A consumer privacy ombudsman is a disinterested person appointed in a US bankruptcy case to advise the judge when a debtor wants to sell or lease personal information about its customers in a way its own privacy policy appears to forbid. The role exists because customer data is an asset like any other in insolvency, and creditors want it turned into cash. Congress created the ombudsman in 2005 so that someone speaks for the people in the database, who are rarely creditors and almost never in court.

When the law requires one

The trigger sits in section 363(b)(1) of the Bankruptcy Code, the provision that lets a debtor sell assets outside the ordinary course of business. If the debtor, in connection with offering a product or service, disclosed to individuals a policy prohibiting the transfer of personally identifiable information to unaffiliated companies, and that policy was in effect on the day the case began, the data cannot be sold freely. The sale must either be consistent with the policy, or be approved after an ombudsman is appointed and the court finds no showing that it would violate non-bankruptcy law.

The Code defines personally identifiable information in section 101(41A). It covers a name, home address, email address, telephone number, Social Security number or credit card number provided by an individual obtaining a product or service primarily for personal, family or household purposes.

Procedure follows from Bankruptcy Rule 6004(g). A party moving to sell such data must ask the court to direct the US Trustee, the Justice Department official who supervises bankruptcy administration, to appoint an ombudsman. Under section 332(a), the trustee must name one disinterested person, other than the case trustee, at least seven days before the sale hearing.

What the ombudsman does

Section 332(b) gives the ombudsman a right to appear and be heard, and a list of topics the court may want addressed: the debtor's privacy policy, the potential losses or gains of privacy to consumers if the sale is approved, the potential costs or benefits to consumers, and alternatives that would reduce privacy losses or costs. Section 332(c) bars the ombudsman from disclosing any personally identifiable information obtained in the role.

In practice the work produces a written report filed before the sale hearing. The ombudsman reviews each version of the privacy policy, maps which systems hold which data, and negotiates conditions. Those have settled into a recognisable menu: no sale of the data as a standalone asset, a buyer in substantially the same line of business, a buyer bound by the old policy and required to obtain affirmative consent for material changes, an opt-out or opt-in window for consumers, and destruction of data the buyer does not need.

The Borders case shows the mechanics at full scale. Michael St. Patrick Baxter was appointed ombudsman on August 12, 2011, and his September 21 report covered a marketing database holding personal information on about 48 million consumers, 45 million of them current or former Borders Rewards members. He recommended honouring prior marketing opt-outs and barring transfer of audio-visual purchase histories, protected by a separate federal video privacy law, without written consent. Barnes & Noble bought the Borders customer list and trademarks for $13.9 million, approved by Judge Martin Glenn with a 15-day email opt-out for customers, according to Publishers Weekly.

Origin and evolution

The office grew out of a single dot-com failure. Toysmart.com, an online toy retailer majority-owned by a Walt Disney subsidiary, had told customers since September 1999 that their information would never be shared with third parties. After it collapsed in 2000, it tried to auction its customer database. The Federal Trade Commission (FTC) sued, and on July 21, 2000 announced a settlement allowing a sale only as part of the whole website, to a "Qualified Buyer" in a related market that would honour the policy. The vote was 3-2. "Customer data collected under a privacy agreement should not be auctioned off to the highest bidder," said Jodie Bernstein, then director of the FTC's Bureau of Consumer Protection. The list was never sold: in early 2001 a Massachusetts bankruptcy judge approved a $50,000 payment from Disney's Buena Vista Internet Group to have the roughly 250,000 records destroyed, according to Pinsent Masons.

Congress wrote the Toysmart logic into statute with the Bankruptcy Abuse Prevention and Consumer Protection Act (BAPCPA), signed on April 20, 2005. It added section 332 and amended section 363(b)(1), for cases filed from October 17, 2005. A 2009 law moved the appointment deadline from five to seven days before the hearing, effective December 1, 2009.

The FTC kept a parallel role, writing to ombudsmen to restate the Toysmart conditions. In RadioShack's 2015 Delaware case, Jessica Rich, then the bureau's director, wrote on May 16, 2015 to ombudsman Elise Frejka about data on more than 117 million customers, calling Toysmart an "appropriate model."

Genetic data raised the stakes in 2025. 23andMe filed in the Eastern District of Missouri in March 2025, and Neil Richards, a Washington University law professor, served as ombudsman. His 211-page report, filed in June, recommended "separate and affirmative" consent before customers' data moved to a buyer, according to The Record. Judge Brian C. Walsh approved the $305 million sale to TTAM Research Institute, a non-profit led by co-founder Anne Wojcicki. Dates differ: Bloomberg Law and MedTech Dive give June 27, 2025, while Washington University's account dates approval to July 5. The judge called the report very helpful for "marshaling the facts and otherwise highlighting the important privacy issues we have in this case," according to Washington University.

Why marketers should care

Customer files, loyalty programmes, email lists and purchase histories are often the most saleable assets a failed consumer business owns. Whether they can move depends on a privacy policy that may be years old, and on how an ombudsman reads it.

The Spirit Airlines case shows how far the scope can stretch. On August 14, 2026, Google won an auction for Spirit's deidentified corporate data at $10 million, with Mercor as backup. The asset schedule listed 100 million emails across 80,000 Microsoft 365 accounts, while customer profiles and loyalty data were excluded. Lucy L. Thomson, appointed ombudsman by order on July 23, 2026, filed her report on September 8 and a supplement on October 5. The supplement records that the parties removed passenger transaction, refund, inflight purchase and Wi-Fi sales systems from the deal, and hired Tonic.ai as an independent deidentification agent for emails and other unstructured data. Spirit and Google also agreed to apply the California Consumer Privacy Act's deidentification standard. The supplement describes privacy losses for 97 million consumers as "eliminated or mitigated."

Limitations and disputes

The ombudsman advises; the judge decides. Nothing in section 332 binds the court to a recommendation, and the 23andMe sale went through without the opt-in consent Richards sought. Robert Lawless, a bankruptcy professor at the University of Illinois, said some of the recommendations "went beyond the bankruptcy courts' limit," according to Bloomberg Law.

The trigger is narrow. Section 363(b)(1) applies only when a privacy policy prohibits transfer. A policy that already discloses transfers in a merger or bankruptcy can take a sale outside the regime. 23andMe had added bankruptcy language to its privacy statement in June 2022, according to The Record. A 2021 Arizona State Law Journal piece questioned whether opt-out remedies go far enough.

The mandate also covers consumers only. Thomson's October supplement states that she "did not investigate or reach any conclusion" about risks to employees or third parties. That gap is where the Spirit fight now sits. Flight attendant and pilot unions have objected. Deidentification itself is contested: the FTC said in July 2024 that hashing does not make data anonymous, and European regulators replaced their 2014 anonymisation test with a three-part framework in 2026.

What it is not

  • Patient care ombudsman. Section 333, added by the same 2005 law, appoints an ombudsman to monitor patient care when a health care business files.
  • Data Privacy Framework redress bodies. The Privacy Shield Ombudsperson, a State Department channel for EU surveillance complaints, fell with Privacy Shield in July 2020. Its successor, the Data Protection Review Court, survived a challenge in the EU General Court on September 3, 2025.
  • Data protection officer. Under Article 37 of the GDPR, a data protection officer is an internal compliance role. The bankruptcy ombudsman serves one case and owes the debtor no duty.
  • Nordic consumer ombudsmen. In Sweden, Norway, Denmark and Finland, a consumer ombudsman is a government consumer-law enforcer.

Recent developments

The Spirit data sale remains undecided. The hearing set for October 14, 2026 was adjourned again, and an amended agenda filed on October 12 lists the deidentified data sale for 11:00 a.m. on November 6, 2026, with replies due November 4. The adjournment followed an October 8 letter from members of Congress seeking more protection for employee data, signed by 121 according to Travel Weekly and more than 110 according to Yahoo Finance.

Other cases show how deals are being structured to stay outside the regime. Character.ai filed for Chapter 11 on October 12, 2026 with Disney as stalking horse for an intellectual property licence. That licence excludes "any personally identifiable information of Licensor end users", and the motion does not mention an ombudsman. For 23andMe, the bankruptcy did not end state scrutiny: California sued the company in May 2026 over its 2023 breach, and the UK Information Commissioner's Office suspended enforcement of a £2.31 million fine pending the proceedings.

Timeline

  • September 1999: Toysmart.com's privacy policy promises customer data will never be shared with third parties.
  • July 21, 2000: FTC announces a 3-2 settlement limiting any sale of Toysmart's customer list.
  • Early 2001: Bankruptcy court approves a $50,000 Disney payment to destroy Toysmart's roughly 250,000 records.
  • April 20, 2005: BAPCPA signed, creating section 332 and amending section 363(b)(1).
  • October 17, 2005: The ombudsman provisions take effect for new cases.
  • December 1, 2009: Appointment deadline extended from five to seven days before the sale hearing.
  • August 12, 2011: Michael St. Patrick Baxter appointed ombudsman in the Borders case.
  • September 21, 2011: Baxter's report and an FTC letter on the Borders data are issued.
  • May 16, 2015: FTC letter to RadioShack ombudsman Elise Frejka covering more than 117 million customers.
  • March 2025: 23andMe files for Chapter 11; Neil Richards later serves as ombudsman.
  • June 2025: Richards recommends affirmative consent before the 23andMe data transfer.
  • June 27 or July 5, 2025: 23andMe sale to TTAM approved (sources differ).
  • July 23, 2026: Lucy L. Thomson appointed ombudsman in the Spirit Airlines case.
  • August 14, 2026: Google named winning bidder for Spirit's deidentified data at $10 million.
  • September 8, 2026: Thomson files her report.
  • October 5, 2026: Thomson's supplemental report recommends approval from a privacy perspective.
  • October 8, 2026: Members of Congress ask Google and Spirit to pause the deal.
  • October 12, 2026: Spirit data sale hearing adjourned to November 6, 2026.

Summary

  • Who: A disinterested person, often a privacy lawyer or academic, appointed by the US Trustee on the court's order. Recent examples include Michael St. Patrick Baxter (Borders), Elise Frejka (RadioShack), Neil Richards (23andMe) and Lucy L. Thomson (Spirit Airlines).
  • What: An adviser who reports to a bankruptcy judge on whether and how a debtor may sell customers' personally identifiable information that its privacy policy said would not be transferred.
  • When: Created by BAPCPA, signed April 20, 2005 and effective for cases filed from October 17, 2005, following the FTC's 2000 Toysmart settlement. Appointment must come at least seven days before the sale hearing.
  • Where: US bankruptcy courts, under sections 332 and 363(b)(1) of the Bankruptcy Code and Bankruptcy Rule 6004(g).
  • Why: Customer data is valuable in insolvency, and the people it describes have no seat at the table. The ombudsman gives the court a consumer-focused view of privacy risks and the conditions that might reduce them, though the judge is free to disregard it.