Selling Customer Data in Bankruptcy: Section 363 Explained

A company in bankruptcy can sell its customer data, but if its privacy policy promised not to transfer personal information to outsiders, the sale must either fit that promise or be approved by the judge after a consumer privacy ombudsman has reported on it. That is the rule in section 363(b)(1) of the Bankruptcy Code, and the ombudsman's role is set out in section 332. The rule protects a narrow category of consumer information, and it does not displace the rest of privacy law: on the ombudsman path the court must find no showing that the sale would violate other law, and in the 23andMe case the court held that state laws restricting data transfers still have to be complied with. Bankruptcy does not wash data clean. The leading recent case shows the practical answer: in Spirit Airlines' chapter 11, the ombudsman supported a $10 million sale of the airline's records to Google only after passenger systems were excluded and the remaining records were to be de-identified and certified, concluding that " the potential privacy losses or costs to consumers have been eliminated or mitigated".

This guide is for the people who decide what happens to a failing company's data: the founder or board of a company heading into chapter 11 or chapter 7, a chief restructuring officer, a trustee, an assignee for the benefit of creditors, their counsel, and the buyers bidding on these records. It explains the rule and its two triggers, the narrow definition of personally identifiable information that decides what the rule covers, what the ombudsman does, the precedents from Toysmart in 2000 to Spirit in 2026, how the answer changes in chapter 7 and outside court, why de-identified records sit outside the rule (and what still applies to them), and a worked example. For the general privacy rules that apply to a sale outside bankruptcy, start with is it legal to sell customer data?

This guide is research from public sources, not legal advice.

Contents

1. The rule: a sale must fit the privacy policy, or go through the ombudsman
2. What counts as personally identifiable information
3. What the consumer privacy ombudsman does
4. The precedents: Toysmart, RadioShack, 23andMe and Spirit
5. Chapter 7: when a trustee sells
6. Outside court: assignments for the benefit of creditors and wind-downs
7. Why de-identified records sit outside the rule, and what still applies
8. Worked example: a consumer app in chapter 11
9. Questions people ask
10. What this means for you

1. The rule: a sale must fit the privacy policy, or go through the ombudsman

In bankruptcy, a company's assets become property of the estate, managed by a trustee (in chapter 7) or by the company itself as "debtor in possession" (usually, in chapter 11) for the benefit of creditors. Customer lists, user accounts, email archives and databases are estate property like trucks and trademarks. The ordinary rule for selling them is simple: outside the ordinary course of business, the trustee may sell estate property "after notice and a hearing", meaning creditors are told and the court can hear objections. Most asset sales in bankruptcy, often called 363 sales after the section that authorises them, run this way: an auction, a winning bid, a sale order.

Personal information is the exception. Congress added it in 2005, in the Bankruptcy Abuse Prevention and Consumer Protection Act, five years after the Toysmart case (section 4) showed a bankrupt website trying to sell a customer list it had promised never to share. The rule has two triggers, and both must be present. First, the debtor, "in connection with offering a product or a service", disclosed to individuals " a policy prohibiting the transfer of personally identifiable information about individuals to persons that are not affiliated with the debtor". Second, that policy was in effect on the date the bankruptcy case began. If both are true, the trustee may not sell or lease personally identifiable information unless one of two paths is followed:

Three features of the rule matter more than they first appear. It covers a lease as well as a sale, so licensing personal information for a fee rather than selling it outright is unlikely to take a deal outside it. It looks at the policy in force on the petition date, so a debtor cannot rewrite its privacy policy the week before filing to make a sale fit; and the Federal Trade Commission has separately warned that quietly loosening a privacy policy after the fact may be unfair or deceptive in any case. And the court must find no showing that the sale would break "applicable nonbankruptcy law": the FTC Act, the state privacy laws, the sector laws such as HIPAA and the children's privacy law. Bankruptcy gives the buyer a clean title to the estate's property; it does not give the buyer a right to use personal information in ways the rest of the law forbids.

When the policy has no such promise

If the privacy policy never prohibited transfers to unaffiliated parties, or expressly allowed transfers in a merger, acquisition or bankruptcy, the special path in section 363(b)(1) is not triggered and the sale proceeds as an ordinary sale of estate property. Holders and buyers sometimes read this as "no privacy issue". It is not. The other privacy laws still apply in full, and some of them have their own view of bankruptcy transfers. California's privacy law, for example, does not treat a transfer of personal information "as an asset that is part of a merger, acquisition, bankruptcy, or other transaction" as a sale, but only where the buyer " assumes control of all or part of the business" and uses the information consistently with the Act. A sale of a bankrupt company's data on its own, to an AI buyer that is not taking over the business, does not fit that exception, so the California rules on selling personal information (notice, opt-outs, sensitive data) apply to it as they would outside bankruptcy.

2. What counts as personally identifiable information

The bankruptcy rule protects one defined category, and the definition is much narrower than the "personal information" of the state privacy laws. Under section 101(41A), personally identifiable information is information provided by an individual to the debtor "in connection with obtaining a product or a service from the debtor primarily for personal, family, or household purposes": the individual's first name (or initial) and last name, home address, email address, home telephone number, Social Security number or credit card number. It also covers a birth date, a birth or adoption certificate number, a place of birth, and any other information about an identified individual, when it is identified in connection with one of those items.

Two consequences follow, and both shape what a bankrupt company can sell. First, the rule is about consumers. Information that a business customer's employee gave the debtor in a business-to-business relationship (a purchasing manager's work email, say) is not provided "primarily for personal, family, or household purposes", so it falls outside the bankruptcy definition. Neither does information about the debtor's own employees. Second, the ombudsman's mandate follows the definition. In Spirit, the ombudsman wrote that she " did not investigate or reach any conclusion about whether the data offered for sale or the deidentification process to be followed presents any risks to affected employees or third parties", and Google argued in its response that the ombudsman's role is limited to personally identifiable information.

That narrowness does not make employee or business-contact data free to sell. California's privacy law has covered employees and business contacts since 1 January 2023, employment and confidentiality agreements still bind the estate, and objectors can still be heard. Spirit is the proof: the hearing on the records sale, first set for August 2026, has been adjourned five times while the estate negotiates with objectors over employee information, and 119 members of Congress wrote to Spirit and Google asking them to halt the transfer of former employees' data until protections are in place. The bankruptcy definition decides when the ombudsman is required; it does not decide what is lawful.

3. What the consumer privacy ombudsman does

When path (B) is needed, the court "shall order the United States trustee to appoint, not later than 7 days before the commencement of the hearing, 1 disinterested person" to serve as the consumer privacy ombudsman. The United States trustee is the Justice Department official who supervises bankruptcy cases; the ombudsman is usually a privacy lawyer or privacy professional with no stake in the case. The appointment comes late in the process, keyed to the sale hearing, which means the estate's choices about what to sell and how have often been made before the ombudsman arrives. A well-advised estate brings the privacy analysis forward rather than waiting for it.

The statute tells the ombudsman what to put before the court. The ombudsman may appear and be heard at the hearing and provides information on the debtor's privacy policy, "the potential losses or gains of privacy to consumers if such sale or such lease is approved", the potential costs or benefits to consumers, and "the potential alternatives that would mitigate potential privacy losses or potential costs to consumers". The ombudsman does not approve or block the sale; the judge does. But in practice the ombudsman's recommendations become the conditions of the sale order, because a judge asked to find that a sale is appropriate will lean on the one disinterested person who has studied it.

What ombudsmen recommend

The recommendations have settled into a recognisable set across two decades of cases (section 4 traces each to the case it came from). The buyer should be in the same or a similar line of business as the debtor, so customers' data is used for what they expected. The buyer should agree to be bound by the debtor's privacy policy, and get affirmative consent before any material change. Only the data needed for the buyer's purpose should transfer; sensitive categories and stale records should be left out or destroyed. Customers should be told and given a way to have their data deleted. And where records are to be de-identified, the method should be independent, documented and certified.

Spirit added a modern layer to that list. Through discussions among the estate, Google and the ombudsman, the parties excluded the passenger databases so that " that data will not be subject to deidentification and will not be provided to the successful bidder in any form, deidentified or not", hired an independent de-identification agent for corporate email and other unstructured records that might mention passengers, and agreed that before every transfer the agent would file a certification with the court. The estate and Google " voluntarily agreed to follow the deidentification standard adopted in the California Consumer Privacy Act", with its three parts: reasonable technical measures, a public commitment not to re-identify, and contractual limits on onward transfer. On those terms the ombudsman recommended approval. The 97 million consumers whose data had passed through Spirit's systems were the people the review was for.

4. The precedents: Toysmart, RadioShack, 23andMe and Spirit

Four cases chart how the rule developed, and a fifth is under way. Each added a condition that is now standard, and together they show where a court, the FTC and the states will look in any sale of customer data out of an insolvent company.

Toysmart (2000): the case that led to the rule

Toysmart.com was a failed online retailer of children's toys whose privacy policy promised customers their information would not be shared. When it tried to sell its customer list in liquidation, the FTC sued in federal court in July 2000 to stop the sale of personal information " collected on the company Web site in violation of its own privacy policy". The settlement, approved by a divided Commission, prohibited Toysmart from selling the list as a stand-alone asset: it allowed a sale only " as a package which includes the entire Web site, and only to a Qualified Buyer", meaning an entity in a related market that agreed to be Toysmart's successor as to the customer information. The stipulated bankruptcy order required that buyer to treat customer information in accordance with the terms of the Privacy Statement.

Toysmart set the template that every later case follows: a privacy promise survives insolvency, the data can move only with the business it was given to, and the buyer steps into the debtor's promises. Congress wrote the core of it into the Bankruptcy Code five years later.

RadioShack (2015): the FTC's conditions and the states' leverage

When RadioShack's assets were sold in its 2015 chapter 11, its customer records were among them, and its privacy policies had told customers their information would not be sold. The director of the FTC's consumer protection bureau wrote to the consumer privacy ombudsman setting out when the agency's concerns " would be greatly diminished": the information is not sold as a standalone asset; the buyer is in substantially the same lines of business; the buyer expressly agrees to be bound by RadioShack's privacy policies; and the buyer obtains affirmative consent before any material change. These four conditions are, in substance, the FTC's standing position.

The states then showed how much further they can push. A coalition of 38 states, led by Texas, opposed the sale, and in mediation the parties agreed that the overwhelming bulk of the consumer data would be destroyed, that no card numbers, Social Security numbers, birth dates or even phone numbers would transfer, and that out of 8.5 million customer email addresses the buyer would keep only those of customers who had asked for product information within the previous two years. The lesson for an estate: the attorneys general, not only the FTC and the ombudsman, are parties to plan for.

23andMe (2025): genetic data and the limits of the ombudsman

23andMe filed for chapter 11 in March 2025 holding the genetic data of millions of customers. Within days, California's attorney general reminded customers of their right to direct the deletion of their genetic data, and the FTC's chairman wrote to the United States trustee that, " consistent with Section 363(b)(1) of the Bankruptcy Code, these types of promises to consumers must be kept". The court directed the appointment of a consumer privacy ombudsman, who reported that the best solution from a consumer privacy perspective would be " to obtain separate, affirmative consent from its customers" before the sale or before the buyer used the data, and who could not conclude with certainty that the sale was consistent with the company's privacy policies or with state genetic-privacy laws. A coalition of attorneys general sued inside the bankruptcy to require each customer's express consent (Colorado described the aim as stopping a sale of the private genetic data of roughly 15 million customers without their knowledge or consent), and more than 30 States and the District of Columbia initially objected to the sale.

The sale went ahead anyway, and how it did is instructive. At auction Regeneron won with a bid of $256 million, but TTAM Research Institute, a nonprofit led by 23andMe's founder, later bid $305 million and won. Approving the sale in June 2025, the court held three things a future estate should know. The "policy" that matters under the bankruptcy rule is the formal privacy policy current on the petition date. The bankruptcy rule does not override state laws that restrict transfers of data, which still have to be complied with. And the ombudsman's opt-in recommendation was advice, not a condition: because customers would deal with the same business under the same policy, the effect on privacy was "not so significant as to justify court intervention". What made the sale approvable was the buyer's commitments: TTAM's privacy policy would be the same as the debtors' policy, with deletion rights and the research opt-out kept, and every customer would get an email before closing. TTAM also committed to comply with the company's privacy policies and applicable law. The sale closed in July 2025 under Section 363.

Spirit Airlines (2026): de-identified records, not customer lists

Spirit is the first major case in which the data for sale was not a customer list at all but a company's working records, sold for AI training. The archive covered about 100 million emails and Teams, OneDrive and SharePoint content, and the auction in August 2026 drew three qualified bidders: Google opened at $5 million and won at $10 million, with Mercor as alternate at $7.5 million. Google said it planned to use the data for product development and training its AI models.

Section 3 describes what the ombudsman, Lucy L. Thomson, required and why she ended up supporting the sale: passenger systems out entirely, California's three-part de-identification standard, an independent agent, and a certification filed before each transfer. Spirit also shows the rule's edges. The ombudsman's review did not cover employees, and the employee questions are what have held up approval: the hearing was adjourned to 6 November 2026, after more than 100 members of Congress wrote to Google and Spirit asking them to halt the deal. As of mid-October 2026 the sale had not been approved.

Character.AI (2026): the next test

Character.AI filed for chapter 11 on 12 October 2026 to sell the company. Its announcement told users their information " continues to be protected under our Privacy Policy" and reminded them they could delete or export their data. The states moved at once. A coalition of state attorneys general said they would seek, among other things, " limits on using private conversations for AI training or other commercial purposes without valid consent" and a chance for consumers to access and delete their information before any sale, and their filed notice reserves the right to ask for a consumer privacy ombudsman and asks for all consumers to have the opportunity to delete their data prior to any sale. The company had more than 21.6 million US user accounts by March 2025, as reported. The case is the first in which the data at stake is users' conversations with an AI, and the states have made clear that training on them is the use they intend to police.

5. Chapter 7: when a trustee sells

In chapter 7 the company stops operating and a trustee is appointed to liquidate it. The trustee's first statutory duty is to " collect and reduce to money the property of the estate" and close the estate as quickly as is compatible with creditors' interests. Data is part of that property, and the same sale rules apply: the general provisions of chapter 3 of the Bankruptcy Code, including the sale section, apply in a case under chapter 7, so a chapter 7 trustee who wants to sell personally identifiable information under a restrictive privacy policy faces the same two paths, the same ombudsman and the same hearing as a chapter 11 debtor. The authority to sign moves with the case: the trustee signs, not the old board or founders.

What changes in chapter 7 is the practical setting, and it usually works against the data. The staff who knew the systems have gone, administrator credentials may be lost with them, and the software subscriptions that hold the records stop being paid. Vendors then delete on their own timetable: Microsoft deletes a cancelled subscription's data within 180 days at most, and Google Workspace offers no recovery window once an account is cancelled. The deletion clock shows the dates for each system. A trustee who wants to realise value from records has to secure the accounts and exports early, often before anyone has decided whether the records are worth selling.

Trustees also need help to sell an asset most of them have never sold. They may employ " attorneys, accountants, appraisers, auctioneers, or other professional persons" with the court's approval, on terms the court approves, which may include a percentage or contingent fee. One chapter 7 trustee, for example, asked the court to approve an auctioneer at a sliding scale of 20 percent of the first $20,000, 10 percent of the next $50,000 and 8 percent of the balance. For records rather than equipment, the professional's job includes the privacy work: deciding what is personally identifiable information, what the privacy policy allowed, whether an ombudsman will be needed, and how the records will be de-identified before any buyer sees them. The estates page describes how this works for trustees and assignees.

6. Outside court: assignments for the benefit of creditors and wind-downs

Many failing companies never enter bankruptcy. Two out-of-court routes are common, and both change the privacy analysis in the same direction: the bankruptcy privacy rule and its ombudsman disappear, and every other privacy law stays exactly where it was.

An assignment for the benefit of creditors (an ABC) is a state-law alternative to chapter 7. The company assigns all its assets to an assignee, a fiduciary who sells them and distributes the proceeds to creditors. In some states the process is supervised by a court; in others, such as California, it is largely a matter of contract and common law. Florida's statute, for example, directs the assignee to " collect and reduce to money the assets of the estate", by suit or by public or private sale, as part of the orderly liquidation of insolvent estates. An ABC is often faster and cheaper than bankruptcy, which is why it is popular for venture-backed companies. But because no bankruptcy court is involved, there is no bankruptcy privacy rule, no ombudsman, and no sale order a buyer can point to as having blessed the transfer. The assignee stands in the company's shoes, bound by its privacy policy (enforced by the FTC as described in the general guide), the state privacy laws, and every contract.

A wind-down by dissolution is the simplest route of all: the board and shareholders resolve to dissolve, and the company sells its assets, pays what it can and closes. In Delaware, where many US companies are incorporated, a dissolved corporation continues for three years (or longer if the Court of Chancery directs) to wind up its affairs, including disposing of its property, and must adopt a plan of distribution that pays or provides for its claims. Selling all or substantially all of a company's assets needs board and shareholder approval and any investor consents its charter requires. There is no court and no ombudsman, so the privacy work is entirely the company's own.

The absence of a court cuts both ways. It removes the delay, the hearing and the ombudsman's conditions. It also removes the protection a court order gives a buyer, so buyers in out-of-court sales ask for stronger warranties instead. Wind-down services that list shut-down companies' code and workspace data, such as SimpleClosure's Asset Hub, ask the company to warrant that it has provided all required notices to, and obtained all required consents from, employees, contractors, customers, investors and vendors whose personal information is in the data. And realised prices in this channel are modest: the same service reported payments typically between $10,000 and $100,000 per company, and its test marketplace recovered about $1 million across nearly 100 deals. The closures page tracks companies shutting down, and the guide for closing companies and estates walks through the choices.

7. Why de-identified records sit outside the rule, and what still applies

The bankruptcy privacy rule restricts the sale or lease of "personally identifiable information". Records from which every identifier has genuinely been removed are not personally identifiable information, so a sale of truly de-identified records does not need path (A) or path (B): it is an ordinary sale of estate property. This is why the market for bankrupt companies' records has moved toward de-identified operating records rather than customer lists. In Spirit, the most competitive bidders agreed to bid on an asset schedule that expressly excluded personally identifiable information, and the price still moved from a $5 million opening bid to $10 million at auction, with a $12.5 million competing proposal filed afterwards.

"Outside the rule" is not the same as "outside scrutiny", and an estate should plan for four things. The court may still want an ombudsman. Spirit's records were de-identified enterprise data, yet the ombudsman reviewed the sale because unstructured records such as email could contain passenger information; an estate that cannot show its records are free of consumer information should expect the same. The de-identification standard must be real. Removing names is not enough: one study estimated that 99.98% of Americans would be correctly re-identified from 15 demographic attributes. Spirit's answer was an independent agent, documented testing and a certification filed before each transfer (our de-identification standard follows the same pattern), and the sale agreement made delivery of certified records, and so payment, a closing condition. Structure can matter more than price, a point the negotiation page returns to. micro1's late proposal of $12.5 million came with in-house de-identification, and the ombudsman asked for further review because micro1 would not use an independent party; earlier, the estate had preferred a lower bid with third-party de-identification over a higher one that let the bidder scrub the records itself.

The fourth point is the one that most often delays a sale: the people the rule does not protect still object. Employees, business customers and vendors are not "consumers" under the bankruptcy definition, so the ombudsman does not speak for them, but they can file objections and the court hears them. In Spirit, vendors argued that their data inside Spirit's email and Teams was not estate property and moved to enforce confidentiality agreements, and the employee-data questions moved the hearing from October 14 to November 6. An estate that wants a clean, fast sale settles these before the auction: exclude vendor-confidential material and privileged legal communications (the Spirit sale agreement excludes privileged material by its terms), and decide how employee information will be handled. The same pattern is visible in the next AI-era bankruptcy: in Character.AI's chapter 11, the states have asked that users be able to delete their data before any sale and that any buyer face limits on using private conversations for AI training without valid consent (section 4).

8. Worked example: a consumer app in chapter 11

Example (illustrative, not a real company). A consumer language-learning app with adult subscribers across the US files for chapter 11 and plans a sale of its assets. Its privacy policy, in force on the petition date, says "we will never sell or rent your personal information to third parties", and adds that if the company "is involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction". Two kinds of bidder appear: a rival language app that wants the subscriber base and will keep the service running, and an AI buyer that wants the company's internal records, its code and its lesson transcripts.

Step 1: find the personally identifiable information. Subscriber names, emails and card numbers are personally identifiable information under the bankruptcy definition, because subscribers gave them to buy a service for personal use. So are lesson histories and recordings identified with those subscribers. Internal Slack and email are not, as a category, because they are about employees and the business; but they contain support escalations quoting subscribers' emails, so they hold personally identifiable information in unstructured form. The code holds none.

Step 2: read the policy against each buyer. The sale of the subscriber base to a rival that continues the service fits the policy's business-transfer clause, so it may proceed on path (A); because the policy also says "never sell", the estate expects an ombudsman anyway and plans for the conditions earlier cases imposed: a buyer in the same business, bound by the same policy, with notice to subscribers and a way to delete. The AI buyer is different. It is buying data, not the business, so the business-transfer clause does not fit and California's bankruptcy exception does not apply either, because the AI buyer does not assume control of all or part of the business. Any personally identifiable information in its lot would need path (B).

Step 3: shape the AI lot so it does not need path (B). The estate follows the Spirit model. Subscriber systems are left out of the AI sale entirely. Lesson recordings are excluded too: they are voice recordings of identifiable people, and voiceprints are biometric identifiers under Illinois law, which bars selling or profiting from them. The internal Slack, email and engineering records are de-identified to the California standard by an independent provider, with a certification filed before each transfer, and the lot description tells the court and the ombudsman exactly what was removed.

Step 4: settle the objections in advance. Privileged communications with counsel, vendors' confidential material and HR channels are excluded before the auction, and the estate tells former employees how their information is being handled. Result: two sales, each shaped for its buyer. The subscribers move to a company that will serve them under the promise they were given, and the AI buyer receives a de-identified record of how a language-learning company ran, with nothing in it the ombudsman has to protect.

Questions people ask

Can a bankrupt company sell customer data? Yes, but if its privacy policy on the filing date prohibited transferring personal information to unaffiliated parties, the sale must either be consistent with that policy or be approved by the court after a consumer privacy ombudsman reports, under section 363(b)(1). The court must also find no showing that the sale breaks other privacy laws, and state laws on data transfers still apply.

What is a consumer privacy ombudsman? A disinterested person, often a privacy lawyer, appointed by the United States trustee at the court's order not later than 7 days before the sale hearing. The ombudsman reports on the privacy policy, the privacy gains and losses of the sale and alternatives that would reduce them; the judge decides. In 23andMe the court declined an ombudsman's opt-in recommendation, so the advice is influential but not binding.

Does the bankruptcy privacy rule cover business customers' or employees' data? Generally no. The bankruptcy definition of personally identifiable information covers information given by an individual to obtain a product or service primarily for personal, family, or household purposes. But employee and business-contact data is still protected by other law, including California's privacy law, and objections over employee data have delayed the Spirit sale for months.

Can customer data be sold in chapter 7? Yes, by the trustee, under the same rule: the sale and ombudsman sections apply in a case under chapter 7. The practical difference is speed: with no staff and unpaid software accounts, records can be deleted by vendors before anyone sells them.

What happened to 23andMe's customer data? It was sold with the business to TTAM Research Institute for $305 million, approved on 27 June 2025, on the conditions that TTAM keep 23andMe's privacy policy, deletion rights and research opt-out, and that customers receive direct notice with instructions on how to delete their data.

Do customers have to consent to a bankruptcy sale of their data? Not under the bankruptcy rule itself, which requires consistency with the privacy policy or court approval after the ombudsman. Consent can still be required by other law: state genetic-privacy laws, HIPAA for health data, and parental consent for children's data. Ombudsmen sometimes recommend it, as in 23andMe.

Can a company sell customer data in an assignment for the benefit of creditors? Yes, the assignee sells the assets under state law, for example by public or private sale in Florida, and there is no ombudsman. But the company's privacy policy, the FTC Act, state privacy laws and contracts all still apply, and without a court order buyers ask for stronger warranties.

What this means for you

If you are deciding what happens to a failing company's data, four steps come first. Find the policy in force on the petition date (or, outside bankruptcy, every version that governed the data) and read what it promised about transfers. Sort the data into consumer personally identifiable information, business and employee data, vendors' confidential material, and records that can be de-identified; each follows a different path. Secure the systems before software subscriptions lapse and vendors delete; the deletion clock shows the dates for each system. Decide the structure early: whether customer data goes with the business to a buyer who will honour the policy, and whether operating records can be sold de-identified to a separate buyer, as in Spirit, so that the ombudsman's work and the objectors' concerns are answered before the auction rather than after it.

For trustees, assignees and boards, the estates page explains how a records sale runs inside an insolvency, and the guide for closing companies and estates walks through the choices. The closures page tracks companies shutting down, the deals page records every public records sale including Spirit, and a valuation shows what the records might fetch. AIData.Broker acts as the holder's agent in these sales, for the officeholder who has authority to sell; the holder licenses or sells the records to the buyer itself. The rights hub explains each question a buyer's counsel will ask about the records, and the legal ledger tracks privacy suits over training data. For the rules that apply outside bankruptcy, see is it legal to sell customer data? and employee emails and chats; for the full process of selling records, see the selling guide.