| But this is NOT a company being sold! And not even a division or a product sold. It’s not a merger or acquisition. It is, what you described as this: “two standing independent companies exchanging personal data.” Google Domains and Google Cloud Domains is shutting down: no technology or people transfer happens. Customer accounts are what are sold, as laid out in black-and-white by Google: “On June 15, 2023, Google entered into a definitive agreement with Squarespace, where they intend to purchase all domain registrations and related customer accounts from Google Domains.” We can argue what it means to sell “customer accounts from Google Domains” from Google to a third party company. My interpretation that this is selling customer data (that is needed for the buyer to operate them: it’s selling, none the less, to a third party who is not Google). To me, this sounds like a new era starting where customer accounts owned by Google can be sold (and this is the first). Which is fine: but then Google cannot claim they will not do this, going forward. This was the deal Google promised its customers - which implied they won’t sell off eg Gmail acccounts to a third party, YouTube accounts, or Google Domain accounts. Google didn’t write that Squarespace is “getting access to customer data”. They wrote Squarespace is purchasing these accounts (likely this wording to avoid writing that Google is selling this: but same difference). Google’s wording: not mine. https://support.google.com/domains/answer/13689670?hl=en#:~:.... |
This is just semantics on your part. Whether it's a company being sold, a division, or only a product, then reasonable companies will consider the data handling in a similar way with multiple gap analyses to mitigate concerns. Context is going to dictate what happens. Lesser companies will not consider this heavily and you can end up with the data being more of the value for the transaction. Whether we like it, or not, we are left to trust that these companies will make efforts to enact good policies and follow them.
What I'd expect to happen here is that Google and Squarespace will familiarize themselves with the posture on both sides and Google will want the standards to at least be maintained to a level which removes liability to them. They are very aware of the scrutiny and a big player here so they can force the acquirer to step up to a certain degree.
I don't know enough about Squarespace's security, or complete business model, but they'll be trying to work out what gaps they may need to fill. Google may have clauses that require that this data can't be co-mingled, or must be handled in specific ways for certain countries. The actual handling and what is communicated can take some time as the teams work out how they deal with any gaps. It's also possible that Google find some gaps on their side and have to resolve them before any transfer could actually happen.
Given the implications of service continuity if domains aren't transferred or operational, I can't imagine that they would ask customers to take some action. It creates a support nightmare with confused customers talking to support and then being unhappy they still took the wrong action when you ask them to approve the transfer.