What Happens to Your Data When a Tech Company Goes Bankrupt

When a tech company files for bankruptcy, the servers do not shut off. The data sitting on those servers — your name, email address, purchase history, location records, browsing behavior — becomes a line item on a balance sheet, valued alongside the office furniture and the domain name. In 2015, RadioShack attempted to sell 117 million customer records as part of its bankruptcy estate. In 2000, online toy retailer Toysmart tried to do the same with children's data it had explicitly promised never to sell. These cases established the legal framework that governs what happens to your information when the company holding it collapses — and that framework has significant gaps.

How Bankruptcy Law Treats Personal Data

Chapter 11 bankruptcy — a form of US federal bankruptcy protection that allows a company to continue operating while reorganizing its debts under court supervision. The company becomes a "debtor in possession" and can propose a plan to restructure.

Chapter 7 bankruptcy — a liquidation proceeding in which a company ceases operations and a court-appointed trustee sells all assets to pay creditors. Most startup failures end in Chapter 7 rather than Chapter 11.

Under the US Bankruptcy Code, the estate of a bankrupt company includes all its property at the moment of filing. Courts have consistently held that customer databases — the structured collection of personal information a company has accumulated — constitute property of the estate. This means they are assets available to satisfy creditors, the same as inventory, equipment, or intellectual property.

The privacy policy a company published on its website does not automatically change this analysis. A privacy policy is a contract, and contracts can be assigned or rejected in bankruptcy. The trustee overseeing the estate has the authority to reject executory contracts (ongoing agreements not yet fully performed) and can treat promises made in privacy policies as obligations it need not honor. This is the uncomfortable reality: the privacy promise you read when you signed up may not survive the company's insolvency.

Consumer Privacy Ombudsman — a role created by the US Bankruptcy Abuse Prevention and Consumer Protection Act of 2005. In bankruptcy cases involving the sale of personally identifiable information, the court must appoint an independent ombudsman to represent consumers' interests and report to the court on privacy implications.

The 2005 law requiring this ombudsman was a direct response to the Toysmart case. Its effect is procedural — it ensures someone is in the room arguing for consumer interests — but it does not prohibit the sale of personal data. It requires that the sale be considered, not that it be blocked.

Source: US Bankruptcy Abuse Prevention and Consumer Protection Act of 2005 (BAPCPA), 11 U.S.C. § 332 — codifies the Consumer Privacy Ombudsman requirement for bankruptcy proceedings involving sales of personally identifiable information.

Source: Federal Trade Commission (FTC), "Privacy During Bankruptcy Proceedings" — FTC guidance on consumer rights and FTC intervention authority in bankruptcy data sales.

The Precedents That Define the Rules

Toysmart (2000): The Case That Created the Template

Toysmart was an online toy retailer that operated during the first dot-com boom. Its privacy policy, published prominently on its website, explicitly stated that customer information "is never shared with a third party." When the company filed for bankruptcy in 2000, it attempted to sell its customer database — which included children's information — as part of its asset sale.

The FTC sued to block the sale, arguing it would violate the FTC Act's prohibition on unfair or deceptive acts or practices. The eventual settlement allowed Toysmart to sell its database, but only as part of a package deal: the buyer had to be in the same line of business (toys and family products), had to agree to honor the original privacy policy, and had to obtain consumer consent before making any material changes to how the data was used.

The Toysmart settlement became the template — the set of conditions courts and regulators now look to when similar situations arise. It established four key criteria for permissible data sales in bankruptcy:

1. The data must be sold as part of a package with other assets (not sold standalone as a pure data asset)
2. The buyer must be in the same or substantially similar line of business
3. The buyer must agree to honor the original privacy policy
4. Consumers must have the opportunity to consent to (or opt out of) material changes

Source: FTC v. Toysmart.com LLC, settlement agreement (2000) — Federal Trade Commission case file, available at ftc.gov. The settlement established the foundational template for data sales in bankruptcy proceedings.

RadioShack (2015): When the Template Gets Tested

RadioShack's 2015 bankruptcy is the most instructive recent case, because it shows both how the template holds and where it bends. RadioShack sought to sell approximately 117 million customer records — including names, addresses, phone numbers, and email addresses — to pay down its debts. The buyer was General Wireless Operations, a different business acquiring the RadioShack brand.

The FTC intervened, as did attorneys general from eleven states. The resulting agreement significantly limited what could be sold:

• Only email addresses for customers who had opted in within the last two years could be transferred
• No records for Texas customers could be transferred at all (Texas state law was stricter)
• General Wireless agreed not to resell the email addresses to any third party
• Customers were given the right to opt out before transfer

The RadioShack case illustrates a critical point: regulatory intervention can meaningfully restrict a data sale, but cannot stop it entirely. Customers who bought a battery from RadioShack in 2009 and haven't thought about the company since were now subjects of a bankruptcy court proceeding.

Source: FTC press release (May 2015) — "FTC Requests Bankruptcy Court Take Steps to Protect RadioShack Consumers' Personal Information," ftc.gov — documents the FTC's intervention and the terms of the resulting agreement.

Source: Alston & Bird Privacy, Cyber & Data Strategy Blog (2015) — "RadioShack Agrees to Significant Limitations in Sale of Customer Data Following Pressure from State Regulators and the FTC" — legal analysis of the case outcome.

What GDPR Changes for EU Users

The EU's General Data Protection Regulation introduces a substantially different framework for data held about EU residents, regardless of where the bankrupt company is incorporated.

GDPR's core principle: data collected for a specific purpose can only be used for that purpose. A company that collected your email address to send order confirmations cannot sell that email address to a buyer who will use it for marketing, without your explicit consent.

In a bankruptcy scenario, this creates a legal collision. The bankruptcy trustee wants to maximize the value of assets for creditors. GDPR says that asset (the data) can only be transferred to a buyer who will use it for the same purposes, under the same conditions, as the original collector.

In practice, this means EU user data in a bankrupt company's database has lower monetary value than equivalent US user data, because the conditions of sale are more restrictive. A buyer who wants to acquire a tech company's user database for its marketing value — the most common commercial reason — cannot legally do so for EU residents without either honoring the original consent or obtaining new consent.

GDPR also gives individuals the right to request deletion of their data — the "right to be forgotten." If you exercise this right before a company enters bankruptcy proceedings, your data should be deleted from the estate before it can be sold. The practical problem: you need to know the company is in trouble before it files.

The interaction between bankruptcy law and GDPR has not been fully tested in cross-border cases involving, say, a US-headquartered company with EU users filing Chapter 7. Legal scholars expect litigation in this area to increase as more data-heavy companies enter insolvency.

Source: General Data Protection Regulation (GDPR), Regulation (EU) 2016/679 — Articles 5 (data purpose limitation), 17 (right to erasure), and 44–49 (data transfer restrictions) are most relevant to bankruptcy scenarios.

Source: Covington & Burling (2019) — "The Sale of Personally Identifiable Information in Bankruptcy" — legal analysis of GDPR implications for transatlantic bankruptcy data sales.

Data as a Balance Sheet Asset: Why This Happens

Understanding why companies sell user data in bankruptcy requires understanding what that data is worth commercially.

A database of email addresses for verified purchasers of electronics — the kind RadioShack held — has direct commercial value to any company that sells electronics and wants to reach those customers. Email marketing to a validated buyer list converts at significantly higher rates than cold outreach. The value per record varies, but industry estimates for verified consumer purchase databases range from $0.50 to $10 per record depending on recency and data richness.

117 million records at even the low end of that range represents tens of millions of dollars — material value in a bankruptcy proceeding where creditors are receiving cents on the dollar for their claims.

More valuable still are behavioral data sets: records of what a person searched for, what they viewed without buying, how long they spent on each page, what price point triggered a purchase decision. These datasets are harder to quantify but more commercially powerful, because they allow buyers to model consumer psychology rather than simply reach a known customer.

Personally identifiable information (PII) — any data that can identify an individual, either alone or in combination with other information. Name, email address, phone number, IP address (in many jurisdictions), and device identifiers are common examples.

The bankruptcy code's treatment of user data as property is not arbitrary. It reflects an existing legal infrastructure built around tangible property and contractual rights — a framework that predates the existence of mass user databases. Courts are applying 20th-century commercial law to 21st-century assets.

Source: Columbia Business Law Review — "Data Privacy In Bankruptcy: Toward A Deus Ex Machina" — academic analysis of the mismatch between bankruptcy law and modern data privacy expectations, with citation to valuation methodologies.

What Typically Happens in Practice: A Timeline

When a tech company becomes insolvent, the data outcome follows a reasonably predictable sequence.

Phase 1: Filing and automatic stay. The company files for bankruptcy. An automatic stay freezes most creditor actions. The company's assets — including its servers and databases — are now under court supervision. Data deletion that might look like asset destruction can be blocked at this stage.

Phase 2: Asset inventory. The bankruptcy trustee (Chapter 7) or debtor in possession (Chapter 11) catalogs all assets. The user database gets a line on the list. If the data set is large and recent, it gets an estimated valuation.

Phase 3: Consumer Privacy Ombudsman appointment. For sales involving PII, the court appoints an ombudsman. This person reviews the proposed sale, evaluates the privacy implications, and reports to the court. The ombudsman can recommend conditions but cannot block a sale.

Phase 4: Sale process. The trustee solicits bids for asset packages. Interested buyers — often competitors or marketing firms — submit offers. The data may be sold as part of a larger package (domain name + brand assets + customer database) or, less commonly, on its own.

Phase 5: FTC and state AG review. If the sale involves large volumes of consumer data, the FTC and state attorneys general may review it and negotiate conditions. This is not automatic — it depends on the scale of the data and the political attention the case receives.

Phase 6: Transfer or deletion. Under court order, the data is either transferred to the buyer under any negotiated conditions, or (rarely) ordered deleted.

Source: 11 U.S.C. §§ 327–330 and § 363 (US Bankruptcy Code) — governing trustee duties, asset sales, and the procedures for bankruptcy estate administration.

How to Protect Yourself Before a Company Fails

The most effective protection is proactive, not reactive. By the time a bankruptcy filing is public knowledge, the automatic stay may already block account deletion requests the company might otherwise honor.

Use a unique, throwaway email address for services you don't trust. Email aliasing services — SimpleLogin, AnonAddy, Apple's Hide My Email — let you create forwarding addresses per service. If the company's database is sold, the alias can be deleted, routing nothing to your real inbox.

Delete your account before a company shows signs of distress. Watch for indicators: layoff announcements, funding rounds that fail to close, leadership departures, product shutdowns. A deletion request fulfilled before the bankruptcy filing removes your record from the estate.

Exercise your GDPR right to erasure if you're an EU resident. This right applies to any company processing EU resident data, regardless of where the company is based. Submit a deletion request in writing and keep the company's acknowledgment.

Review your state's data privacy laws. California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), and a growing number of states have enacted data privacy laws that give residents rights similar to GDPR. Texas residents got specific protections in the RadioShack case. Know what your state provides.

Read the privacy policy's "assignment" clause. Most privacy policies contain a clause that says something like "in the event of a merger, acquisition, or sale of assets, your information may be transferred." This is the clause that allows bankruptcy data sales. Its presence is a signal; its absence is unusual enough to be notable.

Action	When to Take It	Effort Required
Use alias email addresses	At sign-up	Low (tool-assisted)
Delete account proactively	When company shows distress	Low-medium
Submit GDPR deletion request (EU residents)	Any time	Low
Submit CCPA deletion request (California residents)	Any time	Low
Review privacy policy assignment clause	Before signing up	Low
Monitor bankruptcy court filings	Ongoing for important services	High (use PACER or news alerts)

Source: California Consumer Privacy Act (CCPA) as amended by the CPRA (Proposition 24, 2020) — California Civil Code §§ 1798.100–1798.199.100, consumer deletion rights at 1798.105.

Source: SimpleLogin (2025) — email alias service documentation; Apple Hide My Email feature documentation at apple.com/privacy.

The Gap Between Law and Reality

The honest assessment of this legal landscape is that consumer protection in tech company bankruptcies is real but incomplete. The FTC can intervene; state attorneys general can negotiate; courts can impose conditions. But none of these mechanisms guarantee that your data will be deleted, that the buyer will honor the conditions, or that enforcement will follow violations.

The Toysmart template works best when the company has valuable data and the regulator has enough leverage to impose conditions the buyer actually cares about. It works poorly when the bankrupt company is a small startup whose database has modest commercial value — not worth the FTC's attention — but real privacy risk to individuals whose medical, financial, or behavioral records are in it.

The structural problem is that data collected under one privacy framework (we will never sell your information) has no legal mechanism to enforce that promise against creditors who were not party to the original agreement. Until that gap is closed by legislation — which multiple legal scholars have argued for explicitly — the bankruptcy estate will continue to treat user data as it treats any other property: something to be sold to the highest bidder, subject to whatever conditions a court imposes after the fact.

Frequently Asked Questions

Q: Can a bankrupt tech company legally sell my personal data?
A: Yes, in most cases. US bankruptcy law treats customer databases as assets of the bankruptcy estate. The FTC and state attorneys general can intervene to impose conditions on the sale — requiring the buyer to honor the original privacy policy, allowing consumers to opt out, or restricting what data can be transferred — but they cannot automatically block a sale. GDPR adds stronger restrictions for data about EU residents.

Q: What did the RadioShack bankruptcy case establish about data sales?
A: When RadioShack filed for bankruptcy in 2015, it sought to sell 117 million customer records. After FTC intervention and pressure from 11 state attorneys general, the sale was significantly restricted: only recent opt-in email addresses could be transferred, Texas customers were excluded entirely, and the buyer could not resell the data. The case confirmed that regulatory intervention can meaningfully limit data sales but cannot stop them entirely.

Q: Does GDPR protect EU users when a US company goes bankrupt?
A: Partially. GDPR's purpose limitation principle means that data collected for one purpose (say, processing orders) cannot be sold to a buyer who will use it for a different purpose (marketing) without new consent. This makes EU user data less commercially valuable in a bankruptcy sale and harder to transfer legally. However, the cross-border enforcement of GDPR in US bankruptcy proceedings remains legally unsettled and is expected to be tested in coming years.

Q: Can I delete my account after a company files for bankruptcy?
A: Potentially not. The automatic stay that goes into effect at filing can prevent the company from taking actions that would reduce the value of the estate — including deleting data that has been identified as a sellable asset. Your best protection is to delete accounts before a bankruptcy filing, when the company is still obligated to honor deletion requests under its privacy policy and applicable law.

Q: What is a Consumer Privacy Ombudsman?
A: A Consumer Privacy Ombudsman is an independent officer appointed by the bankruptcy court in cases involving the sale of personally identifiable information, as required by a 2005 amendment to the US Bankruptcy Code. The ombudsman reviews proposed data sales, evaluates privacy implications, and reports to the court with recommendations. The ombudsman advocates for consumer interests but cannot veto a sale — only recommend conditions.

Q: How can I tell if a tech company I use might be in financial trouble?
A: Watch for: rounds of layoffs (especially more than once in 12 months), failure to raise a new funding round after a public announcement, major leadership departures, product shutdowns or feature rollbacks, and creditor lawsuits appearing in public court records. Startup bankruptcy filings appear on PACER (the US federal court records system) at pacer.uscourts.gov. For public companies, SEC filings are the authoritative source.

---

Related reading:

• How Encryption Works, Explained
• Cybersecurity Threats in 2026
• How the Internet Actually Works