The Bankruptcy Data Sale Ledger: Every Disclosed User-Data Sale in US Bankruptcy Court, From Toysmart to Google's $10M Spirit Deal

Bankruptcy court has become a marketplace for other people's data. We built the ledger: six estates since 2000, five in Chapter 11 and one in Chapter 7, each with a disclosed attempt to move user data to a buyer. Two patterns hold across the full run. Every sale with a documented outcome carried binding privacy conditions, and every one of those conditions arrived only after a regulator or a union objected. And Google's contested $10 million purchase of low-cost airline Spirit Airlines' internal records is the first entry where the buyer says AI models are part of the point: the dataset "can be helpful in improving our products and AI models," Google's spokesperson said 1.

The estates are enormous, which is why a ledger is overdue. RadioShack put 117 million customer records on the auction block after its February 2015 bankruptcy filing 2. Borders moved purchase histories and email addresses collected from over 20 million customers into a September 2011 bankruptcy auction where Barnes & Noble paid $13.9 million for intellectual property 34. The court file in genetic-testing company 23andMe's case counts approximately 13 million customers 5. Spirit's dataset runs to roughly 100 million emails, 500 million Teams messages, 20 million SharePoint documents, and 80,000 employee email accounts 61.

What the data fetches: about $23 a genome, under two cents a message

The 23andMe auction opened at $52 million, Regeneron Pharmaceuticals bid $256 million, and TTAM Research Institute, a nonprofit public benefit corporation led by 23andMe co-founder and former CEO Anne Wojcicki, won at $305 million 57. That works out to about $23 per customer on the court's 13 million count. At Spirit, Google's $10 million beat a $7.5 million offer from AI recruiting company Mercor, and an AI training data lab called Micro1 later bid $12.5 million 61. Add the 100 million emails to the 500 million Teams messages and Google is paying under two cents per message 6.

The ledger: 26 years, six entries, no referee

• 2000, Toysmart.com: the failed website's privacy policy promised data would never be shared, then its customer list went up for sale in its creditors' involuntary bankruptcy 89. The FTC's July 2000 settlement forbids the sale "except under very limited circumstances": only a family-oriented buyer of the entire website, with any privacy-policy change requiring customer opt-in 8. No public record we could find shows the list ever selling.
• 2011, Borders: FTC Bureau of Consumer Protection Director David Vladeck asked the court-appointed privacy ombudsman to let the bookseller's customer files transfer only with customer consent or significant restrictions 3. Borders' privacy policies did provide for transfers in bankruptcy; the FTC pressed an aggressive reading anyway 2. The customer list went to Barnes & Noble in a sale the federal bankruptcy court approved in September 2011; customers had until October 29, 2011 to opt out of their contact and purchase information being transferred 1011.
• 2015, RadioShack: after a policy that swore "We will not sell or rent your personally identifiable information to anyone at any time," a letter from FTC Consumer Protection Director Jessica Rich and a coalition of state attorneys general pushed the auction into a mediated agreement: some data destroyed, customers offered opt-outs, buyers bound to the old privacy policy 212.
• 2025, 23andMe: more than 30 states and the District of Columbia objected before the winning bid; the court approved the sale with TTAM's binding commitments, including continuing deletion rights and a perpetual research opt-out, no sharing of personal information with insurance companies, a consumer privacy advisory board within 90 days, and two years of identity-theft monitoring 57.
• 2026, Spirit: the Association of Flight Attendants-CWA, the Air Line Pilots Association, vendors Springshot and International Aero Engines, and groups representing machinists and transport workers all filed objections; a hearing was set for September 16, 2026 61.

The sixth entry sits between the first two: XY Magazine, whose gay-interest subscription list drew the FTC's attention 2. The method is simple: start from primary documents, court opinions, FTC letters, company releases, and record each transaction's buyer, price, objections, and safeguards; where no document states an outcome, the entry stays unknown rather than guessed. We could find no one else, in the courts, the FTC, or the legal press, maintaining these outcomes.

Why the objection is the only brake

Call the metric the Safeguard Rate: the share of transactions with documented outcomes that closed with binding privacy conditions attached. It is three for three, Borders' opt-out window, RadioShack's mediated transfer, and 23andMe's approved sale, and the perfect score is the problem. Across the ledger, no binding condition appears before an outside party filed something: an FTC suit in 2000, an FTC letter in 2011, an FTC letter plus state attorneys general in 2015, more than 30 states in 2025, unions and vendors in 2026. There is no standing referee. The 23andMe opinion shows what happens when nobody is watching. The debtors asked the court to skip appointing a consumer privacy ombudsman; the judge declined. The ombudsman, Professor Neil Richards of Washington University in St. Louis, could not conclude the sale was consistent with 23andMe's own privacy policies, or that it would not violate state genetic-privacy laws. His most significant recommendation, separate express consent from each customer before transfer, did not make it into the approved deal, which instead carries an email notice at least two days before closing 5.

The same opinion documents how the paperwork was readied years earlier. Every 23andMe privacy statement since 2007 contemplated personal information being sold in a merger, acquisition, or sale of assets; a bankruptcy reference was added in 2022, and in December 2022 the bold line "we do not sell your Personal Information" was eliminated from the supplemental privacy notice 5. More than two years before the filing, the policy already permitted the sale. About 1.9 million customers deleted their accounts between the Chapter 11 filing and the sale hearing 5.

The AI turn: the first buyer in the ledger to name the models

No closed sale in the ledger disclosed AI training as a use; TTAM's commitments are consent-shaped research promises. Google is the first buyer in 26 years of entries to name AI models, and its deal is the one still open. Adam Schwartz, privacy litigation director at the digital rights nonprofit Electronic Frontier Foundation, told Ars this is the first public bankruptcy proceeding he was aware of over a company selling personal data as an estate asset, and the first attempt to sell employees' data rather than customers' 1. The Association of Flight Attendants-CWA's objection lands the asymmetry: "The privacy architecture of this transaction is consumer-facing; its payload is disproportionately employee-facing" 6. The pilots warn that re-identified flight-operations records could chill the voluntary safety reporting the FAA has found depends on pilots trusting confidentiality 1. The market context sits in the same news cycle: in August 2026, Ryanair, Europe's largest airline, announced a five-year partnership sharing operational data with Google to improve Gemini Enterprise tools 1. Google is buying in bankruptcy what a going concern gives by contract. "Bankruptcy cannot become the new land grab for AI," Springshot founder Doug Kreuzkamp told Ars 1.

The stake is the pace behind it. S&P Global Market Intelligence counted 749 overall US bankruptcy filings in 2025 through December 14, more than the 688 it recorded for all of 2024 13. Every data-rich estate that follows, payroll records, health data, location histories, DNA, flight records, walks into a courtroom with no referee unless someone objects first. This ledger is the running record we could not find.