-transfer language, customer notice |
| De-identified operational records | Job notes, estimates, support tickets and call transcripts with personal details removed | AI developers studying how work gets done | Rights review, privacy preparation, vendor and customer contracts |
What to look for in your privacy policy#
Your privacy policy sets the outer limits on any transfer of customer data. Read every version that was live while the data was collected, because a promise in an older policy may still govern the records gathered under it.
B2B contact records and consumer records can be treated differently, so separate the two before anyone discusses price. The Bankruptcy Code's privacy rule for asset sales, for example, reaches information individuals gave for personal, family or household purposes, while California's CCPA has covered B2B contact information since its B2B exemption expired on January 1, 2023.
Rewriting the policy just before a sale is not a fix. FTC staff warned in February 2024 that quietly and retroactively changing terms of service or a privacy policy to allow new uses of data may be unfair or deceptive, so assume data already collected stays bound by the promises made when it was collected.
- Business transfer language: whether data may pass to a buyer in a merger, acquisition or sale of assets.
- No-sale promises: statements such as we never sell your information, which can block a standalone list sale.
- Sharing categories: the types of recipients customers were told about, such as service providers or affiliates.
- Opt-out and deletion commitments: requests already received that must keep being honored.
- Version history: which policy applied to which customers, and when.
Sell the list, sell the book or license records first?#
Licensing de-identified records first and selling the book afterward usually works if the license is non-exclusive and disclosed; the owner's real decision is sequencing, so that one transaction does not block another.
The two rarely collide because the licensed package contains no names or contact details and the company keeps ownership, so a successor still receives the relationships it is paying for. Disclose the license anyway; an acquirer's counsel will ask what rights in the records have already been granted.
Timing cuts both ways. A successor deal often moves quickly because customers need continuity of service, while a records license needs a rights review and privacy preparation first. Exporting and preserving the records early keeps the licensing option open without slowing the sale of the book.
| Option | Best fit when | Watch out for |
|---|---|---|
| Sell the business or the book | A successor will serve the same customers | Assignment consents and customer notice |
| Sell the customer list alone | The policy allows transfer and the buyer is a natural successor | No-sale promises, marketing consent and regulator attention |
| License de-identified records | Systems still hold years of job, support or project history | Exclusivity that could complicate a later sale |
| License first, then sell the book | Both a successor and useful record history exist | Keeping the license non-exclusive and disclosed to the acquirer |
What to do before subscriptions are cancelled#
Before subscriptions are cancelled, export full system histories to storage the company controls, because records disappear fastest when software subscriptions lapse. Field service platforms, help desks and CRMs often limit or end access after cancellation, so check each vendor's terms before turning anything off.
Preservation is not the same as keeping data forever. Retention promises in your privacy policy and any legal disposal duties still apply, so the archive needs an end date once decisions are made.
- Inventory the systems: field service, CRM, help desk, phone system and accounting.
- Export full histories in native formats, including notes and attachments, while access is live.
- Move archives to company-controlled storage with restricted access.
- Pause automated deletion until counsel confirms what must be kept or destroyed.
- Record who holds authority to sign for the company once it is dissolved.
Illustrative: a retiring owner closes a plumbing and HVAC company#
Illustrative: a fictional family-owned plumbing and HVAC company is closing because its owner is retiring. It has run ServiceTitan for years, holding estimates, job notes, technician comments, invoices and maintenance agreements, and a competitor has offered to take over the maintenance agreement customers.
The website privacy policy allowed transfers as part of a sale of the business but said customer information would not be sold on its own. With counsel, the owner transferred the maintenance agreements and the related customer records to the competitor as part of a sale of that book, with notice to customers. Separately, before cancelling the subscription, the company exported job and call records and licensed a de-identified package of diagnostics, estimates and outcomes with names, addresses and phone numbers removed.
The two transactions did not collide. The competitor received relationships; the licensee received anonymous examples of how technicians diagnosed and priced work.
How SourceX approaches closing-company records#
SourceX handles a closing company's records through the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. Nothing is shared during the initial assessment, which uses metadata such as system names and years of history, so the owner can decide before any export leaves the company.
Customer lists are not what SourceX licenses. Preparation removes personal and confidential details, and the SourceX Evidence Packet records provenance, licensing rights, permitted use, the privacy record and the release authorization signed by whoever holds authority for the closing company.
Frequently asked questions
Do I need customer consent to sell my customer list?
It depends on what customers were told, where they live and the kind of data involved. Some transfers to a successor need only notice, while a standalone sale that contradicts a no-sale promise may need consent or may not be workable at all. Counsel should review the policy and the laws that may apply.
What should happen to customer data if I close without selling anything?
Keep what laws and contracts require, then dispose of the rest securely. Several states have rules on disposing of records that contain personal information, and your privacy policy may have promised deletion. Document what was destroyed, when and by whom.
Can a bankruptcy trustee sell a customer database?
Yes, within limits. Under section 363(b)(1) of the Bankruptcy Code, if the debtor's privacy policy barred transferring personally identifiable information to unaffiliated parties, a trustee can sell it only in line with that policy or after a consumer privacy ombudsman is appointed and the court approves the sale following notice and a hearing. Ask counsel early whether de-identified records offer a cleaner path.
Can I still license records after the company is dissolved?
Possibly, if the records survived and someone still has authority to act for the company, such as a wind-down officer or the shareholders under the plan of dissolution. Dissolution rules vary by state, so confirm who can sign before any licensing conversation starts.
Is licensing records the same as selling them?
No. A license grants defined use rights for a defined purpose and period while the company, or its successor, keeps ownership. A sale transfers ownership. That difference matters to later buyers of the business and to what you can promise each party.
Sources
- In a May 2015 letter to the RadioShack consumer privacy ombudsman, FTC Bureau of Consumer Protection Director Jessica Rich recommended that customer data not be sold as a standalone asset and be transferred only to a buyer in substantially the same line of business that agrees to be bound by RadioShack's privacy policy. Source
- On February 13, 2024, FTC staff warned that a company that adopts more permissive data practices and tells consumers only through a surreptitious, retroactive change to its terms of service or privacy policy may be engaging in unfair or deceptive practices. Source
- Under 11 U.S.C. 363(b)(1), if a debtor's privacy policy prohibited transfer of personally identifiable information to unaffiliated persons, the trustee may not sell it unless the sale is consistent with the policy or, after appointment of a consumer privacy ombudsman and notice and a hearing, the court approves it. Source
- 11 U.S.C. 101(41A) defines personally identifiable information by reference to information an individual provided to the debtor in connection with obtaining a product or service primarily for personal, family or household purposes. Source
- The CCPA employee and business-to-business personal information exemptions expired on January 1, 2023. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.