What Happens to Your Data When a Company Goes Bankrupt

The Short Read

When a company holding your data files for bankruptcy, your profile, search history, purchase log, location history, and messages are treated as assets the trustee can sell to pay creditors. Section 363(b)(1) of the Bankruptcy Code blocks the trustee from selling personally identifiable information if doing so would violate the company's own privacy policy, unless the court orders the appointment of a consumer privacy ombudsman under section 332 of the Code and approves the sale.^[1]^[2]

Outside bankruptcy, California treats a transfer of personal information in a merger, acquisition, or bankruptcy as a "sale" unless the new owner uses or shares it consistently with Sections 1798.110 and 1798.115; a change that is materially inconsistent with the promises made at collection triggers a notice obligation under the CCPA.^[3]

The practical answer: opt out, request deletion, and minimize what you upload before the announcement that a company is "exploring strategic alternatives" or has filed.

The default: your data is collateral

When a US company files for bankruptcy, almost everything it owns becomes property of the "estate," a legal pool that the trustee administers for the benefit of creditors. The list of estate property is broad. Intangibles such as customer lists, in-app behavioral data, location histories, and search queries are routinely treated as general intangibles the trustee may sell to satisfy creditor claims.

Federal law recognizes that selling personal data is different from selling office furniture. Section 363(b)(1) of Title 11 of the US Code lets a trustee "use, sell, or lease" estate property "other than in the ordinary course of business" only after notice and a hearing, and the section then adds a specific carve-out for personal data. The statute reads:

except that if the debtor in connection with offering a product or a service discloses to an individual a policy prohibiting the transfer of personally identifiable information about individuals to persons that are not affiliated with the debtor and if such policy is in effect on the date of the commencement of the case, then the trustee may not sell or lease personally identifiable information to any person unless (A) such sale or such lease is consistent with such policy; or (B) after appointment of a consumer privacy ombudsman in accordance with section 332, and after notice and a hearing, the court approves such sale or such lease.^[1]

The statute has two practical consequences.

If the company's privacy policy at the time of the bankruptcy filing promised that personal information would not be transferred to non-affiliated parties, the trustee cannot sell that data unless the sale is consistent with the existing policy.
If the sale would be inconsistent, the trustee has to ask the court to approve it, and the court has to order the appointment of a consumer privacy ombudsman before that hearing.

The ombudsman is a real role. If a hearing is required under section 363(b)(1)(B), Section 332(a) puts the court in charge of the appointment: the court orders the United States trustee to appoint, "not later than 7 days before the commencement of the hearing," "1 disinterested person (other than the United States trustee) to serve as the consumer privacy ombudsman in the case." Section 332(b) lists what the ombudsman may present to the court: the debtor's privacy policy, "the potential losses or gains of privacy to consumers if such sale or such lease is approved by the court," "the potential costs or benefits to consumers if such sale or such lease is approved by the court," and "the potential alternatives that would mitigate potential privacy losses or potential costs to consumers."^[2]

That is not a guarantee of any particular outcome. The ombudsman can recommend conditions on the sale (limit the buyer's use, return the data, delete it) and can flag a sale that should not proceed, but the court weighs the ombudsman's report alongside the bankruptcy estate's interest in maximizing recoveries for creditors. A company whose privacy policy was silent on transfers has fewer brakes, because the statutory trigger is a written "policy prohibiting the transfer."

What your data includes in the eyes of the law

The statute uses the phrase "personally identifiable information about individuals." That phrase is broader than the more common state-level definitions. It covers the account records the company holds about you and the behavioral inferences the company has built from your activity. Whether it reaches data the company bought from a data broker depends on the policy the statute points to, which is the policy disclosed when the company offered you the product.

None of this is hypothetical. The FTC's June 7, 2021 press release on the MoviePass settlement named the categories of personal data MoviePass's operators allegedly left exposed: "names, email addresses, birth dates, credit card numbers, and geolocation information." The same release described "a database containing large amounts of subscribers' personal information" left unencrypted.^[4] The release's quoted statement from Daniel Kaufman, then the FTC's Acting Director of the Bureau of Consumer Protection: "MoviePass and its executives went to great lengths to deny consumers access to the service they paid for while also failing to secure their personal information."^[4]

The settlement did not involve bankruptcy, but the categories the FTC listed are exactly the categories an asset buyer would expect to see on a data inventory in a bankruptcy filing: name, email, birth date, payment data, location.

What a non-bankruptcy sale looks like under California law

Most company sales do not involve bankruptcy. They are stock or asset sales, structured as mergers or acquisitions, and the question of what happens to your data is governed by the privacy laws that applied to the seller on the day the deal closed.

California's CCPA definition of "sale" treats a transfer of personal information as part of "a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business" as not a sale, as long as the receiving party "uses or shares" the personal information consistently with Sections 1798.110 (the right to know what was collected and disclosed) and 1798.115 (the right to know what was sold or shared) of the Civil Code.^[3]

The same statutory provision addresses the case where the new owner wants to do something different from what the old company promised. The Civil Code text, as published in the codified compilation, requires the third party to provide "prior notice of the new or changed practice to the consumer" if it "materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection." The notice has to be conspicuous enough that the consumer can easily exercise the choices listed in Section 1798.120, the opt-out provision. The statute adds that the paragraph "does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act."^[3]

What that means in plain terms:

If a California consumer's data is part of an acquisition and the new owner continues the same privacy practices, no notice is required and no opt-out is triggered under the statutory definition.
If the new owner wants to start doing something materially different, the consumer must receive prior notice, and the notice has to support an easy opt-out under Section 1798.120. The new owner cannot retroactively claim a right to use the data in a way the original company did not.
Section 5 of the FTC Act and its state analogues still apply. A sale in which the new owner uses the data in ways the old owner promised it would not, without notice or opportunity to opt out, is a textbook unfair or deceptive practice.

What you can do before the announcement

Bankruptcy filings and acquisition announcements come with weeks of "exploring strategic alternatives" before the public news. The window you have is the time between now and that moment. Use it.

Step 1. Get the data out of the at-risk account

If you can export and delete the data, the data you no longer hold is the data a trustee cannot sell. Most large platforms expose a "Download my data" flow that returns a copy of your account history. Once you have the export, request account deletion through whatever path the service exposes. Account deletion also takes the service out of "data broker" chains if the deleted data is removed from the backup rotation within the service's stated retention window.

Step 2. Read the privacy policy the company is operating under now

The "policy prohibiting the transfer" prong of section 363(b)(1) is evaluated against the privacy policy in effect on the date the bankruptcy case commences. A company whose current policy says "we do not sell your personal information" gives you the strongest statutory hook. A company whose policy says "we may share your information with affiliates and business partners" gives you a much weaker one. The current policy is also what California courts are going to look at when evaluating whether a "materially inconsistent" use happened under Section 1798.140(t)(2)(D).^[3]

Step 3. Send a deletion request under any privacy law that applies

California's CCPA gives residents a statutory right to delete personal information the business collected from them, with a set of exceptions for transactions in progress, security records, and legal obligations. A growing set of other states (Colorado, Connecticut, Virginia, Utah, Texas, and Oregon among them) give residents equivalent statutory rights through their own privacy statutes, each with its own scope and exception list. The site's data broker opt-out guide walks through the per-site process for brokers separately. The site's phone number privacy guide covers a related cleanup for sign-up phone numbers.

Step 4. Move communications off the platform

Direct messages on a social platform, a dating app, or a forum are stored on the platform's servers. A bankruptcy buyer has a claim on those messages. Move the conversations you care about onto a channel the buyer does not own, then delete the originals.

Step 5. Disable the integrations that pipe your data elsewhere

Third-party app authorizations for an at-risk account are a separate vulnerability. If the account goes into bankruptcy, an attacker with a copy of the OAuth tokens can keep reading whatever those integrations had access to as long as you have not revoked them. Rotate any tokens that exist.

What you can do at the announcement

Once a company announces a sale or a bankruptcy filing, the practical actions change. A request made before the announcement may still be in transit when the deal closes.

Submit a fresh deletion request the day the deal is announced. The company is still bound to honor CCPA and equivalent state rights up until the moment control transfers. The site has a guide to paid data deletion services that compares the DIY path to the paid services.
Watch the bankruptcy docket. If a trustee proposes to sell customer data under section 363(b)(1)(B), Federal Rule of Bankruptcy Procedure 6004(g)(1) requires the motion to "include a request for an order directing the United States trustee to appoint a consumer-privacy ombudsman under §332." Rule 6004(g)(2) then requires "the United States trustee must give notice of the appointment at least 7 days before the hearing on any motion under §363(b)(1)(B)."^[5] Dockets are public, and the US Trustee program maintains an appointment list.
File an objection or comment at the hearing. Section 332(b)(3) of the Bankruptcy Code specifically lists among the ombudsman's inputs "the potential costs or benefits to consumers if such sale or such lease is approved by the court" and (b)(4) "the potential alternatives that would mitigate potential privacy losses or potential costs to consumers." A reader who shows up at the hearing, or who files a written objection through the court's electronic docket, can be part of what the ombudsman reports.^[2]
Treat a "your privacy choices will be honored" email as a binding claim, not a promise. California's "materially inconsistent" use rule treats it that way. So does the FTC Act's prohibition on deceptive practices. If the new owner changes the practice and you can point to the prior specific commitment, you have a legal hook.

What the ombudsman can and cannot do for you

Reading section 332 in isolation can overstate what the ombudsman role delivers. The statute gives the ombudsman a hearing seat and a list of inputs to provide the court. It does not give the ombudsman a veto. The court weighs the report alongside the trustee's plan and the creditors' claims. The ombudsman's documented impact has been in shaping the conditions on a sale rather than in blocking one.

A useful analogy: the ombudsman is closer to a public comment period than to a regulator's cease-and-desist. It is real, and consumer advocates have used it to shape deals in high-profile cases. It is not a guarantee.

What about the data the company bought about you, not from you

The chapter 11 conversation above is about data the company collected about you. Many companies also hold a much larger file of data they bought from data brokers about you, including people-search profiles, ad-tech IDs, and location-data aggregations. That brokerage file sits in the same bankruptcy estate, but the statutory trigger for 363(b)(1) protection is the company's own "policy prohibiting the transfer of personally identifiable information" that the company showed "in connection with offering a product or a service." A company whose end-user product says "we do not sell your personal information" but whose data-brokerage arm trades in the same data may end up with a narrower protection than the privacy policy would suggest. Treat the end-user-facing policy as the start of the analysis, not the end.

How this fits the practical privacy stack

Bankruptcy is an edge case of an underlying pattern: any company you give data to can be sold, merged, dissolved, or compelled by a court order. The defenses that hold up are the same ones that work in the steady state. Use a privacy-respecting email alias service for sign-ups (the site's email tracking pixels explainer covers the broader tracking ecosystem). Push your phone number to a second-number service that you can drop (the phone number privacy guide lays out the providers). Replace accounts on services you only used once with throwaway equivalents. None of these tactics require the company to still be alive for them to work.

The bottom line

Section 363(b)(1) of the Bankruptcy Code blocks a trustee from selling your personal data if doing so would violate the company's privacy policy, unless the court appoints a consumer privacy ombudsman under section 332 and approves the sale. Outside bankruptcy, California's CCPA requires the new owner to give prior notice and an easy opt-out before it can change how your data is used in a "materially inconsistent" way. Both rules are real and have been used. Neither one is a substitute for asking the company to delete your data before the announcement and minimizing what you give the company in the first place. Bankruptcy is the worst time to learn what a privacy policy actually said.