The Bankruptcy Data Sale Ledger: Every Disclosed User-Data Sale in US Bankruptcy Court, From Toysmart to Google's $10M Spirit Deal

Bankruptcy court has become a marketplace for other people's data. We built the ledger: six estates since 2000, five in Chapter 11 and one in Chapter 7, each with a disclosed attempt to move user data to a buyer. Two patterns hold across the full run. Every sale with a documented outcome carried binding privacy conditions, and every one of those conditions arrived only after a regulator or a union objected. And Google's contested $10 million purchase of low-cost airline Spirit Airlines' internal records is the first entry where the buyer says AI models are part of the point: the dataset "can be helpful in improving our products and AI models," Google's spokesperson said 1. Spirit's sale has now been postponed four times since the August 14 auction: the original August 19 hearing was postponed the day it was to be held, September 16 came and went without approval, the reset September 30 date passed the same way, and Spirit's own attorneys moved an October 14 hearing to November 6, leaving the purchase unapproved as of October 21, with objections still arriving 2345.

The estates are enormous, which is why a ledger is overdue. RadioShack put 117 million customer records on the auction block after its February 2015 bankruptcy filing 6. Borders moved purchase histories and email addresses collected from over 20 million customers into a September 2011 bankruptcy auction where Barnes & Noble paid $13.9 million for intellectual property 78. The court file in genetic-testing company 23andMe's case counts approximately 13 million customers 9. Spirit's dataset runs to roughly 100 million emails, 500 million Teams messages, 20 million SharePoint documents, and 80,000 employee email accounts 101. The inventory behind the objections reportedly runs deeper still: 3.4 million payroll records, 17 million OneDrive files, 5 million crew pairings, and more than 175,000 employee records dating back to 1986 5. The customer side of the line is now on the record too: court records show Spirit's 97.5 million passenger profiles and an estimated 50.2 million Free Spirit loyalty records are not part of the sale, while the workforce data of an airline that once employed about 17,000 people is 2.

What the data fetches: about $23 a genome, under two cents a message

The 23andMe auction opened at $52 million, Regeneron Pharmaceuticals bid $256 million, and TTAM Research Institute, a nonprofit public benefit corporation led by 23andMe co-founder and former CEO Anne Wojcicki, won at $305 million 911. That works out to about $23 per customer on the court's 13 million count. At Spirit, Google's $10 million beat a $7.5 million offer from AI recruiting company Mercor, and an AI training data lab called Micro1 later bid $12.5 million 101. Add the 100 million emails to the 500 million Teams messages and Google is paying under two cents per message 10. The consumer privacy ombudsman added a gate on the rivals in her October 5 report: if the court entertained either Mercor's or Micro1's bid, additional privacy review would be needed, and she wanted more information about a "supply chain security incident" at Mercor earlier this year 12.

The ledger: 26 years, six entries, no referee

• 2000, Toysmart.com: the failed website's privacy policy promised data would never be shared, then its customer list went up for sale in its creditors' involuntary bankruptcy 1314. The FTC's July 2000 settlement forbids the sale "except under very limited circumstances": only a family-oriented buyer of the entire website, with any privacy-policy change requiring customer opt-in 13. The FTC's settlement release records the conditions but no completed sale, so the list's fate stays unknown.
• 2011, Borders: FTC Bureau of Consumer Protection Director David Vladeck asked the court-appointed privacy ombudsman to let the bookseller's customer files transfer only with customer consent or significant restrictions 7. Borders' privacy policies did provide for transfers in bankruptcy; the FTC pressed an aggressive reading anyway 6. The customer list went to Barnes & Noble in a sale the federal bankruptcy court approved in September 2011; customers had until October 29, 2011 to opt out of their contact and purchase information being transferred 1516.
• 2015, RadioShack: after a policy that swore "We will not sell or rent your personally identifiable information to anyone at any time," a letter from FTC Consumer Protection Director Jessica Rich and a coalition of state attorneys general pushed the auction into a mediated agreement: some data destroyed, customers offered opt-outs, buyers bound to the old privacy policy 617.
• 2025, 23andMe: more than 30 states and the District of Columbia objected before the winning bid; the court approved the sale with TTAM's binding commitments, including continuing deletion rights and a perpetual research opt-out, no sharing of personal information with insurance companies, a consumer privacy advisory board within 90 days, and two years of identity-theft monitoring 911.
• 2026, Spirit: Google won a virtual auction on August 14 with its $10 million bid, and the Association of Flight Attendants-CWA filed the first objection on August 18, one day before a hearing the court postponed the day it was to be held 2. The Air Line Pilots Association, vendors Springshot and International Aero Engines, and groups representing machinists and transport workers all filed objections; the September 16, 2026 hearing came and went without approval, the sale was reset for a September 30 approval hearing, and by October 3 the purchase remained unapproved, the hearings delayed several times as objectors kept pressing what belongs in the dataset at all 10145. By September 25 the flight attendants' union said Spirit still had not done enough to fix the privacy issue 18, though a September 24 union filing conceded "The parties have made progress" while saying Spirit had not yet agreed to exclude flight attendants' tax forms 2. The Allied Pilots Association objected on September 29, and on October 9 Spirit's attorneys moved the October 14 hearing to November 6, the fourth postponement since the auction; the Miami Herald reported Spirit sought the last two delays in part because it believes it is winning over the flight attendants' union 2.

The sixth entry sits between the first two: XY Magazine, whose gay-interest subscription list drew the FTC's attention 6. The method is simple: start from primary documents, court opinions, FTC letters, company releases, and record each transaction's buyer, price, objections, and safeguards; where no document states an outcome, the entry stays unknown rather than guessed. Across the court opinions, FTC releases, and legal-press coverage this ledger cites, none maintains the full run of outcomes.

Why the objection is the only brake

Call the metric the Safeguard Rate: the share of transactions with documented outcomes that closed with binding privacy conditions attached. It is three for three, Borders' opt-out window, RadioShack's mediated transfer, and 23andMe's approved sale, and the perfect score is the problem. Across the ledger, no binding condition appears before an outside party filed something: an FTC suit in 2000, an FTC letter in 2011, an FTC letter plus state attorneys general in 2015, more than 30 states in 2025, unions, vendors, and 121 members of Congress in 2026. There is no standing referee. Spirit shows the vacuum in real time. In late September, Judge Sean H. Lane's court at the US Bankruptcy Court for the Southern District of New York cleared Spirit's final 27 aircraft for $668.1 million, while the $10 million data sale, before the same court, stayed open 19. Kreuzkamp's test is the plain one: Spirit is selling airplanes whose bills of sale clearly demonstrate ownership, while the dataset mixes vendor IP with Spirit's own data, and he argues a forensic process is necessary to segregate it 1. Spirit's case does now have a consumer privacy ombudsman, whose September 8 report examined the proposed sale; Google's answer came as a company filing, not a court-imposed condition, stating that the purchase includes no personally identifiable information and that Spirit's customer databases are excluded 20. That company answer hardened into scope changes the referee could verify. Consumer privacy ombudsman Lucy Thomson's October 5 report recommends Judge Lane approve the sale, finding the parties narrowed the personal consumer data included, excluded passenger databases, and hired a third party, Tonic.ai, to de-identify data such as company emails that could contain consumer information. "The parties have taken consequential steps to protect the privacy of the personal data of the Spirit consumers," Thomson wrote, sizing the affected population at 97 million consumers who booked travel; her review, by its consumer-only mandate, did not examine whether the sale poses privacy risks to employees 12. The one standing referee the Bankruptcy Code provides in a data sale cannot see the part of the dataset the fight is actually about. Robert Drain, a former New York bankruptcy judge, put the likeliest path in one line: "I think the court will take the union's motion seriously and may well press Google on what it can do to ensure the scrubbing of the personnel records without meaningful cost to the buyer" 4. OnLabor's roundup states the gap directly: most state privacy laws do not protect worker data, and no legal framework currently exists under bankruptcy law to safeguard employee data 4. The 23andMe opinion shows what happens when nobody is watching. The debtors asked the court to skip appointing a consumer privacy ombudsman; the judge declined. The ombudsman, Professor Neil Richards of Washington University in St. Louis, could not conclude the sale was consistent with 23andMe's own privacy policies, or that it would not violate state genetic-privacy laws. His most significant recommendation, separate express consent from each customer before transfer, did not make it into the approved deal, which instead carries an email notice at least two days before closing 9.

The same opinion documents how the paperwork was readied years earlier. Every 23andMe privacy statement since 2007 contemplated personal information being sold in a merger, acquisition, or sale of assets; a bankruptcy reference was added in 2022, and in December 2022 the bold line "we do not sell your Personal Information" was eliminated from the supplemental privacy notice 9. More than two years before the filing, the policy already permitted the sale. About 1.9 million customers deleted their accounts between the Chapter 11 filing and the sale hearing 9.

The AI turn: the first buyer in the ledger to name the models

No closed sale in the ledger disclosed AI training as a use; TTAM's commitments are consent-shaped research promises. Google is the first buyer in 26 years of entries to name AI models, and its deal is the one still open. Adam Schwartz, privacy litigation director at the digital rights nonprofit Electronic Frontier Foundation, told Ars this is the first public bankruptcy proceeding he was aware of over a company selling personal data as an estate asset, and the first attempt to sell employees' data rather than customers' 1. The Association of Flight Attendants-CWA's objection lands the asymmetry: "The privacy architecture of this transaction is consumer-facing; its payload is disproportionately employee-facing" 10. The pilots warn that re-identified flight-operations records could chill the voluntary safety reporting the FAA has found depends on pilots trusting confidentiality 1. The objector ranks have kept filling into October. The AFA says it represents more than 5,500 former Spirit flight attendants and has asked the court to exclude all flight attendant data from the sale, training records, timecards, and payroll information included, warning that individuals could still be identified from deidentified records by inference 5. ALPA wants safety-program records excluded even if each record is deidentified: fatigue management files, Aviation Safety Action Program reports, Flight Operations Quality Assurance data, and Line Operations Safety Assessments 5. In the final week of September the Allied Pilots Association, which represents about 16,000 American Airlines pilots, joined with an objection of its own, warning that the deal "threatens to have a chilling effect across all commercial airlines" because the confidential employment and training records of more than 700 former Spirit pilots now flying for American sit in the dataset 5. The Electronic Privacy Information Center, supporting the flight attendants, calls deidentification "not a magic wand" and warns that approving the transfer would "create incentives for employers to over-collect as much employee data as possible" for monetization in a future bankruptcy 5. October added a rank the ledger has never had: elected lawmakers. On October 8, Representative Steven Horsford and Senator Elizabeth Warren led 121 members of Congress, 13 senators among them, in a letter to Spirit chief executive Dave Davis and Google chief executive Sundar Pichai asking the companies to exclude employee information from the transaction "to the greatest extent possible," at minimum employee training records, timecards, payroll information, and Microsoft 365 content containing flight attendant information, and to build a de-identification protocol with workers' input, obtain an independent review of employee confidentiality, bar use of the data to profile identifiable groups of workers, and keep voluntary aviation safety reporting out, with no employee-related information transferred until those protections exist 23. The letter warns, citing the National Institute of Standards and Technology, that "removing names, email addresses or other direct identifiers does not necessarily make a dataset anonymous" 2. "Spirit's workers handed over this information because their jobs required it, not so it could be sold to train a different company's AI," Horsford said 2. ALPA president Captain Jason Ambrosi put the safety stake in one line: "our safety system works because pilots and other airline workers trust that when they speak up, it stays confidential" 2. The market context sits in the same news cycle: in August 2026, Ryanair, Europe's largest airline, announced a five-year partnership sharing operational data with Google to improve Gemini Enterprise tools 1. Google is buying in bankruptcy what a going concern gives by contract. "Bankruptcy cannot become the new land grab for AI," Springshot founder Doug Kreuzkamp told Ars 1.

The stake is the pace behind it. S&P Global Market Intelligence counted 749 overall US bankruptcy filings in 2025 through December 14, more than the 688 it recorded for all of 2024 21. The queue is already forming: AI companion startup Character.ai filed for Chapter 11 on October 12, 2026, with Disney signed on as stalking-horse bidder to license intellectual property for $20 million, and no user-data sale disclosed, which is this ledger's bar for entry 22. Every data-rich estate that follows, payroll records, health data, location histories, DNA, flight records, walks into a courtroom with no referee unless someone objects first. Across the court opinions, FTC letters, and news coverage this page cites, none carries the full run of outcomes; this ledger is that running record.