Selling customer data in bankruptcy: the rules
The short answer
Selling customer data in bankruptcy is allowed under 11 U.S.C. 363(b)(1) if the sale fits the debtor's privacy policy or a court-appointed consumer privacy ombudsman reviews it. The ombudsman advises the court but has no veto. Courts add conditions, such as Toysmart limiting sales to the whole business.
The statute covers consumer information. Anything else a bankrupt company holds falls outside its text.
What does Bankruptcy Code section 363(b)(1) require?
Section 363(b)(1) applies when the debtor's privacy policy bars transferring personally identifiable information to people who are not affiliates.
That policy must have been in force when the case began. The trustee may then sell only if the sale is consistent with that policy.
Otherwise the court must take three steps:
- appoint an ombudsman under section 332
- hold a notice and a hearing
- find that "no showing was made" that the sale would violate applicable nonbankruptcy law
What counts as personally identifiable information there?
Section 101(41A) covers information an individual gave the debtor "in connection with obtaining a product or a service from the debtor primarily for personal, family, or household purposes."
The examples are a name, a home address, an email address, a phone number, a Social Security number and a credit card number.
Employee records and business-to-business contacts don't clearly fit that definition. That's my reading, not a court ruling. The ombudsman page explains the role.
What conditions have courts and regulators attached?
-
Toysmart (FTC, 21 Jul 2000). The settlement allowed a sale of the customer list only to a qualified buyer in a related market.
That buyer had to agree to follow the privacy statement. The list could not be sold alone. The company had to delete it if no buyer appeared within a year.
-
23andMe (Missouri Attorney General). A $305M sale to TTAM Research Institute was approved on 27 Jun 2025. After that, the release listed a deletion right for consumers and limits on resale. It also banned sharing data with foreign adversaries.
-
Spirit Airlines (2026). The ombudsman's report of 5 Oct 2026 recommends approval from a privacy view. The union that objected says it does not contend that section 363(b)(1) is triggered.
The Spirit objection page has the details. The sale overview tracks the hearing.
What changes outside bankruptcy?
A company that closes without a bankruptcy case has no ombudsman. That includes an assignment for the benefit of creditors, the state-law way to wind down an insolvent company. See shutting down and licensing Slack. Customer data also raises consent questions in any sale. The consent page covers them.
Talk to a bankruptcy lawyer and a privacy lawyer in your state before you sign anything tied to an insolvent company. Our risk map and rights check list the facts counsel will ask for.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
