Selling Or Purchasing An Online Business? Make Sure You’re Protected (2026 Updated)

Buying or selling an online business can feel like the “smart” shortcut - the brand is already built, the website is live, and the marketing channels are (hopefully) humming along.

But because the assets are digital, it can be surprisingly easy to misunderstand what’s actually being sold, who owns what, and what liabilities come along for the ride.

This guide is updated for current expectations around online trading, privacy, and digital assets, so you can approach a purchase or sale with clear, practical steps to protect yourself from day one.

What Are You Really Buying Or Selling In An Online Business?

When you’re dealing with an online business, you’re usually not just buying “a website”. You’re buying a bundle of assets and relationships - and if the bundle isn’t clearly defined, that’s where disputes start.

Before you agree on a price (or even a headline deal), get specific about what is included and what is excluded. In a well-run transaction, this will be captured in the sale agreement and the completion process.

Common Online Business Assets To Identify Clearly

• Domain name(s) (including variations, country domains, and any “parked” domains)
• Website (codebase, CMS admin access, hosting accounts, and any custom plugins/themes)
• Brand assets (name, logos, style guides, social handles)
• Customer and subscriber lists (and whether you can lawfully transfer them)
• Supplier and contractor relationships (including dropshipping, fulfilment, and marketing contractors)
• Content (blog posts, product photos, videos, graphics, templates)
• Digital products (courses, downloads, templates) and the IP behind them
• Store accounts (Shopify, Amazon, Trade Me, eBay), advertising accounts (Meta/Google), and email marketing tools
• Recurring revenue contracts (subscriptions, retainers, licences) and the rights to transfer them

Asset Sale Vs Share Sale (The “What Am I Actually Taking On?” Question)

In New Zealand, many online business transactions are structured as either:

• An asset sale: you buy specific assets of the business (often preferred by buyers because you can “pick and choose” what you take).
• A share sale: you buy the company that owns the business (often preferred by sellers because it can be cleaner operationally).

The key difference is risk.

In a share sale, you may be taking on the company’s existing obligations and historical liabilities (even ones you don’t know about yet). In an asset sale, you can usually limit what transfers - but it still needs to be drafted carefully, especially around staff/contractors, subscriptions, and customer data.

If you’re at the stage of documenting a transaction, a tailored Asset Sale Agreement is often the backbone of making sure both sides understand the deal.

Do Your Due Diligence Before You Pay (Or Hand Over The Keys)

Due diligence is just a structured way of saying: “trust, but verify”.

It’s tempting to rely on screenshots, dashboard snapshots, and verbal assurances - but a purchase is where you want evidence, not optimism.

Financial And Performance Checks (Beyond The Pretty Graphs)

A buyer should usually request enough information to confirm revenue is real and sustainable, for example:

• Sales reports that match bank statements or payment processor reports (Stripe/PayPal)
• Breakdown of revenue by channel (organic, ads, marketplace, email)
• Return/refund rates and chargebacks
• Subscription churn (if it’s a membership or SaaS-style business)
• Key costs (apps, contractor costs, ad spend, licences)
• Tax position and whether GST is correctly handled (where applicable)

Sellers can help the process by preparing a tidy due diligence pack early, rather than scrambling when the buyer asks questions at the last minute.

If you want a more structured approach, a Legal Due Diligence process can help identify common red flags before they turn into expensive surprises.

IP Ownership (Because “We Made It” Isn’t The Same As “We Own It”)

Online businesses often rely heavily on intellectual property - and ownership can be messy if contractors have been involved.

As the buyer, you’ll want to confirm:

• Who created the logo, website, product photography, and copywriting
• Whether contractors assigned IP to the business in writing
• Whether any stock images/fonts/music are properly licensed
• Whether the business name or brand infringes someone else’s trade mark

As the seller, it’s worth tightening these up before going to market, because buyers will either (a) reduce the purchase price, or (b) walk away if they can’t get comfortable that the IP is clean.

Tech And Access Checks (So You Don’t Buy A Business You Can’t Operate)

In an online business sale, “handover” is often the real make-or-break moment.

Before completion, buyers should confirm:

• Admin access will be transferred for the domain registrar, hosting, and CMS
• Any critical accounts aren’t tied to a personal email the seller won’t hand over
• There’s a documented list of tools and subscriptions needed to run the business
• There is a workable transition plan (even if it’s just a few weeks of support)

This is also where you want the contract to clearly deal with what happens if something can’t be transferred (for example, certain advertising accounts) and what the workaround will be.

What Laws Apply When Selling Or Buying An Online Business In NZ?

Even if the business is “all online”, the legal obligations are very real.

As a general rule, the buyer should assume they’re stepping into a business that must comply with New Zealand’s consumer, privacy, and marketing laws - and the seller should assume that statements made during negotiations can come back to bite if they’re inaccurate.

Fair Trading Act 1986 (Be Careful What You Say And Promise)

The Fair Trading Act 1986 prohibits misleading or deceptive conduct in trade.

In a sale context, this can matter if (for example):

• Revenue is overstated or presented in a way that hides significant ad spend
• Traffic claims are inflated (or based on paid traffic presented as “organic”)
• Key supplier relationships are implied to be secure when they’re not
• “Exclusive” arrangements aren’t actually exclusive

Buyers should ask for warranties in the sale agreement to back up important claims, and sellers should be disciplined about what they represent (and what they don’t).

Consumer Guarantees Act 1993 (If The Business Sells To Consumers)

If the online business sells goods or services to consumers in New Zealand, the Consumer Guarantees Act 1993 may apply.

That means the business generally needs to honour consumer guarantees around acceptable quality, fitness for purpose, and remedies - and you can’t just “contract out” of this when selling to consumers.

For buyers, it’s worth checking the business’s refund and returns process, and whether customer complaints have been handled appropriately. For sellers, clear customer-facing terms and processes reduce the risk of post-sale blow-ups.

Privacy Act 2020 (Customer Data Is Not A Free-For-All)

Customer email lists and behavioural data are valuable - but they’re also regulated.

The Privacy Act 2020 requires you to collect, use, store, and disclose personal information in a lawful and transparent way. When a business is sold, transferring customer data can raise real privacy issues, especially if customers weren’t told their data may be transferred in a sale.

As a buyer, you’ll want to check:

• What the business told customers at the time of collection
• Whether there’s an up-to-date Privacy Policy that covers business transfers or disclosure to new owners
• Whether marketing emails comply with consent expectations and unsubscribe requirements
• Whether the business has had any privacy complaints or data breaches

As a seller, it’s smart to be upfront about what data is being sold, and make sure the sale agreement includes obligations about secure transfer and ongoing confidentiality.

What Should Your Online Business Sale Agreement Cover?

A good agreement doesn’t just record the price - it sets expectations and allocates risk.

If there’s one common mistake we see, it’s parties relying on informal emails or a basic template that doesn’t match how online businesses actually work. Online businesses have unique assets (domains, accounts, IP, customer data), and the agreement needs to deal with them clearly.

For many transactions, a tailored Business Sale Agreement is the best way to capture the full deal properly.

Key Clauses To Get Right

Depending on whether it’s a share sale or asset sale, your agreement will usually need to cover:

• Exactly what’s being sold (assets included and excluded, and how transfer happens)
• Purchase price and payment terms (deposit, adjustments, earn-outs, or staged payments)
• Completion and handover steps (a clear process, with timelines and responsibilities)
• Restraints (so the seller doesn’t immediately launch a competing clone)
• Confidentiality (especially when buyer due diligence involves sensitive financial and customer data)
• Warranties and indemnities (who bears the risk if something turns out to be untrue)
• Transition support (handover training, introductions to suppliers, and access to systems)
• Dispute resolution (what happens if the deal goes sideways)

Warranties That Matter In Online Business Deals

Warranties are promises in the contract. If they’re wrong, the other party may have a claim.

Common online-business warranties buyers often ask for include:

• The seller owns (or has the right to transfer) the domain, website content, and IP
• There are no undisclosed disputes (supplier disputes, customer claims, IP complaints)
• Financial statements and performance information provided are accurate
• Key contracts are disclosed and are not in default
• The business has complied with applicable laws (including privacy and consumer law)

Sellers often worry warranties are “too risky”. The goal isn’t to trap you - it’s to make sure the buyer isn’t buying surprises. A properly negotiated agreement can make warranties fair, limited to what you actually know, and backed by appropriate disclosure.

Completion Checklists Are Not Optional

Because there are so many moving parts, online business sales should use a completion checklist - it’s basically the step-by-step list of everything that needs to happen at handover, so nothing is missed.

A good checklist often covers:

• Domain transfer confirmation
• Website hosting transfer
• Admin access for e-commerce platforms
• Transfer of social accounts (or agreed alternative arrangements)
• Transfer/assignment of key supplier agreements
• Delivery of IP assignment documents (where needed)
• Secure transfer of customer data (where lawful)

Using a structured Completion Checklist helps keep both sides aligned and reduces “completion day” stress.

Special Risks In Online Business Sales (And How To Handle Them)

Online businesses can be fantastic purchases - but there are a few risk areas that come up again and again.

Once you know what they are, you can plan for them in the agreement and due diligence process.

1) Vendor Finance And Earn-Outs

Some deals involve the seller financing part of the purchase price (vendor finance), or the buyer paying more later if the business hits certain targets (earn-outs).

These can work well, but only if the terms are crystal clear, including:

• How repayments are calculated and when they’re due
• What happens if revenue drops (and why)
• What access the seller has to reporting (if any)
• Default provisions and what security the seller gets

If you’re considering this structure, it’s worth documenting it properly with a Vendor Finance Agreement rather than relying on informal promises.

2) Contractors, Agencies, And “Key Person” Dependence

Many online businesses rely on a small number of people who know how everything works - a VA, a developer, a marketing agency, or the founder themselves.

As a buyer, you’ll want to know:

• Who does what each week to keep the business running
• Whether key contractors will stay on after completion
• Whether the business owns the work product created by contractors
• Whether there are written agreements in place

As a seller, if contractors are critical, it’s worth tightening the documentation before sale - it makes the business easier to transfer and usually more valuable.

3) Data, Email Lists, And Marketing Consents

It’s easy to assume “the email list is part of the business”, but the legal question is whether the business has the right to transfer and keep using that personal information under the Privacy Act 2020 and general consent expectations.

Practical ways to reduce risk include:

• Making sure customer-facing policies disclose that information may be transferred if the business is sold
• Only transferring data that is genuinely required to operate the business
• Having the buyer agree to handle transferred data securely and lawfully
• Considering a customer notification plan where appropriate

This is also a good moment to check the business’s broader online legal hygiene - for example, whether website terms are in place and reflect how the store actually operates.

4) Platform Dependence (Shopify, Meta, Google, Marketplaces)

If 80% of revenue depends on one platform, you’ll want to treat that like a major risk factor.

Sometimes the issue isn’t just “what if Meta changes the algorithm?”. It’s more immediate:

• Ad accounts can be restricted or banned
• Marketplace accounts may not be transferable
• Supplier integrations may break during migration
• Critical automations may be undocumented

In the agreement, consider requiring evidence of account status, setting completion conditions (e.g. certain accounts must be transferred), and including a transition support period so the seller can help stabilise operations.

Key Takeaways

• In an online business sale, you need to be clear about what is actually being bought or sold - domains, IP, customer data, accounts, and contracts should all be documented.
• Asset sales and share sales allocate risk differently, so it’s important to structure the transaction in a way that suits your situation (and to document it properly).
• Due diligence should cover financials, traffic sources, tech access, IP ownership, key contractors, and whether the business can lawfully transfer customer data.
• The Fair Trading Act 1986, Consumer Guarantees Act 1993, and Privacy Act 2020 commonly impact online businesses, especially around advertising claims, customer remedies, and personal information handling.
• A well-drafted sale agreement should cover assets, payment terms, completion steps, warranties, restraints, and transition support so you’re protected if something goes wrong.
• Online business deals have unique risk areas (like platform dependence and email list transfers), and the easiest way to manage them is to identify them early and address them directly in the contract.

If you’d like help buying or selling an online business, we can talk you through the right structure, due diligence, and contracts. Reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.