California companies: data sales in bankruptcy and ABCs under the CCPA

California has more distressed technology, consumer and services companies than anywhere else, and the strictest general privacy law in the country. It is also the home of the assignment for the benefit of creditors as a mainstream wind-down tool. If a California company is restructuring or winding down, a data offer process can turn years of records into cash, but only if it's built around California's privacy rules from the start.

General information, not legal advice. California privacy law is detailed and changes often. Counsel should advise on your case.

Routes: Chapter 11, Chapter 7, or an ABC

California has four federal districts: the Central District (Los Angeles, Santa Ana, Riverside, Woodland Hills, Santa Barbara), the Northern District (San Francisco, Oakland, San Jose, Santa Rosa), the Southern District (San Diego) and the Eastern District (Sacramento, Fresno, Modesto). A data license in any of them needs notice and a hearing under § 363(b).

Many California companies, especially venture-backed startups, choose an ABC instead. A California ABC is a common-law process: the company assigns its assets to a professional assignee, who liquidates them without court supervision and distributes proceeds to creditors. ABCs are fast and relatively private. Buyers get no bankruptcy sale order, but many buyers of de-identified data accept that if the assignee's authority, the lender's consent and the privacy analysis are documented. See data sales in ABCs.

The CCPA and CPRA

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to for-profit businesses that do business in California and meet a threshold, such as annual gross revenue above an inflation-adjusted figure (initially $25 million), buying, selling or sharing personal information of 100,000 or more consumers or households, or deriving half of revenue from selling or sharing personal information. Many distressed mid-size companies meet the revenue test.

Key points for a data sale:

• "Consumer" includes employees and business contacts. Since January 2023, the CCPA's exemptions for employee and B2B data have expired, so personal information about employees, job applicants and business contacts who are California residents is covered. Operational records are full of exactly that.
• Selling personal information triggers notice and opt-out rights, and restrictions on sensitive personal information.
• Deidentified information is outside the definition of personal information if the business takes reasonable measures to ensure it can't be associated with a consumer, publicly commits to maintain it in deidentified form and not re-identify it, and contractually obligates recipients to comply. That's the structure of a well-built data license.
• Mergers and transfers: the CCPA treats a transfer of personal information as part of a merger, acquisition, bankruptcy or similar transaction differently from an ordinary sale, if the acquirer uses it consistently with prior commitments. Don't rely on this for a data license; de-identify instead.

The California Privacy Protection Agency enforces the law alongside the Attorney General. Regulators have shown interest in how personal information is handled when companies fail, so documentation matters.

Data broker registration

California requires data brokers, businesses that knowingly collect and sell personal information of consumers with whom they don't have a direct relationship, to register, and the Delete Act created a centralized deletion mechanism. A company licensing properly deidentified data of its own operations generally isn't acting as a data broker, but buyers and assignees sometimes ask. A clear deidentification record answers the question.

Bankruptcy privacy rules on top

In a bankruptcy case, § 363(b)(1) applies too: if the privacy policy prohibits transferring personally identifiable information and the sale would transfer it, the court needs consistency with the policy or an ombudsman process. California consumer companies have seen ombudsman appointments in retail and subscription cases. See privacy policies and bankruptcy data sales.

A California deidentification standard

Because the CCPA covers employees and business contacts, the deidentification standard for a California data set should be at least:

1. Remove names, emails, phones, addresses, account numbers and government IDs of all people, including employees and contractors.
2. Replace company names (customers, vendors, partners) with consistent placeholders.
3. Generalize quasi-identifiers such as exact dates, ZIP codes and job titles where combinations could identify someone.
4. Exclude HR, payroll, benefits and recruiting systems entirely.
5. Exclude sensitive personal information categories: health, precise geolocation, financial account data, and others the law lists.
6. Publish or document the commitment not to re-identify, and bind buyers contractually.

Contracts

California startups often have enterprise customer agreements with strict confidentiality and data-processing terms. Customer-submitted content is usually out of scope. See executory contracts and customer confidentiality.

A California timeline

• ABC: go/no-go in days, offers in two to three weeks, close in four to six weeks after assignment.
• Chapter 11 or 7: add the § 363 motion, notice period and hearing, typically six to ten weeks overall.

Worked example: a Bay Area SaaS startup in an ABC

A venture-backed, 85-person software startup in San Francisco runs out of cash after a failed fundraise. The board chooses an ABC. The assignee sells the code and customer contracts to a strategic buyer within three weeks. Left with the estate: six years of support tickets, engineering issues, product chat and the internal wiki.

Because the CCPA covers employees and business contacts, the deidentification goes further than a typical non-California deal: every employee, contractor and customer contact is replaced; Slack profile data and HR channels are excluded; job titles are generalized; and the assignee's file includes a written commitment not to re-identify. Customer-submitted content in the product is excluded under the customer agreements. Two buyers make written offers for a non-exclusive license; the venture lender consents to a split. The license closes about five weeks after the assignment, with no court involvement, and the assignee reports it to creditors in its distribution report.

Before you choose a route

If the company has substantial consumer data, a contentious lender, or buyers who insist on a court order, Chapter 11 or Chapter 7 may be worth the extra time. If speed and cost matter most and the data is mostly business operations, an ABC is often the better fit. Ask counsel to compare both early.

Frequently asked questions

Does the CCPA prevent a California company from selling its data in bankruptcy?

It regulates personal information. A license of properly deidentified data, with public and contractual commitments not to re-identify, generally falls outside it. Counsel should confirm for your facts.

Are employee records covered by California privacy law?

Yes. Since 2023, employee and business-contact personal information of California residents is covered by the CCPA, so it must be removed or excluded.

Is a California ABC supervised by a court?

Generally no. California ABCs are a common-law process handled by the assignee without court supervision, which makes them fast but provides no sale order.

Do buyers accept data from a California ABC?

Many do for deidentified licenses, with documentation of authority, lender consent and the privacy analysis.

Does licensing data make the company a data broker?

Not usually, if the data is properly deidentified and concerns the company's own operations. Keep a clear record of the method.

What about the company's customers outside California?

Their states' laws apply too, but California's standard is usually the strictest, so meeting it covers most others.

This guide is general information, not legal, tax or financial advice, and reading it does not create an attorney-client relationship. Bankruptcy outcomes depend on the facts, the court and the parties; nothing here promises price, timing or court approval. Talk to your bankruptcy counsel about your case.