Introduction
Data privacy regulation has moved from a compliance afterthought to a material deal variable in TMT M&A. Buying a company that collects, processes, or stores personal data means inheriting both the value of that data asset and every regulatory liability attached to it. The enforcement backdrop makes those liabilities real: European regulators issued roughly EUR 1.2 billion in GDPR fines in 2025, taking the cumulative total since May 2018 to about EUR 7.1 billion, according to DLA Piper's annual GDPR fines and data breach survey.
The Verizon/Yahoo transaction remains the defining case study. After Yahoo disclosed two massive breaches it had not previously reported, the parties cut the price for Yahoo's operating business by $350 million, from $4.83 billion to roughly $4.48 billion, as set out in the amended deal terms Yahoo filed with the SEC. Yahoo (by then renamed Altaba) later paid a $35 million penalty to settle SEC charges that it misled investors about the breach, and its combined SEC and class action costs ran well above $100 million. For TMT bankers, privacy diligence is now a standard workstream whose findings shape valuation, structure, and integration.
The Regulatory Landscape
Four regimes drive privacy diligence for most TMT targets, and they differ in reach, penalty design, and how directly they touch the mechanics of a transaction.
| Regime | Who it reaches | Maximum penalty | Why it matters in M&A |
|---|---|---|---|
| GDPR (EU/EEA) | Any company processing EU residents' data, wherever based | EUR 20 million or 4% of global turnover, whichever is higher | Inherited fines, lawful-basis gaps, transfer restrictions |
| CCPA/CPRA (California) | Businesses above revenue or data-volume thresholds | $2,663 per violation; $7,988 if intentional or involving minors | Per-violation math scales with user base; opt-outs survive a sale |
| China's PIPL | Processors of personal information of individuals in China | RMB 50 million or 5% of prior-year revenue | Localization and security reviews limit data consolidation |
| Other US state laws | Roughly two dozen states, each with its own thresholds | Set by each state, usually enforced by the attorney general | Patchwork compliance widens diligence for national targets |
Enforcement has concentrated on exactly the business models TMT acquirers buy. In 2024 the Irish Data Protection Commission fined LinkedIn Ireland EUR 310 million over behavioral analysis and targeted advertising, and the Dutch DPA fined Clearview AI EUR 30.5 million for building a facial-recognition database from scraped images. For a buyer, a fine like that signals that the target's core data practices (ad targeting, model training, biometric processing) may have to change after closing, undercutting the revenue the acquirer is paying for.
California added an M&A-specific wrinkle. Assembly Bill 1824, effective January 2025, requires a business that acquires consumers' personal information in a merger, acquisition, or bankruptcy to honor opt-out requests those consumers made to the seller. The target's opt-out records travel with the data, so an acquired user base is not freshly monetizable. CCPA penalty caps are indexed to inflation, and the California Privacy Protection Agency raised them in its 2025 adjustment to the levels shown in the table. Beyond California, the state count keeps climbing: Alabama, Louisiana, Oklahoma, and Vermont passed comprehensive laws in 2026, bringing the total to 24 states by MultiState's count.
Privacy Due Diligence in TMT Transactions
Technology diligence routinely changes deal outcomes: Accenture research on tech-led M&A found that 96% of CIOs had seen technology due diligence uncover major issues or opportunities in their deals. Privacy sits inside that workstream, usually run jointly by privacy counsel, the buyer's security team, and the wider IP and technology diligence effort.
- Privacy Due Diligence
The part of M&A due diligence that assesses how a target collects, uses, shares, secures, and transfers personal data, and whether those practices comply with applicable privacy laws. Its output is a list of inherited liabilities and remediation costs that feed into price, deal protections, and integration planning.
It runs alongside the standard financial, legal, and commercial diligence tracks, but its findings are harder to quantify, because the largest exposures (undisclosed breaches, unlawful processing at scale) usually surface only through targeted questions.
How Privacy Risk Affects Deal Terms
Privacy findings affect TMT transactions across multiple deal dimensions, and the structuring response depends on the severity of the identified risks.
The Verizon/Yahoo amendment also shows how parties allocate liabilities they cannot yet size. Beyond the price cut, Yahoo agreed to bear 50% of post-closing cash liabilities from non-SEC government investigations and third-party litigation tied to the breaches, kept shareholder suits and SEC matters entirely, and the breaches were carved out of the material adverse effect definition so Verizon could not later cite them as grounds to walk away. That package remains the reference point when a known incident hangs over a target. Where exposure is severe enough to reopen structure, the trade-offs between asset purchases and stock purchases decide which liabilities the buyer inherits.
Cross-Border Complexity
Cross-border deals stack these regimes on top of each other, and the hardest problems involve data transfers rather than fines. Moving EU personal data to the US relies on the EU-US Data Privacy Framework, adopted in July 2023 to replace the invalidated Privacy Shield, or on contractual mechanisms. The EU General Court upheld the framework in September 2025, but an appeal to the Court of Justice keeps its durability in question, and the Court of Justice struck down both of its predecessors.
- Standard Contractual Clauses (SCCs)
Model contract terms adopted by the European Commission that allow a company to transfer personal data from the EU to a country without an adequacy decision. The exporter must still assess whether the destination country's laws let the recipient honor the clauses, a step known as a transfer impact assessment.
The China leg is where transfer risk has become most expensive. In May 2025 the Irish Data Protection Commission fined TikTok EUR 530 million and ordered it to suspend transfers to China unless it fixed its processing within six months, finding it had not shown that EEA data accessed from China received essentially equivalent protection. Restrictions now run the other way too: the US Justice Department's Data Security Program, in effect since April 2025, limits transactions that could give countries of concern such as China access to Americans' bulk sensitive personal data, a compliance layer for China-linked buyers of data-rich US targets that sits apart from antitrust review and CFIUS.
The practical consequence is that privacy belongs in deal planning from the start, not as a last-minute diligence item, because late findings can derail transactions or force hasty renegotiations. Experienced TMT bankers bring in privacy counsel during the marketing phase on sell-side mandates (to remediate issues before bidders find them) and during preliminary diligence on buy-side mandates (to price privacy risk into the initial bid).
