Updated October 2026
What consumer privacy ombudsmen did in reported data sales
If you are planning a data sale in a bankruptcy case, expect someone to examine the privacy side. In Spirit Airlines' case that was a consumer privacy ombudsman, Lucy L. Thomson, appointed in July 2026 to report to the court. Whether your sale needs one is a question for your counsel, not for us. What we can show is what ombudsmen actually did in reported cases.1
Spirit Airlines, 2026
How the Spirit ombudsman was appointed
The US Trustee appointed Thomson on 2026-07-17 (Dkt. 1350), and the court approved the appointment six days later, on 2026-07-23 (Dkt. 1380). That came after the court had already set bidding procedures for the data in June, and before the August auction.1,2,3
Google, the successful bidder, argued in its filing that an ombudsman's remit is limited to sales of personally identifiable information, and that selling data stripped of personal details is not a sale of consumer data. That argument sits on the docket; the court has not ruled on it.4
Her reports
Five categories of conditions, then a recommendation
Her first report, filed 2026-09-08, neither recommended denial nor approval outright. It set five categories of conditions: verified removal of personal details with certification, transparency, protection of children and teens, restrictions on re-identification, and reasonable security in the AI training environment.5
On 2026-10-05 she recommended approving the sale to Google. Tonic.ai strips personal details from the unstructured data, including corporate email, and certifies each transfer to the court. She stated that she did not assess risks to employees or third parties. For the other bidders, she flagged Mercor's 2026 security incident and micro1's plan to strip personal details in-house.6,7
| Fact | Value and source |
|---|---|
| Consumer privacy ombudsman appointed | The US Trustee appointed Lucy L. Thomson on 2026-07-17 (Dkt. 1350); the court approved the appointment on 2026-07-23 (Dkt. 1380) |
| Ombudsman's first report | Report of 2026-09-08 (Dkt. 1581) set five categories of conditions: verified de-identification with certification, transparency, protection of children and teens, no re-identification, and security in the AI training environment |
| Ombudsman's recommendation | On 2026-10-05 the ombudsman recommended approving the sale to Google. Tonic.ai de-identifies the unstructured data and files a certification with the court before every transfer. She did not assess risks to employees or third parties |
RadioShack, 2015
A nine-hour mediation over a customer file
In RadioShack's case, the ombudsman led a nine-hour mediation between the company and state attorneys general. The result cut the customer file to recent product-inquiry emails and removed Social Security numbers, phone numbers, birth dates and card numbers. The FTC wrote to the ombudsman recommending that any buyer be in the same line of business and follow the old privacy policy.8,9
What is next
Character.AI and the next ombudsman question
In Character.AI's Chapter 11 case, attorneys general for 39 states and DC have reserved the right to ask for a consumer privacy ombudsman. The proposed sale hearing is 2026-11-24. That case involves user chats, which are a consumer asset, unlike Spirit's internal records.10,11
For a seller, the practical point from Spirit is that a buyer's plan for stripping out personal details gets examined in detail. Ask any licensing company who does that work, by what method, and whether an independent party will certify the result. Some buyers publish their method: Pewter, for one, shows a before-and-after sample with names replaced by placeholders and says no method removes every risk.12,13
FAQ
Questions, answered with sources
Lucy L. Thomson, appointed by the US Trustee on 2026-07-17 and approved by the court on 2026-07-23.1
Approval of the sale to Google, on 2026-10-05, with Tonic.ai certifying before each transfer that personal details were stripped out.6
Five categories: verified removal of personal details with certification, transparency, protection of children and teens, no re-identification, and security in the AI training environment.5
No. She stated that she did not assess the risks to employees or third parties.6
Led a nine-hour mediation with state attorneys general that narrowed the customer data the buyer received.8
Not yet decided. Attorneys general for 39 states and DC reserved the right to seek one in their 2026-10-14 notice.10
Every business is different, so this one is best talked through with the buyer you're working with. Their team goes over it with you before anything is signed.
Every business is different, so this one is best talked through with the buyer you're working with. Their team goes over it with you before anything is signed.
Before you sign
Questions to talk through with your buyer
Every business is different, so these are best talked through with the buyer you're working with. Their team goes over them with you before anything is signed.
Questions for this kind of business
- Do Bankruptcy Code sections 332 and 363(b)(1) apply to our sale, given what our privacy policy said at filing?
- Who would certify to the court that personal details were stripped out, and would you pay for it?
- Is a consumer privacy ombudsman, court approval, or notice and a hearing needed?
- How do CCPA, GDPR, UK GDPR and state privacy laws apply, and is de-identified data still personal information?
Questions for any buyer
- Is the license exclusive, and for how long?
- Can you sublicense the data, and to whom?
- Which AI labs will receive it, and will you tell us?
- How long do you keep it, and how is it deleted?
- What is your liability cap, and who indemnifies whom?
- Will the contract ban re-identification of people in the data?
- Who removes personal data, by what method, and do we approve it first?