Legal Due Diligence for Online Business Buyers

Buying an online business means buying rights: to content, code, designs, a brand, customer relationships and contracts. If any of those rights are missing, unclear or tied up elsewhere, the business you pay for may not be the business you can actually run. Legal due diligence is how you check, before you sign, that the seller owns what they’re selling and that nothing hidden comes with it.

This checklist covers the main areas for small online businesses, the documents to request, the red flags to watch for and how findings feed into the agreement. It’s practical guidance, not legal advice; for larger or more complex deals, a lawyer in the relevant country is worth the cost. For the wider process, see due diligence for an online business.

The seven areas

Legal due diligence on a small online business usually covers seven areas. Not every deal needs the same depth: a small content site may need a few hours, while a software company with staff and customer contracts needs much more. Work through each area, request the documents, and note every gap.

1. The seller’s authority to sell

• Who legally owns the business: an individual, partners or a company.
• If a company, its registration details and who can sign for it.
• Whether any co-founder, partner or investor must agree to the sale.
• Whether the business or its assets are pledged as security for a loan.

It sounds obvious, but it’s a common problem: a business started by two friends, where only one wants to sell, or a company whose shareholder agreement requires approval from investors. Ask directly, check company records where they exist, and make sure the person signing the agreement has the authority to do so.

2. Intellectual property

• Who created the content, code, designs, videos and images.
• Written assignments from contractors, freelancers and agencies.
• Licences for fonts, stock images, music, themes, plugins and software.
• Open-source licences used in code, and whether they fit the business’s use.
• Any content copied, scraped or closely based on someone else’s.

In the United States, the Copyright Office explains when commissioned work counts as “work made for hire”; outside those situations, the creator may own the copyright unless there’s a written assignment. That’s why contractor agreements matter so much. Our guide to intellectual property in digital products goes deeper.

3. Trademarks and domains

• Registered trademarks for the brand, and who owns them.
• Searches for conflicting marks in the countries where the business operates.
• Domain ownership confirmed in the registrar account and public registration data.
• Social handles and other brand assets.

The U.S. Patent and Trademark Office provides a free trademark search for its database, and other countries have their own registers. A brand that conflicts with someone else’s registered mark can force an expensive rename after you buy.

4. Contracts

• Supplier and manufacturer agreements.
• Customer contracts, especially with custom terms or service levels.
• Contractor, freelancer and staff agreements.
• Affiliate, advertising and sponsorship agreements.
• Software and service subscriptions in the business’s name.
• Whether each contract can be transferred, and whether consent is needed.

Look for clauses that matter in a sale: change-of-control clauses that let the other side end the contract, exclusivity, minimum commitments, automatic renewals and promises the business must keep. Contracts that need the other side’s consent to transfer should be raised with them before signing, not after.

5. Privacy and data protection

• What personal data the business holds: customers, subscribers, users.
• Privacy policy and how consent was collected.
• Where data is stored and which providers process it.
• Any data breaches or complaints.
• Email marketing consent and unsubscribe handling.

If the business serves people in the European Union, the GDPR sets rules on handling personal data, including when it’s transferred as part of a sale. In the United States, the FTC’s CAN-SPAM guide sets requirements for commercial email. A list collected without proper consent can be a liability rather than an asset.

6. Platform terms

• Terms of every platform the business depends on: stores, marketplaces, app stores, ad networks, affiliate programmes.
• Whether accounts can be transferred to a new owner.
• Whether the business currently complies with each platform’s rules.

Platform rules can decide what you’re really buying. Etsy’s help says accounts can’t be transferred; Amazon’s Associates agreement can’t be assigned without Amazon’s approval; Discord’s Monetization Policy requires approval for selling monetized servers. Check each relevant platform in writing.

7. Disputes, claims and compliance

• Past or pending legal claims, complaints or threatened action.
• Copyright or trademark notices received.
• Chargeback disputes and consumer complaints.
• Tax registrations and filings related to the business.
• Industry rules that apply, such as disclosures for affiliate content or product safety rules.

In the United States, the FTC’s Endorsement Guides say affiliate relationships should be disclosed clearly; a business missing disclosures carries a compliance task you’ll inherit.

Legal due diligence by asset type

• Content and affiliate sites: writer assignments, image licences, affiliate programme terms and disclosure practices.
• SaaS and apps: code ownership, open-source licences, customer contracts, data processing terms and app store agreements. See SaaS due diligence.
• E-commerce: supplier agreements, product safety and labelling, trademarks on products and packaging, and consumer law obligations on returns. See supplier due diligence.
• Newsletters and communities: consent records, sponsorship agreements and platform terms.
• Social and game accounts: platform terms for the account type, and the handover of email and security settings.
• Domains: registration ownership, trademark conflicts and any dispute history.

Questions to ask the seller

1. Who created each part of the business, and where are the agreements?
2. Are there any partners, investors or lenders who need to approve the sale?
3. Which contracts will move with the business, and do any need the other side’s consent?
4. What personal data does the business hold, and how was consent collected?
5. Have you ever received a legal notice, takedown request or complaint?
6. Which platforms does the business depend on, and what do their terms say about a change of owner?

From request to signed agreement

1. Send a request list grouped by the seven areas.
2. Set up a shared folder (a data room) where the seller uploads documents.
3. Review each item and note gaps and risks.
4. Ask the seller to fix what can be fixed before signing, such as missing assignments.
5. Put remaining promises in the agreement as warranties: statements the seller confirms are true.
6. Sign once conditions are met, with payment held by escrow or a middleman.

Key clauses in the sale agreement

Legal due diligence feeds directly into the agreement. For a small online business, the agreement usually covers:

• The assets: a full list of what’s included, from domains and code to accounts, files and contracts.
• Price and payment: amount, method, escrow or middleman, and any part paid later.
• Handover: the steps, timing and what counts as complete.
• Warranties: the seller’s written promises about ownership, figures and claims.
• Assignment of IP: transferring copyright and other rights to the buyer.
• Restrictive terms: a reasonable non-compete or non-solicitation; see non-competes in an online business sale.
• Transition support: what help the seller provides afterwards.
• Governing law and disputes: which country’s law applies and how disagreements are resolved.

Warranties and conditions

You can’t verify everything. Warranties fill the gap: the seller confirms in writing, for example, that they own all the content, that no claims are pending and that the figures provided are accurate. If a warranty later proves false, the agreement says what happens. Conditions go further: things that must happen before the deal completes, such as a contractor signing an assignment or a key supplier agreeing to continue.

Cross-border deals

Online businesses often have a buyer in one country, a seller in another and customers everywhere. That raises a few extra questions: which country’s law governs the agreement, where disputes would be heard, how taxes apply to each side, and which data protection and consumer rules apply to the customers. None of these needs to stop a deal, but they should be decided deliberately and written into the agreement rather than left to chance. For larger cross-border deals, advice from a lawyer familiar with both countries is especially valuable.

After the sale

Legal due diligence keeps paying off after completion. Record any trademark or domain assignments with the relevant offices and registrars, update the business details in privacy policies and terms, notify suppliers and partners whose contracts moved, and keep the full set of documents together. If a question comes up later, such as a claim about a piece of content, the records show who owned what and what the seller promised.

Keeping it proportionate

For a small website or account, legal due diligence doesn’t need to be heavy. A short request list, a few hours of review and a clear agreement with warranties is often enough. Scale the effort to the price, the complexity and the risk: the aim is to find the problems that would matter, not to create paperwork for its own sake.

A worked example

The details below are made up to show the process.

A buyer is purchasing a recipe website with a cookbook sold as a digital download. Legal due diligence finds three issues: the site’s logo was designed by a freelancer with no written agreement; several photos came from a stock library under a licence that covers web use but not products for sale; and the email list was partly built from a giveaway with unclear consent.

The seller obtains a signed assignment from the designer, the buyer budgets to replace the cookbook photos, and the giveaway subscribers are separated so the buyer can ask them to confirm consent. The agreement includes warranties on content ownership and no pending claims. The deal goes ahead, at a slightly adjusted price, with each issue solved or allowed for.

Red flags

• A seller who can’t say who created the content or code.
• A brand name close to a well-known registered trademark.
• Key accounts in someone else’s name.
• Contracts with change-of-control clauses on major customers or suppliers.
• Email lists with no record of consent.
• Unexplained legal notices or takedown requests.

When to use a lawyer

For small, simple deals, careful review and a clear agreement may be enough. Bring in a lawyer when the price is significant, the business has staff or many contracts, holds sensitive personal data, operates in several countries or has any history of disputes. A lawyer can also draft or review the sale agreement, warranties and conditions.

Frequently asked questions

Keep reading

• Operational Due Diligence: Processes, Tools and Contractors
• How to Check a Seller Before You Buy
• PayPal and Card Chargebacks: Why Sellers Avoid Them
• Free Website Valuation Tools: How Accurate Are They?

Sources