M&A due diligence · SaaS & technology
M&A Privacy & Security Due Diligence for Martech & Adtech Platforms
Adtech deals are priced on audience assets, and audience assets are worth exactly as much as the consent behind them. We call the gap between what a target's data room claims and what its consent records can actually prove consent debt: liability that either gets disclosed and priced, or surfaces after close as an OPC complaint, a CASL exposure, or a list nobody can lawfully use. Our due diligence surfaces that gap before the term sheet is final, for buyers and, on the sell side, before the data room ever opens.
Reviewed by the Privacy Horizon team · Last reviewed
What you're protecting
What gets examined in a martech acquisition
The assets that matter most in this niche rarely show up as a clean line item, and diligence has to go find them.
Consent provenance for every list and identity graph
Where each audience segment, hashed-email list and identity-graph entry originated, and whether the documented consent basis actually covers the uses the acquirer intends to continue.
CASL and regulatory complaint history
Any past CRTC inquiries, undertakings or OPC findings against the target, since these carry forward with the entity and shape both valuation and integration risk.
Data-supplier and platform contracts
Whether agreements with Meta, Google and third-party data suppliers are assignable on a change of control, and what they actually permit the acquired data to be used for post-close.
Law 25 posture for Quebec-touching data
Whether profiling and tracking functions ship default-off as required, whether impact assessments exist for cross-border transfers, and whether an incident register has been properly maintained.
Sub-processor and enrichment sourcing
Where third-party or scraped data entered the target's systems, a source of risk the OPC's joint statement on scraping makes explicit for any acquirer inheriting an enrichment pipeline.
Regulatory map
Why this liability follows the entity, not just the data
Privacy obligations in this niche do not reset at closing, which is exactly why consent debt has to be priced rather than assumed away.
PIPEDA accountability continues post-acquisition
The accountability principle expects the acquiring organization to answer for personal information it now controls, regardless of the practices that originally created it.
CASL exposure transfers with the business
The reverse onus to prove consent does not disappear at close, and an acquirer inherits every list whose provenance was never properly documented.
Law 25 duties carry forward
Incident registers, impact assessments and default-off requirements remain live obligations for the combined entity, and gaps become the acquirer's problem to remediate.
Precedent findings define the exposure
Cases like the OPC's ruling against Home Depot's use of hashed emails for Offline Conversions establish what an acquirer should expect regulators to say about comparable practices found in a target's data.
What goes wrong
How consent debt actually shows up in a deal
The damage rarely looks like a lawsuit at signing; it looks like an asset that turns out to be worth less than the data room claimed.
A flagship audience that cannot lawfully be used
The target's most valuable segment turns out to rest on implied consent windows that expired years ago, cutting the acquirer's intended use case out from under the deal.
An undisclosed complaint history
A past CRTC inquiry or an informal CASL complaint the target never escalated internally surfaces during diligence, changing how the deal is priced or structured.
A data broker built on scraped or enriched sources
Acquiring a company whose audience enrichment leaned on scraped public data inherits the exact exposure a joint regulator statement has already flagged as a privacy violation.
Integration that merges two consent regimes incorrectly
Post-close, combining the acquirer's and target's audiences without reconciling their different consent bases repeats the cross-purpose data use regulators have already penalized elsewhere.
Our m&a due diligence for martech & adtech platforms
What our M&A privacy due diligence covers
A focused review built around how value and risk actually sit inside an adtech company's data.
Consent-debt assessment
A structured review of consent provenance across the target's lists, segments and identity graph, quantifying what can be defended and what cannot.
Compliance and regulatory history review
Evaluation of the target's CASL program, any OPC or CAI history, and how its documented practices compare to what its systems actually do.
Contract and sub-processor review
Assessment of platform and data-supplier agreements for assignability, permitted use and any warranties the target has already made about its own compliance.
Findings and pricing support
A clear report identifying gaps, their likely cost to remediate, and where they belong in deal terms, whether as a purchase-price adjustment, holdback or condition to close.
Post-close integration guidance
Support merging consent regimes, policies and access controls between the two organizations so operations start clean rather than inheriting ambiguity.
How the engagement runs
How due diligence runs on a deal timeline
Structured to fit an acquisition calendar, whether the work starts at LOI or well before a sale process begins.
Step 1
Scope the review
Confirm deal structure, timeline and the specific data assets driving valuation, then request the consent, contract and regulatory records that matter most.
Step 2
Assess consent debt
Review the target's lists, segments and identity graph against their documented consent basis, flagging what would not survive a CASL complaint or a Law 25 review.
Step 3
Report findings against deal terms
Deliver a report mapped to how buyers and sellers actually negotiate: what needs disclosure, what needs pricing, and what needs fixing before close.
Step 4
Support integration
Help align consent records, policies and access controls post-close, so the combined company operates on one clean set of practices from day one.
What it costs
What shapes diligence cost on martech deals
Scope tracks the target's complexity: how many products and client relationships it carries, the volume and diversity of lists and identity-graph data, whether Quebec obligations apply, and how compressed the transaction timeline is. Sell-side preparation, done before a data room opens, is consistently cheaper than the discount an unprepared one invites.
We quote per transaction after a short scoping conversation covering the deal's shape, the data assets at stake and the closing date you are working toward.
Martech & Adtech Platforms: M&A due diligence questions, answered
It centres on tracing consent provenance through every list, segment and identity-graph entry the target holds, reviewing its CASL compliance program and any regulatory history, and checking whether data-supplier and platform contracts are assignable on a change of control. The output is a findings report mapped to deal terms, not a general compliance audit.
Consent debt is the gap between what a data room claims an audience asset is worth and what its consent records can actually support. When that gap surfaces late, during exclusivity or after signing, it forces a repricing, a structural change like a holdback, or in the worst cases a walked deal, because the buyer discovers the flagship asset cannot lawfully be used the way the valuation assumed.
Trace how each data category entered the business: first-party collection with documented consent, purchased or licensed third-party data, or scraped and enriched sources, since a joint regulator statement treats scraping publicly accessible personal data as a privacy violation. Also review whether the broker's own customer contracts permit resale or matching in the ways the acquirer intends to continue.
Yes, indirectly but materially. Published findings like the ones against Home Depot's use of hashed emails or Tim Hortons' location tracking define what regulators consider acceptable for practices the target may share, which shapes how much risk a buyer should price into a similar, uninvestigated practice found in diligence.
Yes, and it consistently pays for itself. Sellers who document consent provenance, resolve outstanding CASL or Law 25 gaps, and confirm contract assignability before diligence begins avoid the price adjustments and delays that come from a buyer's advisors finding those gaps first.
A SOC 2 report speaks to security and operational controls, but it does not evaluate whether a target's audience data was collected with valid consent or whether its profiling functions meet Law 25's default-off requirement. Deals in this niche need both a security review and a dedicated consent-provenance assessment, since either gap alone can affect valuation.
More for martech & adtech platforms
Other services for this niche
About this service
What's Protecting Your Business from the Next Threat?
Don't wait for a breach to expose your vulnerabilities. Let Privacy Horizon secure your data, ensure compliance, and build lasting trust.