In 2012, Instagram had a privacy policy that said it would not sell user data to third parties. In 2012, Instagram was acquired by Facebook. Its privacy policy changed. This pattern has repeated across the tech industry with such regularity that it has become a standard part of the startup playbook: build with permissive privacy policies to attract users, sell to a larger company, and convert those users' data into acquisition value.
What a Privacy Policy Actually Promises
A privacy policy is a contract between you and the company that currently owns the service. It can be changed at any time, with notice — typically an email that most users never read, or a banner notification on the app. In most jurisdictions, continued use of the service after the policy change constitutes acceptance of the new terms.
More importantly, a privacy policy binds the *current* legal entity. When a company is acquired, the assets — including the user database and the data in it — typically transfer to the acquiring entity. The new entity then publishes its own privacy policy, which may be substantially different from the original. Users who signed up under one set of assumptions are now subject to an entirely different data regime.
The Asset Nature of User Data
In an acquisition, user data is not a liability — it's part of the valuation. When a startup is acquired for hundreds of millions of dollars, the acquirer is often paying for the user base, the behavioral data, and the signal that data provides. The acquirer has paid for this data. They intend to use it.
This creates a fundamental tension with privacy-forward commitments. A startup might genuinely mean it when they promise never to sell your data. But once they accept acquisition terms, the decision is no longer theirs. The data is now the acquirer's property, subject to the acquirer's business model.
What the Law Does (and Doesn't) Protect
GDPR, CCPA, and similar privacy regulations impose some constraints on what can be done with data after an acquisition. Data collected under a specific stated purpose cannot simply be repurposed for something entirely different without new consent — in theory. In practice, acquiring companies frequently rely on broad, vague original consent language ("to improve our services," "to personalize your experience") that covers a wide range of subsequent uses.
GDPR Article 14 requires notification when data is obtained from third parties, but the practical enforcement record on acquisition data transfers is sparse. Most users never learn that their data changed hands, let alone what the new owner intends to do with it.
Warrant Canaries and Shutdown Commitments
Some privacy-focused services have attempted to address the acquisition problem structurally. Warrant canaries are public statements that a company has not received certain types of legal demands — and their absence signals that something has changed. Some services have published explicit "we will shut down rather than be acquired" commitments, or designed their architecture so that an acquisition wouldn't yield useful data.
The most robust version of this commitment is technical, not legal. A service that cannot read your data cannot sell it. Zero-knowledge architecture means that an acquiring company inherits encrypted ciphertext and no keys — not a valuable data asset. The privacy guarantee survives the acquisition because it was never dependent on the company's good intentions.
Practical Implications
When evaluating a service that holds sensitive data, the relevant question is not "do they have a good privacy policy today?" It's "would I be comfortable with their data if it were acquired by the largest, most data-hungry company in their sector?" If the answer is no, the architectural question follows: does this service hold data in a form that would be useful to an adversarial acquirer?
Services that store only encrypted ciphertext they cannot read give acquirers nothing worth buying from a surveillance standpoint. That's the only structural protection that survives every business outcome, including bankruptcy, acquisition, and regulatory change.
