Business Transfer Data Disclosure

What it is

The policy discloses that all collected personal data across all categories may be transferred to a third party acquiring control of Figure AI's business in whole or in part, including through merger, acquisition, or bankruptcy.

Why it matters (compliance & governance perspective)

This provision authorizes transfer of all personal data categories, including sensory data and professional data, to an acquiring entity without a requirement for separate user notice or consent at the time of transfer. The scope covers partial acquisitions, meaning a third party acquiring only a portion of the business could receive the full dataset.

Consumer impact (what this means for users)

Under this clause, all personal data collected by Figure AI, including sensory data such as recordings and geolocation data, may be transferred to a third-party acquirer in a merger, acquisition, or bankruptcy without a separate consent step at the time of the transaction. The agreement does not specify that the acquiring entity must maintain the same privacy practices.

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: Business transfer data disclosures engage the FTC Act's consumer protection framework, and the FTC has historically scrutinized whether acquiring entities honor predecessor privacy commitments. Under CCPA and CPRA, transferred personal data remains subject to the original privacy commitments unless users are notified and provided opt-out rights where applicable. State privacy laws in Colorado, Connecticut, Virginia, and others may require notification or new consent upon material changes to data processing. 2) GOVERNANCE EXPOSURE: Medium. The provision's reference to partial acquisitions expands the potential transfer scope beyond standard whole-company sale language. The absence of a requirement that the acquiring entity maintain equivalent privacy practices creates post-transfer compliance uncertainty for users. 3) JURISDICTION FLAGS: California (CCPA/CPRA) requires that data transferred in a business transaction remain subject to the original privacy commitments or that users be provided notice and opt-out rights. EU and UK GDPR frameworks, if applicable, would require that any data transfer in a corporate transaction maintain an adequate legal basis for processing. State privacy laws in multiple states create notification obligations upon material changes to data handling. 4) CONTRACT AND VENDOR IMPLICATIONS: In M&A due diligence contexts, acquiring entities should assess the scope of personal data categories subject to transfer, including sensory and biometric data, and evaluate whether post-acquisition processing plans align with Figure AI's stated privacy commitments. Data privacy representations and warranties in transaction agreements should reflect the breadth of data categories described in this policy. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should establish a protocol for user notification in the event of a business transfer transaction as required under applicable state privacy laws. Data transfer agreements in M&A contexts should include provisions requiring the acquiring entity to honor existing privacy commitments or provide users with appropriate notice and rights.

Applicable agencies

Provision details

Other risks in this policy

• Consent-by-Use Mechanism medium
• Sensory Data Collection high
• Data Retention Policy medium
• Do Not Track Non-Support medium
• U.S. State Privacy Rights Exercise Process low
• No Targeted Advertising Sale Disclosure low