Your Privacy Policy and a Bankruptcy Data Sale

The privacy policy on your website was probably written years ago and rarely read since. In bankruptcy, it suddenly matters a lot. Congress made it a limit on what the estate can sell. Here's how to read it with a data sale in mind.

General information, not legal advice. Privacy law is fast-moving and state-specific.

Why the policy matters in bankruptcy

Section 363(b)(1) of the Bankruptcy Code provides that if a debtor disclosed a privacy policy to individuals, in connection with offering a product or service, that prohibits transferring personally identifiable information to unaffiliated persons, and the policy is in effect when the case starts, the estate can sell that information only if:

the sale is consistent with the policy, or
the court appoints a consumer privacy ombudsman (§ 332) and, after notice and a hearing, approves the sale after giving due consideration to the circumstances and finding no showing that it would violate applicable nonbankruptcy law.

Step 1: Find the right version

The test looks at the policy in effect on the petition date. But data collected under earlier policies may have been collected on different promises, and regulators have historically cared about what consumers were told when they handed over their information. Pull every version you can, with dates.

Step 2: Read for transfer language

Look for phrases like:

"We will never sell or share your personal information."
"We do not share your information with third parties except..."
"In the event of a merger, acquisition or sale of assets, your information may be transferred."

A "business transfer" clause can help, but whether it covers a license of a dataset to an AI developer, as opposed to a sale of the business, is a legal question for counsel.

Step 3: Map what's actually covered

Section 101(41A) defines "personally identifiable information" around information an individual provides to obtain a consumer product or service for personal, family or household purposes, such as name, address, email, phone, SSN, card numbers, and related data linked to them.

That leaves a lot of operational data outside the bankruptcy-specific rule:

business contacts at your B2B customers,
your own employees' information,
internal operational discussions.

But "outside § 363(b)(1)" doesn't mean "unrestricted." State privacy laws, employment laws, contracts and FTC rules may still apply.

Step 4: Choose a path

Path	When it works	Trade-off
Exclude consumer PII	Most operational datasets	Slightly less data
De-identify consumer PII	When it's mixed into useful records	Must be done well and described clearly
Consistent with policy	Policy permits the transfer	Counsel must be confident
Ombudsman process	Valuable consumer data that can't be excluded	Time, cost, possible conditions

For datasets aimed at AI developers, excluding or de-identifying consumer PII is usually the cleanest path, because buyers want workflows, not identities.

The ombudsman, briefly

If one is needed, the U.S. Trustee appoints a disinterested person at least 7 days before the hearing. The ombudsman reports on the policy, potential privacy losses or gains, costs and benefits to consumers, and alternatives. Common recommendations include limiting the buyer to similar uses, honoring prior opt-outs, and notifying consumers.

Other law that comes along

FTC Act. Breaking a privacy promise can be a deceptive practice. The FTC has historically taken an interest in bankruptcy sales of customer data.
State comprehensive privacy laws. Several define "sale" broadly and give opt-out rights, and some treat de-identified data specially if certain safeguards are met.
Sector rules. HIPAA (health), GLBA (financial), COPPA (children) and others.

What to put in the motion

Which policy versions apply and what they say
What categories of data are included and excluded
How consumer PII is handled (excluded, de-identified, or subject to the ombudsman)
The buyer's contractual restrictions, including no re-identification
Why the sale doesn't violate applicable nonbankruptcy law

Practical advice

Don't wait for the U.S. Trustee to ask. A privacy section that's thorough and honest about residual risk, without overclaiming that de-identification is perfect, is what lets a court approve a data sale without a fight.

Find out what your data could add to the estate

Tell us the case basics (court, chapter, deadlines, DIP status) and the systems you run. We'll come back with what's saleable, the approvals it needs, and an illustrative range. No upfront cost, and nothing is shared without your approval and, where required, the court's.

Get a confidential valuation Runway calculator

This guide is general information, not legal, tax or financial advice, and reading it does not create an attorney-client relationship. Bankruptcy outcomes depend on the facts, the court and the parties; nothing here promises price, timing or court approval. Talk to your bankruptcy counsel about your case.