How to Run IP and Privacy Due Diligence in California M&A Deals

To run IP privacy due diligence, California deal teams must combine two disciplines that have historically been handled in separate workstreams: intellectual property ownership verification and data-protection compliance assessment. In a California transaction, both carry outsized weight because so many targets are technology, software, or data-driven businesses whose core value sits in code, brands, patents, and personal information. The practical effect of getting either wrong is the same, overpaying for assets the seller cannot cleanly transfer, or inheriting regulatory exposure the acquirer never priced. This guide gives you a checklist-first workflow to run the IP privacy due diligence acquisitions demand, with document request lists, a comparison table, sample reps, and escrow guidance you can deploy immediately.

Who this is for: acquirers, sellers, in-house counsel, outside M&A counsel, and deal teams working on California transactions. What you will get: a step-by-step, checklist-first workflow for IP and privacy diligence tailored to California law, plus drafting guidance for reps, indemnities, and escrow.

1. Quick pre-deal checklist, deal timeline and team

Before a single document is reviewed, scope the engagement. The goal is to run IP privacy due diligence California counsel can defend, within a timeline that supports a clean signing and closing. Weak sequencing, privacy review starting late, or IP searches running without a team to interpret them, is the most common cause of missed risk.

Assemble the team and tools

Build a cross-functional diligence team early. At minimum you want corporate M&A counsel, an IP specialist, a privacy/data-protection lawyer, and a technical reviewer (internal or an external code-scanning vendor). Line up the tools you will need: access to USPTO assignment records, Trademark Trial and Appeal Board filings, the U.S. Copyright Office public catalog, an open-source scanning platform, and a data-mapping template. The NIST Privacy Framework offers a widely accepted structure for organizing privacy risk, controls, and data-inventory work, and it makes a useful backbone for the privacy workstream.

Prioritize high-risk assets

Not every asset deserves equal attention. Identify the two or three assets that drive deal value, a flagship patent family, a dominant brand, a proprietary codebase, or a large consumer dataset, and front-load diligence there. For data-heavy targets, early triage of personal-information holdings is essential to run IP privacy due diligence California regulators would consider adequate.

Timing and the document request list

Issue a focused document request list at the outset. What is IP due diligence in an M&A deal? It is the process of confirming that the target actually owns, or has valid rights to use, the intellectual property it claims, and that those rights can be transferred to the buyer free of undisclosed encumbrances, infringement claims, or license restrictions. Your first-wave request should include the IP register, all assignment documents, license agreements, source-code access policies, an open-source inventory, the data inventory, privacy notices, vendor and processor contracts, and the breach register.

2. IP due diligence, core areas and evidence checklist

IP due diligence for M&A transactions requires a methodical walk through each category of intellectual property. The aim is evidence, not assertion: the seller’s confidence that it owns an asset is not a substitute for recorded assignments and clean registrations.

Patents, chain of title verification, prosecution history, licenses

Chain of title review of patents and trademarks is the backbone of IP diligence. For each material patent, confirm the chain of title from inventor to the current owner. Verify that each inventor executed an assignment and that each assignment was recorded with the United States Patent and Trademark Office. Gaps in recorded assignments, a missing employee assignment, an unrecorded corporate name change, or a security interest never released are among the most frequent defects uncovered when teams run the IP privacy due diligence that California deals demand. Pull the full prosecution file to understand scope, office-action history, and any disclaimers, and review all inbound and outbound licenses for exclusivity, field-of-use limits, and change-of-control triggers.

Trademarks, filings, assignments, oppositions

For trademarks, confirm registration status, goods-and-services coverage, and that assignments were recorded with the USPTO. Check for pending oppositions or cancellation proceedings before the Trademark Trial and Appeal Board, and confirm that use has been continuous and that required maintenance filings are current. A lapsed renewal or an unrecorded assignment can leave a brand vulnerable immediately after closing.

Copyrights and content, evidence and registration checks

What documents prove copyright ownership? Registration certificates and recorded documents filed with the U.S. Copyright Office are strong evidence of ownership, though copyright exists upon creation of an original work and registration is not required to own the right. For software, marketing content, and other creative works, confirm that contributor and contractor agreements contain valid work-made-for-hire or assignment language, otherwise a freelancer or former employee may retain rights. Where ownership of key works rests on contractor output, trace each contributor agreement to confirm the rights actually transferred to the target.

Trade secrets, policies, NDAs, access maps

Trade secrets are protected only to the extent the target took reasonable steps to keep them secret. Review confidentiality policies, non-disclosure agreements with employees and third parties, and access controls. Request an access map showing who can reach the most sensitive information. Weak NDA coverage or uncontrolled access undermines the enforceability of trade-secret rights and should be flagged for reps and, where material, indemnity.

Software and open source

Proprietary software diligence overlaps heavily with the open-source audit covered in the next section. At this stage, confirm the target has a software bill of materials, documented source-code access controls, and a clear inventory of what code is proprietary versus third-party.

Chain-of-title document checklist

3. Open source and third-party code audits

An open source audit M&A reviewers conduct can change deal economics overnight. Open-source components are embedded in almost every modern codebase, and the licenses governing them carry obligations, some benign, some capable of forcing disclosure of proprietary source code.

Why open source matters in M&A

Copyleft licenses such as the GPL and AGPL can require that derivative or linked code be made available under the same terms. If a target has combined proprietary code with strongly copyleft components in a way that triggers those obligations, the buyer may inherit an obligation to make source code available that it intended to keep confidential. That is why an open-source review is a core part of any effort to run the IP privacy due diligence that California technology deals require.

Scanning tools and reports to request

Request a current software bill of materials and run an automated composition scan against the production codebase. Ask for prior scan reports, the target’s open-source usage policy, and records of how open-source approvals are tracked. A credible SBOM, cross-checked against an independent scan, is the fastest way to validate the target’s own representations about its code.

License risk matrix and remediation steps

Classify each identified component by license risk. Permissive licenses (MIT, BSD, Apache) generally present lower risk if attribution and notice requirements are met. Weak copyleft (LGPL, MPL) carries moderate obligations. Strong copyleft (GPL, AGPL) warrants close review of how the component is used and linked. For high-risk findings, define remediation: replacing the component, re-architecting to remove the triggering linkage, or obtaining a commercial license.

When infringement risk triggers holdbacks or escrow

How should open-source code be audited during M&A? Through a combination of an SBOM, an automated scan, a license-risk classification, and verification of compliance for the most critical modules. Where the audit reveals material, unremediated copyleft exposure or a credible infringement claim, that finding should drive a specific indemnity, a holdback tied to remediation, or a source-code escrow arrangement discussed below.

4. Privacy due diligence, CPRA and CCPA focus

Privacy due diligence for California transactions is now as consequential as IP review, because California’s data-protection regime imposes concrete obligations that transfer with the business. CPRA due diligence is not a compliance tick-box; it is a valuation and risk-allocation exercise.

Which California laws apply, CPRA vs CCPA

What California privacy laws apply to acquirers? The California Consumer Privacy Act (CCPA), enacted as AB-375, established California’s consumer privacy framework. It was subsequently amended and expanded by the California Privacy Rights Act (CPRA), approved by voters in 2020 as Proposition 24, which among other things, created the California Privacy Protection Agency and granted it rulemaking and enforcement authority. The California Attorney General also retains enforcement authority. For a target that collects California residents’ personal information, the first CPRA due diligence question is whether it meets the applicable statutory thresholds and, if so, whether its practices are compliant.

Data inventory and mapping steps

How do you map data inventories for CPRA due diligence? Build or validate a data inventory that records what categories of personal information the target collects, where it is stored, why it is processed, who it is shared with, and how long it is retained. Both the California Attorney General and the CPPA treat data inventories and documented data flows as foundational to compliance, and the NIST Privacy Framework provides an accepted methodology for the mapping exercise. When you run an IP privacy due diligence California regulators would scrutinize, a current and accurate data map is the single most useful artifact you can obtain.

Data subject rights, opt-outs, and service provider vs contractor designations

Confirm that the target can actually honor consumer rights, access, deletion, correction, and opt-out of the sale or sharing of personal information. Review how opt-out preference signals are handled and whether the target’s privacy notices accurately describe its practices. Scrutinize vendor contracts to confirm that third parties are correctly designated as service providers, contractors, or third parties, with the contractual terms those designations require. A mislabelled vendor relationship can convert a routine data transfer into a reportable sale or sharing.

Data flows, transfers, and cross-border issues

Map where personal information moves, including any transfers to affiliates, vendors, or jurisdictions outside the United States. A data transfer assessment should identify whether cross-border flows are documented and whether contractual safeguards are in place. Complement the California analysis with the baseline data-security expectations set out in the Federal Trade Commission’s privacy and security guidance, which acquirers frequently reference when assessing a target’s security posture.

Data-inventory request list

• Data map. Categories of personal information, sources, storage locations, and recipients.
• Privacy notices. Current and prior versions of consumer-facing notices.
• Consent and opt-out records. Evidence of how consents and opt-outs are captured and honored.
• Vendor and processor contracts. Service-provider and contractor terms and data-processing addenda.
• Retention schedules. Documented retention and deletion practices.
• Data-protection assessments. Any risk assessments or impact analyses the target has performed.

5. Data-breach and regulatory history checks

A target’s incident history is a direct indicator of latent liability. These checks should run in parallel with the privacy workstream whenever you run an IP privacy due diligence for California deals.

Incident logs, breach notifications, and remediation records

How do you assess prior data breaches and regulatory notices? Request the full breach register, copies of any consumer or regulator breach notifications issued, and records of remediation. Look for patterns, repeated incidents of the same type suggest an unresolved control weakness that will likely recur under new ownership.

Regulatory notices, consent decrees, and fines

Ask for any correspondence with the CPPA, the California Attorney General, or the FTC, along with any consent decrees, orders, settlements, or penalties. An open investigation or an outstanding consent decree is a material contingent liability that should be reflected in price, reps, and indemnity.

Materiality assessment for reps and indemnities

For each finding, assess materiality: the magnitude of potential penalties, the volume and sensitivity of affected data, and whether the underlying weakness has been fixed. That assessment feeds directly into whether a disclosed issue becomes a specific indemnity, a holdback, or merely a scheduled exception to a representation.

6. Drafting reps, warranties and indemnities, allocating IP and privacy risk

Diligence findings only protect the buyer if they are translated into contract. Reps and warranties IP privacy coverage allocate risk between the parties and set the triggers for recovery. The clauses below are illustrative templates only; counsel should tailor them to the specific transaction.

Model rep language, IP ownership and non-infringement

What reps and indemnities should cover privacy and IP? Start with ownership and non-infringement. A short-form IP ownership and open-source rep might read:

“The Company exclusively owns, or has valid and enforceable rights to use, all Intellectual Property used in its business, free of all liens and encumbrances. To the Company’s knowledge, the conduct of its business does not infringe any third party’s Intellectual Property. The Company’s use of open-source software complies with all applicable licenses and does not require disclosure of any proprietary source code.”

Privacy-specific reps

Privacy reps should address the accuracy of notices, the validity of consents, and the flow-down of obligations to vendors. For example:

“The Company’s collection, use, and disclosure of personal information complies in all material respects with applicable California privacy laws, including the CCPA as amended by the CPRA. The Company’s privacy notices accurately describe its data practices, all required consents have been obtained, and its agreements with service providers and contractors contain the terms required by applicable law.”

Indemnity triggers, caps, survival periods, and carve-outs

Tie indemnities to breaches of the IP and privacy reps and to specifically disclosed issues. Negotiate caps, baskets, and survival periods calibrated to risk. Fundamental reps, including core IP ownership, frequently survive longer than general reps, and some ownership reps survive for extended periods or until recordation of key assignments is complete. For undisclosed data breaches and regulatory matters, align survival with applicable limitation and regulatory look-back periods, and consider carving these matters out of general caps where exposure is severe.

Sample short-form clauses and negotiation tips

Use schedules to disclose known issues rather than diluting the reps themselves, a clean rep with specific scheduled exceptions is easier to enforce than a heavily qualified one. Where a diligence finding is significant but quantifiable, a dedicated special indemnity with its own cap and survival period is usually preferable to relying on general indemnification. Treat these templates as starting points; always confirm language with transaction counsel.

7. Escrow, holdbacks and remedies for source code and data

Where reps and indemnities alone do not adequately secure the buyer, structural protections fill the gap.

When to insist on source-code escrow

When should buyers use escrow and holdbacks for source code or data? Software escrow California deal teams negotiate makes sense when the target’s operations depend on proprietary code that carries business-continuity risk, or where escrow reduces execution and indemnity exposure. If the codebase cannot be cleanly transferred at closing, for example, pending remediation of an open-source issue, an escrow bridges the gap.

Escrow agents, release triggers, and verification

Use a neutral escrow agent, define objective release triggers, and build in verification so the deposited materials are genuinely complete and usable. A source-code escrow that holds an incomplete or non-building copy offers false comfort.

Holdbacks vs escrows vs insurance

Holdbacks retain part of the purchase price against post-closing claims; escrows set aside specific assets or funds with a third party; representations and warranties insurance transfers risk to an insurer. Many California technology deals use a combination: a holdback for identified privacy remediation; an escrow for source code; and insurance for unknown breaches of the reps.

8. Negotiation and post-closing integration checklist

Diligence does not end at signing. The findings from IP privacy due diligence in California deals require a disciplined post-closing plan.

Post-closing remediation, transition services, and recordation

Close out the items identified in diligence. Record outstanding patent and trademark assignments with the USPTO and copyright-related documents with the U.S. Copyright Office so the buyer’s ownership is reflected in the public record. Where privacy gaps were found, execute the remediation plan and ensure any agreed transition services keep data processing compliant during integration.

IP prosecution and maintenance obligations

Assign responsibility for ongoing IP prosecution and maintenance, renewal deadlines, maintenance fees, and continued trademark use, so that rights acquired at closing are not lost through administrative lapse afterwards.

Comparison table: IP vs privacy due diligence

The table below helps deal teams allocate effort across the two workstreams.

Conclusion and quick action checklist

To run an IP privacy due diligence that California acquisitions require, work the two disciplines in parallel from day one: verify IP ownership through recorded assignments and clean registrations, audit open-source exposure against an SBOM, build or validate a CPRA-aligned data inventory, investigate breach and regulatory history, and translate every material finding into tailored reps, indemnities, holdbacks, or escrow. The teams that run IP privacy due diligence on California deals most effectively are those that start early, prioritize high-value assets, and close the loop with recordation and remediation after closing. For a tailored diligence engagement, contact the Global Law Experts Corporate team in the USA.

This article is for general information only and is not legal advice. Sample clauses are illustrative templates; consult qualified transaction counsel before relying on any language or approach described here.

Sources

1. California Attorney General, CCPA overview
2. California Legislative Information, AB-375 (CCPA) bill text
3. California Privacy Protection Agency (CPPA)
4. Federal Trade Commission, Privacy & Security guidance for businesses
5. United States Patent and Trademark Office, Assignment Center
6. U.S. Copyright Office
7. NIST Privacy Framework