Can a bankrupt company sell customer data?

When a company fails, a court collects whatever it owns and sells it to pay creditors. Offices, servers and trademarks are obvious. Data is less obvious, but often worth more: a customer list, purchase histories, a codebase, years of support tickets or sensor readings. Buyers who would never have bought the whole business may bid for exactly that piece.

For a broker, these sales are worth understanding for two reasons. Closed and failing companies are some of the likeliest sellers of data, and the rules a bankruptcy court applies are a clear, public version of the questions any careful buyer asks in a private deal: who was promised what, and does the sale keep that promise?

The rule sits in section 363(b)(1) of the US Bankruptcy Code. A trustee may sell the estate's property outside the ordinary course of business. There is one carve-out for data: if the company told individuals it would not transfer their personally identifiable information to unaffiliated parties, and that policy was in force when the case began, the trustee may not sell that information unless one of two things is true.

1. The sale is consistent with the policy the customers were given.
2. A consumer privacy ombudsman is appointed under section 332, there is notice and a hearing, and the court approves the sale after weighing the facts.

The ombudsman is a disinterested person appointed by the US trustee at least seven days before the hearing. They can tell the court about the company's privacy policy, what consumers stand to lose or gain, the costs and benefits to them, and alternatives that would reduce the harm. They must keep the personal information they see confidential.

RadioShack's 2015 bankruptcy is the case most people cite. Among the assets for auction were names, addresses, email addresses and purchase histories, and the FTC said documents suggested data on tens of millions of consumers might be included. RadioShack had told customers it would not sell their information.

On May 18, 2015, the FTC published a letter from Jessica Rich, then director of its Bureau of Consumer Protection, to the court's privacy ombudsman. Pointing back to the Toysmart bankruptcy of 2000, it asked for four conditions: that the data not be sold on its own but with other assets, that it go only to a buyer in substantially the same line of business, that the buyer be bound by the privacy policies in place when the data was collected, and that the buyer get affirmative consent before using the data in a materially different way.

The 2025 sale of 23andMe raised the stakes, because the data was genetic. A bankruptcy court approved a sale to TTAM Research Institute, a nonprofit formed by co-founder Anne Wojcicki, for $305 million, after Regeneron had earlier agreed to buy the company for $256 million. The buyer committed to honour existing privacy policies and to let customers delete their accounts and data.

State attorneys general were involved throughout. Minnesota's attorney general later told consumers that the buyer must undergo annual independent external audits of its data safeguards and that people keep the right to delete their data permanently. The case showed that a court can approve a large data sale and still leave regulators pressing for conditions after it closes.

Section 363(b)(1) is about personally identifiable information covered by a no-transfer promise. Plenty of what a failed company holds is not that. Here is how the categories usually sort out.

1. 1

   Read the privacy policy that was live when the data was collected

   Not just today's version. The promise in force at the time is the one that follows the data, in court and out of it.

2. 2

   Separate personal data from everything else

   Codebases, de-identified records and business documents often move far more easily than customer files. Package them apart so one hard question doesn't stall the whole sale.

3. 3

   Check for data the company only licensed

   Third-party datasets, open-source code and partner feeds come with their own terms. A failed company can't sell rights it never had.

4. 4

   Expect conditions and price them in

   Buyer restrictions, consent requirements and deletion rights reduce what a buyer can do with the data. Factor them into the value range before anyone bids.

5. 5

   Get counsel who knows bankruptcy sales

   Timelines in a case are set by the court, and objections can come from regulators you never spoke to. A specialist lawyer saves a deal more often than they slow it down.

This covers US federal bankruptcy law and two well-documented cases. It does not cover sales outside bankruptcy, assignments for the benefit of creditors, or other countries, where the GDPR and similar laws apply their own rules on transferring personal data. State privacy laws keep changing, and a policy's exact wording matters more than any general pattern described here.