[zerkten]

>> But this is NOT a company being sold! And not even a division or a product sold. It’s not a merger or acquisition. It is, what you described as this: “two standing independent companies exchanging personal data.”

This is just semantics on your part. Whether it's a company being sold, a division, or only a product, then reasonable companies will consider the data handling in a similar way with multiple gap analyses to mitigate concerns. Context is going to dictate what happens. Lesser companies will not consider this heavily and you can end up with the data being more of the value for the transaction. Whether we like it, or not, we are left to trust that these companies will make efforts to enact good policies and follow them.

What I'd expect to happen here is that Google and Squarespace will familiarize themselves with the posture on both sides and Google will want the standards to at least be maintained to a level which removes liability to them. They are very aware of the scrutiny and a big player here so they can force the acquirer to step up to a certain degree.

I don't know enough about Squarespace's security, or complete business model, but they'll be trying to work out what gaps they may need to fill. Google may have clauses that require that this data can't be co-mingled, or must be handled in specific ways for certain countries. The actual handling and what is communicated can take some time as the teams work out how they deal with any gaps. It's also possible that Google find some gaps on their side and have to resolve them before any transfer could actually happen.

Given the implications of service continuity if domains aren't transferred or operational, I can't imagine that they would ask customers to take some action. It creates a support nightmare with confused customers talking to support and then being unhappy they still took the wrong action when you ask them to approve the transfer.

[gregdoesit]

Thank you. After having gone through more of this - and receiving more long-form input - I am with you that this is, almost certainly, not "selling of customer data."

Thanks for your comments, I appreciate it. Now is the part when I would want to go back and edit all my comments here (and on Twitter), but cannot thanks to the append-only nature. I can delete: but then e.g. this post points to nowhere and the context is lost. I deleted the orginal tweet given it's clear it has incorrect information / missing information, replaced with: https://twitter.com/GergelyOrosz/status/1671959124337217536?...

Some longer form thoughts, and also input from someone who is quite well versed in privacy: https://blog.pragmaticengineer.com/google-domains-to-shut-do...