The consumer privacy ombudsman in data sales

Thomson's appointment came from the US Trustee on 2026-07-17 (Dkt. 1350). Six days on, the judge approved it (Dkt. 1380), between the June procedures order and the August auction.

In its filing, Google said an ombudsman only has a role when personally identifiable information is being sold, and that de-identified data falls outside consumer data. The argument sits on the docket without a ruling.

Thomson's first report came out on 2026-09-08 and took no final side on the sale. Instead it laid out five groups of conditions:

1. 1Verified removal of personal details, with certification
2. 2Transparency
3. 3Protection of children and teens
4. 4A ban on re-identification
5. 5Security in the AI training environment

She came out for the Google sale on 2026-10-05. Under her plan, Tonic.ai removes personal details from the unstructured material, corporate email included, and certifies every transfer to the court. She said plainly that employee and third-party risks were outside her review.

Back in 2015, RadioShack's ombudsman spent nine hours in mediation with the states' attorneys general. Afterwards only emails from customers with recent product inquiries remained in the file, and Social Security, phone, birth date and card numbers were stripped. See customer data in bankruptcy.

Character.AI's bankruptcy raises the issue again: dozens of state attorneys general have asked who can buy users' chats. If your case has any customer or user data, plan for privacy review early, budget for de-identification and expect the ombudsman's report to shape the final terms.