The Federal Trade Commission (FTC) has long been
aggressive in holding businesses accountable for the commitments
made to consumers in online privacy policies. Among the
related issues that the FTC has revisited over the years is the
validity of changing data use practices after a business
acquisition or merger.
As early as 2000 in the Toysmart bankruptcy case, the FTC adopted a
strict view that an acquirer — even one in a bankruptcy
setting — could either not acquire (depending on the
transaction structure) or undertake new uses of consumer data
collected by an acquired company if the acquired
company's privacy policy did not put provide clear notice to
consumers of a proposed change in use. Thus, statements that
collected data would "never' be shared with third parties
was taken to mean just that, even following a business acquisition.
In the FTC's view, the acquirer generally must obtain
affirmative consent to the proposed possession or new use,
