Selling customer data in a US bankruptcy

Customer data is often one of the last valuable assets of a bankrupt company. US bankruptcy law lets the estate sell it, but Congress added a specific privacy check to the Bankruptcy Code in 2005, and the Federal Trade Commission has intervened in high-profile sales for more than 25 years.

This guide explains the rules in 11 U.S.C. 363 and 11 U.S.C. 332, the FTC's position and how the 2025 23andMe sale worked. It describes what the law and the regulator say, not how they apply to a particular case, so take advice from bankruptcy counsel. For the wider question of selling data from a closing company, see selling data from a closed or closing company.

Can a bankrupt company sell customer data?

A bankrupt company can sell customer data, because data the debtor owns becomes property of the estate. The trustee, or the debtor in possession in Chapter 11, sells it under section 363 after notice and a hearing.

Section 363(b)(1) says the trustee "may use, sell, or lease, other than in the ordinary course of business" property of the estate. Section 541 defines that property to include all legal or equitable interests of the debtor as of the start of the case, and section 1107 gives a Chapter 11 debtor in possession the trustee's powers. Section 363(f) can let the buyer take the asset free and clear of other interests, and section 363(m) protects a good-faith buyer if the approval is later reversed on appeal without a stay.

What does section 363(b)(1) say about personally identifiable information?

Section 363(b)(1) says that if the debtor gave customers a privacy policy that prohibited transferring personally identifiable information to unaffiliated persons, and that policy was in effect when the case began, the trustee "may not sell or lease personally identifiable information to any person unless" one of two conditions is met.

The definition is narrower than most privacy laws. Section 101(41A) covers information an individual gave the debtor "in connection with obtaining a product or a service" for personal, family or household purposes: name, home address, email, home phone, Social Security number and credit card number, plus other information linked to those items that would identify or contact the person.

Employee records and business contacts usually fall outside that definition, but they do not fall outside the law. State privacy statutes, genetic privacy laws and contracts still apply, and section 363(b)(1)(B) requires the court to consider applicable nonbankruptcy law. Our guide to UK GDPR, EU GDPR and CCPA sets out the main state rules.

What does a consumer privacy ombudsman do?

A consumer privacy ombudsman is an independent person appointed to tell the bankruptcy court how a proposed data sale affects consumers. Section 332(a) requires the court to order the United States trustee to appoint one "not later than 7 days before the commencement of the hearing" whenever a sale needs approval under section 363(b)(1)(B).

Under section 332(b), the ombudsman may appear at the hearing and gives the court information on four points:

1. The debtor's privacy policy
2. The potential losses or gains of privacy to consumers if the sale is approved
3. The potential costs or benefits to consumers if the sale is approved
4. The potential alternatives that would mitigate potential privacy losses or potential costs to consumers

The procedure is set by Rule 6004(g) of the Federal Rules of Bankruptcy Procedure. A motion to sell personally identifiable information under section 363(b)(1)(B) must include a request for an order directing the United States trustee to appoint an ombudsman, and the trustee must give notice of the appointment at least 7 days before the hearing. Section 332(c) bars the ombudsman from disclosing any personally identifiable information obtained in the role.

The FTC has said consistently that privacy promises survive bankruptcy and that a buyer of customer data should be bound by them. Three cases set out the position.

The Toysmart settlement was approved by a 3 to 2 vote of the Commission. In RadioShack, Jessica Rich, Director of the FTC's Bureau of Consumer Protection, wrote to the consumer privacy ombudsman and asked that her letter be included in the ombudsman's report to the court. In 23andMe, Chairman Andrew N. Ferguson wrote to the Office of the U.S. Trustee that "these types of promises to consumers must be kept".

“Consumers should be able to trust that companies will keep their promises.”

How did the 23andMe customer data sale work?

The 23andMe customer data sale went through section 363 with a consumer privacy ombudsman and conditions set by the court. It is the most detailed recent example of a bankruptcy court weighing a sale of sensitive consumer data.

• Court: the U.S. Bankruptcy Court for the Eastern District of Missouri, Judge Brian Walsh, according to Washington University in St. Louis
• Buyer: TTAM Research Institute, a nonprofit led by co-founder Anne Wojcicki, for $305 million, after Regeneron's earlier $256 million bid, according to White and Williams
• Ombudsman: Neil Richards, Koch Distinguished Professor in Law at Washington University in St. Louis, who produced a 211-page report
• Approval: the sale order was entered on June 27, 2025, and 23andMe announced the approval on June 30, 2025
• Closing: TTAM said it completed the acquisition of the Personal Genome Service and Research Services business lines on July 14, 2025

The ombudsman recommended that any buyer keep 23andMe's privacy policies and research consent choices, and said the best outcome for privacy would be separate, affirmative customer consent. The court did not require opt-in consent. According to White and Williams, it found the sale complied with the privacy policies under section 363(b)(1)(A) and, in the alternative, that there was no showing it would violate nonbankruptcy law under section 363(b)(1)(B).

The sale order still imposed conditions. TTAM had to give notice, let customers "easily and promptly delete" their information in perpetuity and submit to independent external audits, with summaries available to state regulators on request. 23andMe's June 30, 2025 release said TTAM was "committed to adhering to 23andMe's existing privacy policies in perpetuity".

Can a bankruptcy estate license customer data for AI training?

A bankruptcy estate can license data for AI training, but customer personal data is the hardest part to include. Most retail and app privacy policies did not tell customers their information would train AI models, so a sale for that purpose is unlikely to be consistent with the policy under subparagraph (A).

That leaves the ombudsman route, the FTC's expectation that buyers keep the original promises and any state law the court must consider. The practical answer in recent cases has been to exclude customer records or de-identify them. The Spirit Airlines records sale, listed in our AI data deals tracker, excluded booking, transaction and refund records and involved de-identified business data, with a consumer privacy ombudsman reviewing the bids.

What should a trustee or debtor prepare before selling data?

A trustee or debtor should prepare the privacy record before marketing data to buyers. The court, the ombudsman and any buyer will ask the same questions.

1. 1

   Collect every privacy policy

   Gather each version in force since the data was collected, with dates, because customers who signed up under older terms may have different promises.

2. 2

   Classify the records

   Separate consumer personally identifiable information under section 101(41A) from employee, business contact and operational data.

3. 3

   Check state law

   Identify state privacy, biometric and genetic privacy laws that apply to the records and the customers' locations.

4. 4

   Decide the route

   Exclude or de-identify consumer data, or plan for an ombudsman and a hearing under section 363(b)(1)(B).

5. 5

   Build the manifest

   Record what is included and excluded using our data manifest guide, so the court and buyers see the same description.

6. 6

   Set buyer conditions

   Write the privacy commitments into the sale or license terms, including use limits, deletion rights and onward transfer limits.

Every buyer we introduce is verified for company identity, intended use, security and retention commitments and onward transfer limits before seeing a sample. If you represent a debtor or a trustee, request a free data valuation to find out which records buyers want and which are better left out. Our US seller guide covers the rules outside bankruptcy.