Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that in the event of a sale or transfer of all or part of Meta's business, user information may be transferred to the new owner as part of that transaction, subject to applicable law.
This analysis describes what Meta's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision reserves the right to transfer user personal data to a third-party acquirer in a business transaction, which is a standard disclosure in corporate privacy policies but operationally significant because it means user data may pass to an entity with different privacy practices, subject to the constraint that such transfer must comply with applicable law.
Clarifies that user data may be transferred to new owners in business acquisition scenarios with minimal protective language.
View full change record →Under this clause, if Meta sells or transfers part or all of its business, user information including collected personal data may be provided to the acquiring entity as part of the transaction, with the stated limitation that such transfer must comply with applicable law. The policy does not specify notification procedures to users in the event of such a transfer.
Cross-platform context
See how other platforms handle Business Sale or Transfer of User Data and similar clauses.
Compare across platforms →Monitoring
Meta has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"And if we sell or transfer all or part of our business to someone else, in some cases we'll give the new owner your information as part of that transaction, but only as the law allows.Excerpt from Meta's Privacy Policy
1) REGULATORY LANDSCAPE: This provision engages GDPR's requirements for lawful bases for processing and data subject rights, which would apply to any transfer of personal data to an acquirer, as well as FTC guidance on the honoring of privacy commitments following corporate acquisitions. State AG offices in the US have also pursued enforcement actions in contexts where acquired companies changed privacy practices. 2) GOVERNANCE EXPOSURE: Low. This is a standard provision in corporate privacy policies and the policy qualifies the transfer with 'only as the law allows.' However, the absence of specific notification procedures or user consent mechanisms for such a transfer may be a consideration in jurisdictions with heightened data subject rights. 3) JURISDICTION FLAGS: EU and EEA users have statutory rights regarding data processing that would apply in an acquisition context, including the right to be informed of changes in controller identity. California residents have rights under CPRA that would apply to a successor entity. 4) CONTRACT AND VENDOR IMPLICATIONS: Organizations that have data processing agreements with Meta should assess whether those agreements require notification or renegotiation in the event of a business transfer. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should monitor for any announced business transactions involving Meta that could affect data controller identity and assess whether existing contractual protections are adequate.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision reserves the right to transfer user personal data to a third-party acquirer in a business transaction, which is a standard disclosure in corporate privacy policies but operationally significant because it means user data may pass to an entity with different privacy practices, subject to the constraint that such transfer must comply with applicable law.
Under this clause, if Meta sells or transfers part or all of its business, user information including collected personal data may be provided to the acquiring entity as part of the transaction, with the stated limitation that such transfer must comply with applicable law. The policy does not specify notification procedures to users in the event of such a transfer.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Meta.