Privacy policy says 'we never sell data': can a closing company still license records?

Does a 'we never sell' promise survive a shutdown?#

A 'we never sell your data' promise survives a shutdown in the sense that matters: it continues to govern the personal information collected while it was in force. Consumer protection regulators, including the FTC and state attorneys general, treat privacy statements as promises to the people who relied on them, and they have objected in past bankruptcies when customer data was offered for sale against such promises.

Closing changes who holds the data, not what was promised about it. Whoever controls the data next, whether the company's own wind-down officers, an assignee or a bankruptcy trustee, holds it subject to those commitments. The practical question is therefore not whether the promise binds, but exactly what it covers.

What did the policy actually promise?#

What a privacy policy promised depends on its exact words, its definitions and the version in force when each record was collected. Collect every version with the dates it was live, then read each one for the data it covers, the act it rules out and the exceptions it allows.

Also note whom each policy addressed. A website privacy policy typically speaks to visitors, users and customer contacts. It usually does not govern employees, whose information falls under handbooks and employee notices, or a company's internal records about its own processes.

Is licensing de-identified records a 'sale'?#

Whether licensing de-identified records counts as a sale depends on the policy's definitions and on the privacy laws that may apply. Some state privacy laws, including the CCPA, define selling personal information broadly enough to cover sharing it for something of value, while treating information that meets their de-identification standard differently.

De-identification is a technical and contractual standard, not a label. It generally involves removing direct identifiers, reducing the chance that individuals can be re-identified and binding the recipient not to re-identify anyone. Whether a specific dataset meets a specific law's standard is decided with privacy counsel for each deal, and a policy that promised never to share data at all may restrict even well-prepared datasets.

Which records may fall outside the promise?#

Records that may fall outside a 'never sell' promise are those that were never personal information about the policy's audience, or that no longer identify anyone after preparation. Records that sit squarely inside the promise are the data people handed over as users or customers.

Two traps catch closing companies. Support tickets from business customers often contain end users' names, emails and phone numbers pasted into the conversation, so a business record can still hold personal information about the very people the policy addressed. Engineering issues can also carry customer data copied in to reproduce a bug, which needs the same treatment as the source system.

Steps before licensing anything#

The steps before licensing anything under a restrictive privacy policy are about narrowing scope until every remaining record can be defended to a buyer, a court or a regulator.

• 1Assemble every version of the privacy policy and terms of service, with the dates each was live.
• 2Map each record family to the policy audience it came from and the version in force when it was collected.
• 3Exclude records collected under promises that rule out the intended use.
• 4Remove personal details from the remaining records and document the method.
• 5Check customer contracts, data processing agreements and NDAs for separate limits.
• 6Consider whether notice or consent is feasible for any record group.
• 7In bankruptcy, expect a consumer privacy ombudsman and a court hearing before any sale or lease of customer personal information that the policy does not allow, and follow that process rather than working around it.
• 8Write down the analysis and decisions so they can be reviewed later.

Illustrative: a closing booking platform narrows its scope#

Illustrative: a fictional software company that ran an online booking platform for home services contractors is winding down. Its privacy policy, written for homeowners who booked through the app, said the company would never sell or share their personal information. Its contractor customers signed separate business agreements.

Counsel concludes that homeowner profiles, booking histories and messages fall inside the promise and excludes them entirely. Internal Jira issues, engineering design documents and support escalations between the company and its contractor customers are reviewed separately. After contractor names and any homeowner details in tickets are removed, those records are assessed for a non-exclusive license, and the decision memo is kept with the wind-down file.

The company's Slack workspace and HR records are left out of this review entirely, because the homeowner policy never addressed them. They go through a separate review under the employee handbook and monitoring notice, with direct messages and HR channels excluded by default.

How SourceX handles restrictive privacy promises#

SourceX starts the Rights step of the SourceX five-step transaction with the company's privacy policy versions and the records each one governed, and excludes data covered by a promise that rules out the intended use rather than trying to work around it. Personal and confidential details are removed in Preparation, and the privacy record in the SourceX Evidence Packet documents which policy versions applied and what was excluded.