Maybe this is a radical position, but if users have given you data based on the agreement that you'll follow a particular privacy policy, then material changes to that policy should require the user's consent.

If a user doesn't consent, then sure, you can go ahead and do whatever policy changes or mergers or acquisitions you want, but you don't get to include that user's data in the deal.