I think it would be best to pass the user id instead of the whole User object into the Buy method. I assume this user id is stored in the database (or somewere else).

Now your buy method is independent of your user object, and you will send less data over the Internet