(Where the new buyer would breach the contract if passing data on.)
Couldn't you simply codify in the ToS that PII or even most/all historical metadata would be scrubbed upon the sale of the company? IANAL, but I would assume that a company could commit themselves in the user agreement in such a way that it guarantees some protection against this kind of concern.
And things like email addresses are "PII", and maybe some more things that are required to actually run this business. So "scrub all PII" isn't really a very feasible thing to do in the first place.
1) Don't sell the company 2) Sell the company sans data (destroy it first)
And no one is going to buy a company stripped of all customer data.
This is just not realistic. Any company or website that lives long enough will change hands eventually, whether it's "selling" or handing it to your first-born son, or whatever, for any number of reasons, and when that happens you lose control. The best you can do is hand it over to someone you trust (if that's possible), but nothing is fool-proof.