Most buyers spend three weeks verifying revenue and forty minutes glancing at the asset purchase agreement. Then a trademark cease-and-desist arrives in month four and the $340,000 brand they bought becomes a rebrand project. Legal due diligence is the cheapest insurance in acquisitions — and the most skipped.
Deal Alert AI is reader-supported. We earn commissions from affiliate links at no cost to you.
This post is based on a video from our Deal Alert AI YouTube channel. Watch the original or read the full breakdown below.
By Sophal Lanh, Founder of Deal Alert AI
I've watched buyers run a 40-tab traffic analysis on a content site, reconcile Stripe against QuickBooks down to the dollar, interview three former contractors — and then sign an asset purchase agreement they read once on a phone. Financial due diligence feels productive because the numbers move. Legal due diligence feels like paperwork until the day it isn't.
Here's the pattern I see repeatedly in deals that go bad post-close: the revenue was real. The traffic was real. The seller wasn't lying about anything financial. But the ownership of what was sold was cloudy, or a liability rode along with the asset, or a compliance gap existed that the buyer inherited the moment funds cleared. None of those show up in a P&L.
This is a practical walkthrough of the eight legal areas I check on every online business acquisition, what each one costs to verify, and what happens when you skip it. Nothing here is legal advice — I'm not an attorney and you should hire one for any deal over roughly $100,000. But knowing what to ask for before you pay an attorney $400 an hour to figure it out saves real money.
Financial due diligence answers one question: are the numbers real? Legal due diligence answers four different questions, and they're structurally harder because the answers aren't in a spreadsheet.
First: is the seller legally capable of transferring what they're selling? This sounds absurd until you meet a SaaS founder who can't produce a contractor IP assignment for 30% of his codebase, or an ecommerce owner whose brand trademark is registered personally to a former partner. You cannot buy what the seller doesn't own. The asset purchase agreement can say whatever it wants — if the underlying ownership is defective, you're buying a lawsuit.
Second: what liabilities travel with the business? In a well-structured asset purchase, most liabilities stay with the seller. In a stock or entity purchase, they come with you. The distinction matters enormously and most first-time buyers don't push hard enough on it. Third: is the business compliant with the regulations that apply to it? FTC disclosure rules, GDPR, CCPA, sales tax nexus, platform terms of service. Fourth: what contractual obligations survive the sale? Long-term vendor contracts, affiliate agreements with exclusivity clauses, unexpired ad network commitments.
Key insight: Financial due diligence tells you what the business earned. Legal due diligence tells you whether you can keep earning it. A site making $8,000/month with a trademark conflict on its brand name is not a $240,000 asset — it's a $240,000 asset minus the cost of a rebrand, minus the traffic you lose during the rebrand, minus legal fees. That's often 40–60% of the purchase price.
We scan Empire Flippers, Flippa, Acquire.com and Quiet Light daily — scoring every listing. Start free.
This is the single highest-value check in legal due diligence and the one buyers most consistently botch. The question isn't "does the business have content and code?" It's "does the selling entity hold clean, transferable title to that content and code?"
For content sites, the specific risk is work-for-hire. In the United States, work created by an independent contractor does not automatically belong to the person who paid for it unless there's a written agreement assigning copyright. If a seller hired 15 freelance writers over four years via Upwork with no IP assignment language, the copyright on that content technically sits with the writers. In practice, nobody sues over a $60 blog post. But if you're buying a 900-article site for $500,000 and 300 of those articles were written by contractors with no assignment agreement, you have a real defect. Ask for the standard contractor agreement the seller used. If there isn't one, ask what platform they hired through — Upwork's standard terms include an IP assignment, which helps, but Fiverr's vary by service tier and direct-hire arrangements often have nothing.
For SaaS, the stakes go up. Codebases built by a technical co-founder who left in year two, or by an offshore agency with a poorly drafted MSA, create ownership gaps that can be genuinely deal-killing. I want to see: founder IP assignment agreements to the entity, contractor/agency agreements with explicit assignment clauses, and a clean accounting of any open-source dependencies with copyleft licenses (GPL in a commercial SaaS product is a conversation you want to have before closing, not after). For branded ecommerce, verify that product designs, packaging artwork, and any registered trademarks are held by the selling entity — not the founder personally, not a defunct LLC, not a designer who was never paid the final invoice.
The verification itself is cheap. Ask the seller for a written IP schedule listing every material IP asset and how they acquired ownership of it. A legitimate seller can produce this in a day. A seller who stalls, deflects, or says "it's all mine, obviously" is telling you something. When you're evaluating listings on Empire Flippers, the broker will typically have basic ownership documentation on file, but the depth varies significantly by listing size — assume you need to ask.
Search the USPTO's TESS database before you make an offer. It's free, it takes ten minutes, and it has saved buyers I know from six-figure mistakes. You're looking for registered or pending marks that are confusingly similar to the target business's brand name, product names, or tagline, in the same or adjacent classes of goods and services.
Two failure modes here. The obvious one: the business you're buying is infringing someone else's registered mark and just hasn't been caught yet. Small online brands operate under the radar for years until they cross a revenue threshold that makes them worth suing. The moment you acquire it and start scaling, you raise your profile. A cease-and-desist forces a rebrand — new domain, new logo, new packaging, new Amazon listings, and a brand equity reset that can wipe out a year of growth.
The less obvious failure mode: the business has no trademark protection at all, and you're paying a brand premium for something anyone can copy. If the seller is pricing at a 4.5x multiple because "the brand has real recognition," but the brand isn't registered and the name is descriptive enough to be unregistrable, you're paying for a moat that doesn't exist. Registration costs a few hundred dollars per class plus attorney fees — the fact that a seller never bothered tells you something about how they viewed their own brand equity.
Also check international registrations if the business sells outside the US. Amazon Brand Registry requires a registered trademark, and if the seller's registry enrollment is tied to a mark held personally rather than by the entity, the transfer gets messy. That's a specific, common, and extremely annoying problem in ecommerce acquisitions.
Pull the WHOIS record for every domain in the deal. You want to confirm the registrant matches the seller or seller's entity, the domain isn't locked in a registrar dispute, and the expiration date isn't three weeks out. Check for domains the seller didn't list — misspellings, defensive registrations, country-code variants. If those aren't included in the sale, a departing seller technically retains assets that can redirect your traffic.
Beyond domains, build a complete asset schedule and verify transferability for each item. Google Analytics and Search Console properties transfer cleanly. Google AdSense accounts do not transfer — the buyer must use their own account, which means a revenue gap during re-approval and possible RPM changes. Amazon Seller Central accounts have a specific transfer process that can take weeks and occasionally fails. Affiliate accounts with networks like Amazon Associates or Impact are non-transferable and require the buyer to re-apply, sometimes at lower commission tiers than the seller enjoyed.
Social accounts, email lists, payment processors, ad accounts, trademark registrations, supplier relationships, and third-party software licenses all have distinct transfer paths. I want a line-by-line schedule with a transfer method noted for each. Deals fall apart in the migration window far more often than in the negotiation, and almost always because someone assumed an account was transferable when it wasn't.
Warning: Never release full funds before asset transfer is complete and verified. Use escrow with a defined inspection period — typically 14 to 30 days depending on deal complexity. If a seller pushes for direct wire "to avoid escrow fees," walk. Escrow on a $200,000 deal costs a fraction of a percent. Losing the deal because a seller couldn't transfer an Amazon account costs 100%.
Ask the seller to warrant in writing that there is no pending or threatened litigation, no regulatory investigation, no unresolved consumer complaint pattern, and no material dispute with a supplier, contractor, or former partner. Get it in the purchase agreement with a survival period — 12 to 24 months is standard — so the representation has teeth after closing.
Then verify independently. Run the entity name and the seller's personal name through PACER for federal cases and through your state's court records system for civil filings. This costs almost nothing and takes under an hour. For consumer-facing businesses, check the BBB complaint history and search the brand name plus "lawsuit," "scam," and "refund" — you're looking for patterns, not one angry customer.
Threatened litigation matters as much as filed litigation. A cease-and-desist letter received six months ago and never resolved is a live liability even though nothing appears in court records. This is exactly why the seller warranty matters — it forces disclosure of things you can't independently discover. If a seller resists a clean no-litigation rep, that resistance is the disclosure.
Three compliance areas cover most online businesses, and gaps in any of them transfer to you the moment you take ownership.
FTC affiliate disclosure. Any content site making product recommendations for compensation must disclose the relationship clearly and conspicuously, close to the recommendation, not buried in a footer. The FTC's 2023 endorsement guides tightened this considerably. Enforcement against small publishers is rare but not zero, and the bigger practical risk is that Amazon Associates or another network terminates the account for non-compliance — which for an affiliate site is an extinction-level event. Spot-check ten money pages. If disclosures are missing or inadequate, factor remediation into your first-90-days plan.
Privacy and data. If the business collects email addresses from EU visitors, GDPR applies regardless of where the business is based. That means a lawful basis for processing, a compliant privacy policy, a functioning cookie consent mechanism, and the ability to honor deletion requests. CCPA/CPRA creates parallel obligations for California residents above certain thresholds. Most small online businesses are partially compliant at best. That's not automatically a deal-breaker, but you should know what you're inheriting and what it costs to fix — usually a few thousand dollars of policy work and a consent management platform.
Worker classification and sales tax. If the business treats full-time, directed workers as independent contractors, there's payroll tax exposure. In an asset purchase this typically stays with the seller, but state successor-liability rules vary and I've seen buyers surprised. Similarly, ecommerce businesses that crossed economic nexus thresholds in states where they never registered or remitted sales tax carry a real, quantifiable liability. Ask for the nexus analysis. If there isn't one, that's your answer.
Key insight: Compliance gaps are usually negotiating leverage, not deal-breakers. A GDPR-noncompliant site with $12,000/month in profit is still a good business — it just needs $4,000 of remediation and should be priced accordingly. The buyers who lose money are the ones who don't discover the gap at all. Find it, price it, close it. That's the entire game.
Most online businesses depend entirely on platforms they don't control. Google organic search, Google AdSense, Amazon Seller Central, Meta ad accounts, affiliate networks, app stores, payment processors. Every one of those relationships is governed by terms of service that the platform can enforce unilaterally, with no appeal process worth the name.
So the question in due diligence is: has this business done anything that would get it terminated if the platform looked closely? For content sites, that means checking for AI-generated content at scale without editorial oversight, private blog networks or paid link schemes, expired-domain redirects, and thin doorway pages. Run the site's backlink profile through Ahrefs or Semrush. A backlink profile that's 60% guest posts from the same twelve low-quality sites is a link scheme, and Google's policy enforcement on those has gotten dramatically more aggressive.
For Amazon businesses: check for suspension history, policy warnings in Account Health, review manipulation (an unnatural velocity of five-star reviews in a short window is visible in the data), and listing hijack disputes. Ask for Account Health screenshots covering at least 24 months, not just current status. For AdSense sites: invalid traffic warnings and prior policy violations are visible in the account and the seller should share them.
The reason this matters more than almost anything else in legal DD is that platform terminations are usually permanent and rarely negotiable. You can fix a privacy policy in a week. You cannot un-terminate an Amazon account. When I screen deals through Deal Alert AI, platform-dependency risk is one of the first signals I look at, because it's the risk with the worst tail outcome relative to how easy it is to check.
Run this before you sign an LOI, not after. Most of it costs nothing but time, and the items that require an attorney will be far cheaper if you've already assembled the documents.
The failure mode I want you to avoid is spending forty hours on legal due diligence for a business you were never going to buy. Sequence matters. Legal DD is expensive in attention, so front-load the cheap checks and gate the expensive ones behind a signed LOI.
Stage one, before you contact the seller: USPTO search, WHOIS lookup, basic litigation search, FTC disclosure spot-check, and a look at the backlink profile. That's ninety minutes and it eliminates maybe one in five listings outright. Stage two, after initial seller contact but before LOI: request the IP schedule, platform account health data, and privacy documentation. If the seller can't or won't produce these, you've learned everything you need. Stage three, after LOI and inside exclusivity: attorney review of the purchase agreement, entity-level searches, contract review, and any specialist work the first two stages flagged.
Budget realistically. On a $150,000 to $500,000 deal, expect $3,000 to $8,000 in legal fees for a competent M&A attorney who understands digital assets. That's 1–3% of the purchase price for the single highest-ROI spend in the entire process. Buyers who skip it to save $5,000 are the buyers who write me eighteen months later about a dispute that would have been caught in an afternoon.
Deal source matters too. Curated marketplaces like Empire Flippers do a vetting pass that catches the most egregious problems before listing, which raises your baseline. Open marketplaces like Flippa have far more inventory and occasionally better pricing, but the variance in seller quality is much wider — your legal DD needs to be correspondingly more thorough. Neither approach is wrong. Just calibrate your effort to the source.
I built Deal Alert AI because the screening stage was eating the time I wanted to spend on actual diligence. When you're looking at 200 listings a month across multiple marketplaces, the manual version of stage-one screening isn't sustainable — and the deals that deserve deep legal review are maybe three of those 200.
The platform surfaces the patterns that correlate with legal risk before you invest hours: brand names that collide with registered marks, sites with backlink profiles that look like link schemes, ecommerce listings with account-health language that suggests prior suspensions, content businesses with AI-generation signatures at scale, and sellers whose listing history shows the same asset relisted under different framing. None of that is a verdict. It's a prioritization layer — it tells you where to point your attention and, just as usefully, which listings to skip entirely.
What it doesn't do is replace an attorney. No screening tool reads an asset purchase agreement or evaluates whether an indemnification cap is reasonable for your risk tolerance. The goal is narrower and more useful: get you to the small set of deals worth paying an attorney to examine, with the obvious problems already flagged so you're not paying $400 an hour for someone to run a WHOIS lookup.
Legal due diligence isn't glamorous and it doesn't feel like progress the way a growing revenue model does. But in a market where most buyers do it badly, doing it well is a durable edge. The deals you don't do are worth as much as the ones you do. Start with the checklist above, gate your effort by stage, and let Deal Alert AI handle the volume so your attention goes where it actually matters.
This article is for informational purposes only and does not constitute legal advice. Consult a qualified attorney before completing any acquisition.
We scan Empire Flippers, Acquire, Flippa, and Quiet Light daily. The best sub-$500K businesses are gone within 48 hours.