What Diligence Should Be Asking
A target's website is not one asset. It is a domain portfolio held under registrar agreements, a set of third-party platform accounts governed by platform terms, a code base assembled largely from components the target does not own, licensed images and fonts, and contracts with agencies and developers that may or may not have transferred anything. Each of those sits with a different counterparty and moves on different terms.
The question technology and IP diligence should be putting is narrow and answerable: for every element of the target's online presence, who is the owner of record today, and what specifically has to happen for that to become the buyer after closing. The answer differs for domains, for code, for content, and for advertising accounts, and it is established from records rather than from representations.
What follows is a diligence checklist — the questions worth asking and the documents worth requesting. It is not a legal opinion, it does not address how any particular transaction should be structured, and it is not a substitute for counsel who can read the actual contracts.
Why This Gets Left Until After Closing
It is routinely skipped because it is nobody's item. IP diligence goes to patents and registered marks. Technology diligence goes to the product and its infrastructure. Commercial diligence goes to customers and contracts. The marketing website falls between all three, and it is assumed to travel with the business because it has the business's name on it. It is also small relative to the headline numbers, which makes it easy to leave as a checklist line marked confirmed.
The cost of skipping it does not appear at closing. It appears three months later, when the integration team wants to redirect the target's site into the acquirer's and finds the domain registered to a contractor who stopped working for the target in 2019. Or when a demand letter arrives about a photograph the seller licensed under terms that did not permit transfer. Or when the paid-search account turns out to live inside an agency's manager account, and the conversion history that underpinned the revenue model goes with it.
These are recoverable problems. They are recovered on the buyer's time and at the buyer's cost, and the indemnity that would have covered them was negotiated by people who did not know they existed.
The Domain Portfolio, Name by Name
The deliverable is not a list of domain names. It is the registration record for each one: the registrant of record, the accredited registrar, whether the registration is held through a reseller, the expiry date, the name servers, and the status codes.
Scope it properly. The primary domain, plus defensive registrations covering misspellings, hyphen variants and alternative extensions; country-code variants for every market the target sells into; campaign and microsite domains; and names acquired in the target's own earlier acquisitions and never consolidated. Domains registered by regional offices, distributors or individual sales staff are a recurring finding, and they are usually the ones registered to an individual.
Country-code domains sit outside ICANN consensus policy and follow their own registry rules for transfer, expiry and eligibility. Several impose local-presence requirements, which becomes a live problem when the registrant entity is dissolved after closing.
Then there is the scheduling problem. Under the ICANN Transfer Policy in force, a change of registrant triggers a 60-day inter-registrar transfer lock, although a registrar may allow the registrant to opt out of that lock in advance of the change — the election has to be made before the change, not after. A registrar may also deny a transfer within 60 days of an earlier transfer or of initial registration. None of that is a legal risk; it is a constraint on the closing timetable, and it is entirely manageable if it is known about early and impossible to unwind if it is not. A policy review that would alter this structure is pending at ICANN; as of mid-2026 the Board has not adopted it and the 60-day locks remain in effect.
Hosting, DNS, Certificates, and Mail
Hosting, CDN, DNS, TLS certificates and mail all follow the domain, and in a poorly governed target each of them sits somewhere different: the DNS zone in an agency's account, the CDN on a developer's personal login, certificates issued against an address belonging to someone who has left.
Ask for the account of record and the named administrators for each; whether the target or an agency holds the billing relationship; where TLS private keys live and who can renew them; and who is able to change the SPF, DKIM and DMARC records that determine whether the company's mail is treated as authentic. Whoever controls DNS can obtain a publicly trusted certificate for the domain, redirect MX records and receive the company's mail, and through that mail reset credentials on nearly everything else. That makes it a control question rather than an IT logistics question.
The failure at closing is usually quieter than any of that. A certificate expires two weeks after completion because the renewal notice went to a mailbox disabled during integration, and a public-facing site goes down over a weekend. Ask for the renewal calendar alongside the account list.
The Licences Buried Inside the Website
A modern site is largely assembled from things the target licensed rather than owns. The diligence request is for the licence records, not the files.
- Stock images. A stock purchase is a licence, not a transfer of copyright, and standard royalty-free licences are typically non-exclusive, non-transferable and non-sublicensable. Licences generally do not travel in an asset sale or a merger absent the agency's consent. Ask for the invoice, licence ID, download record, purchasing account and licence type for each image — a folder of files proves nothing.
- Editorial-only and unreleased content. Editorial-licensed images used on commercial pages are among the most common findings, and they carry third-party exposure — publicity, trademark, property — beyond the stock agency's own contract.
- Fonts. Webfont licences are commonly scoped per domain or capped on page views, and are frequently registered in the agency's name rather than the client's.
- Themes, plugins and code libraries. Ask for a bill of materials in SPDX or CycloneDX format listing every component, its version and its licence. Strong copyleft licences impose source-availability obligations on distributed derivative works; network copyleft extends that obligation to users interacting with the software over a network, which is precisely the posture of a hosted application. Source-available licences such as SSPL, BUSL and the Elastic License are not open source and carry commercial-use restrictions.
- AI-generated assets. The US Copyright Office requires applicants to disclose AI-generated material and describe the human contribution, and the D.C. Circuit held in Thaler v. Perlmutter in March 2025 that the Copyright Act requires a work to be authored in the first instance by a human being. An IP schedule listing AI-generated marketing assets as owned works may be materially overstated.
Assignment Clauses and What the Deal Structure Changes
Under 17 U.S.C. 201(a) copyright vests initially in the author, and paying for a work does not by itself transfer it. A clause reading that all deliverables shall be works made for hire is, standing alone, generally ineffective for a website: the statutory route for commissioned work requires the work to fall within one of nine enumerated categories in 17 U.S.C. 101, and source code, website visual design and marketing copy do not appear on that list. A transfer of copyright ownership requires an instrument in writing signed by the owner of the rights conveyed, under 17 U.S.C. 204(a). In website engagements, statements of work and email threads are frequently the only writing that exists.
What to look for in the target's development and agency contracts: present-tense assignment language rather than a promise to assign at some future point; a fallback licence if the assignment is held ineffective; further-assurances and power-of-attorney provisions, which are what rescue a transaction when the agency has since dissolved; and sub-contractor flow-down, because an agency's assignment is only as good as what its own freelancers and offshore partners signed.
Deal structure changes the mechanics. As a general matter, in a stock purchase the target entity survives and its contracts and licences remain with it, subject to any change-of-control provisions. In an asset purchase every asset has to be identified and assigned, and anything non-assignable needs the counterparty's consent — which is the position of most stock image licences, many font licences, and several platform accounts. The schedule of transferred assets is where that is either handled deliberately or discovered a year later.
Advertising, Analytics, and Search Console Accounts
These are third-party platform accounts governed by the platform's own terms. A contract can oblige a seller to transfer them; it cannot make the platform do so. The platform mechanics decide the outcome, and they are worth reading before the reps are drafted.
Google documents that a Google Ads client account can have only one owner, that ownership runs up the manager account hierarchy, and that although a client account still owns its data and can unlink a manager, users of the client account do not have permission to transfer ownership. If the target's account was created inside an agency's or a seller's manager account with no client-side administrator, the buyer's practical position is considerably weaker than the phrase owns its data suggests.
In Search Console, verified owners hold a token — a DNS record, an HTML file, a meta tag — and delegated owners are granted ownership without one. Removing a user is not sufficient: a removed owner can re-verify and regain access if the token is still in place, so the token itself has to come out. If every verified owner removes their token, remaining users lose access to the property after a grace period.
What frequently does not survive a change of account ownership is the accumulated data rather than the access: conversion history and the training data behind automated bidding, remarketing and customer-match audiences, search-terms and change history, and linked assets such as Merchant Center and analytics connections. Where analytics properties or tag manager containers were created under the seller's own identity, check the platform's current documentation on moving them rather than assuming it can be done on the closing timetable.
Search Visibility When Brands and Sites Are Consolidated
Consolidating brands after a deal is a site migration, and it behaves like one. Retiring the target's domain into the acquirer's, folding two content sets together, or rebranding both onto a new name all involve URL-level change at scale, and the risk concentrates in whether every retired URL has a mapped destination.
Google classifies 301 and 308 as permanent redirects and 302, 303 and 307 as temporary, and documents that its crawlers follow up to ten redirect hops by default. It also documents keeping redirects for as long as possible, generally at least a year — which in a deal context means the redirects outlive the integration project that created them and need a named owner afterwards. The Change of Address tool in Search Console requires ownership of both domain properties in the same account with redirects already in place, and does not cover subdomains, including www variants.
The diligence question is narrower than the migration itself, and it is answerable during the deal: does the target have a complete URL inventory, working analytics, and Search Console access the buyer will actually hold after closing? Without those three, the migration is being planned without a baseline, and any decline afterwards cannot be attributed to the migration, to the market, or to anything else. That is also how a recoverable technical problem becomes an argument about the purchase price.
If It Becomes a Post-Closing Dispute
Disputes in this area are usually about representations: that the target owned its website and its content, that the domains were properly registered and transferable, that third-party licences were disclosed. The questions counsel then needs answered are factual and technical. Who was the registrant of record on the closing date. What the site contained on that date. Which third-party components, images and fonts were present in it. Who administered each platform account and with what permissions. What the traffic and conversion baseline was before consolidation began.
None of that reconstructs well after the fact. Registration data is redacted in the present and patchy in the archive, platform data retention runs on the platform's schedule rather than the deal's, and a site that has since been migrated no longer displays what it displayed. A dated capture of the target's site, an export of the registration records, a bill of materials, and analytics and search console exports taken at closing cost close to nothing and become the entire evidentiary record if a dispute follows. Reconstructing and authenticating that record afterwards is what an expert witness is engaged to do, and it is markedly harder and less complete than preserving it on the day.
Frequently Asked Questions
What should due diligence check about a company's website?
Start with ownership of record for each element rather than with the seller's asset list. For domains, the registrant of record and the accredited registrar for every name, including defensive and country-code variants. For the site, the development and agency contracts and whether they contain a present assignment of copyright signed by the supplier.
For content, the licence records behind images, fonts and video. For infrastructure, who holds the hosting, DNS, certificate and mail accounts. For marketing, who is the account owner on advertising, analytics, tag manager and Search Console. Documents, in every case, rather than representations.
Do stock photo licences transfer when a company is acquired?
Frequently not. A stock licence is permission granted to a named entity, and standard royalty-free terms are typically non-exclusive, non-transferable and non-sublicensable. Licences generally do not travel in an asset sale or a merger without the agency's consent.
The consequence is that an acquirer can end up publishing images it holds no licence for, on pages it inherited, and the exposure sits with whoever operates the site. Ask for the licence records — invoice, licence ID, download date, purchasing account and licence type — during diligence, and put the question of consent or re-licensing to counsel where the deal is structured as an asset purchase.
How long does it take to transfer a domain name after an acquisition?
Longer than most closing timetables assume. Under the ICANN Transfer Policy in force, a change of registrant triggers a 60-day inter-registrar transfer lock, although a registrar may allow the registrant to opt out of that lock in advance of the change — the opt-out has to be elected before the change, not afterwards.
A registrar may also deny a transfer within 60 days of an earlier transfer or of the initial registration. Country-code domains follow their own registry rules entirely, and some impose local-presence requirements that become a problem once the selling entity is dissolved.
Will we lose our Google Ads history if the account changes hands?
Possibly, and it is worth establishing before closing rather than after. Google documents that a client account has only one owner and that client-account users do not have permission to transfer ownership, so an account created inside a seller's or agency's manager account may not move on the buyer's terms.
What is at risk is less the access than the accumulated data: conversion history and the training data behind automated bidding, remarketing and customer-match audiences, search-terms and change history, and linked assets such as Merchant Center. Rebuilding those takes time that integration plans rarely budget for.