Repossessed cars for sale: everyone publishes, nobody is responsible

A citizen who, by his account, fell victim in 2023 to a loan taken out without his knowledge and a car purchased in his name, discovered years later the same car advertised on the website of Bidspirit, a platform serving law firms appointed as receivers over pledged vehicles. Next to the photographs he found the vehicle registration document, published on the site with a failed redaction of his personal details: ID number, address and full name.

He was reminded of the judgment against Google in the case of a Spanish citizen who asked to remove from search results old information about a forced sale of his property over a debt. Except that here, by the citizen's account, the information is not true at all: he never received the loan, never bought the car and never signed any document that would put him before tens of thousands of visitors as a debtor whose car was sold in receivership. How the car came to be registered in his name is the subject of a court proceeding and is presented here as his claim only. The affair was also covered by Adva Dadon in her "Fraudsters" segment (watch the report).

We examined the matter under privacy and data-security law and compared the statements of three actors in the market for repossessed cars: Bidspirit, the law firm Chen, Fisher, Gabbay, and the law firm Y. Shapira & Co. It is apparent from the outset that the statements contradict one another, and that none answers the simple question: on what basis does a person's data remain published after the car has already been sold.

How a repossessed car is sold, and when the receiver's job ends

When a debtor fails to pay a loan secured by a pledge on a vehicle, the creditor turns to the Enforcement and Collection Authority. The registrar appoints a receiver, usually a lawyer from a collections firm, and authorises him to seize and sell the car. Today most such sales take place on online car auction sites, the largest of which is Bidspirit Cars.

The appointment has one purpose: to realise the vehicle and pay the debt from the proceeds. To sell, the receiver may show bidders the vehicle details they need. After the sale he transfers the money, files a report, collects his fee and ends his role. This is the question at the heart of the investigation: what is the legal, ethical and moral basis for continuing to use that vehicle's details, that registration document open to all, and those photographs, months and years after the sale ended.

An ordinary seller of a used car may keep his advertisement up as long as he likes. He is the owner. A receiver is not the owner. He acts under a court order, for a limited period and a defined purpose, and the debtor's details reached him only because of the proceeding. When the proceeding ends, so does the justification.

21 June 2023: the sale. 1 September 2026: the listing is still live

The car was offered in a public auction run by the law firm Geller, Hahn-Markovitz, Prag, Schwab, Ziv, Danan, the auction house marked on Bidspirit with the code ghm. Sale date: 21 June 2023. According to server data, the registration file was uploaded ten days earlier, on 11 June 2023.

On 1 September 2026 the vehicle page was checked. It showed the auction house, the licence plate number, the odometer reading, the number of previous owners, the viewing location and the status "sold". The page title, as written by the site: "Bidspirit | Honda Jazz Hybrid 2013 from receivership". Under "Documents" there was a link to the registration document.

The check was made without logging in, without cookies and without any permission. The file was downloaded, documented and sealed with a certified timestamp (RFC 3161), so that both its content and the time of its existence can be proven.

A redaction that erased nothing

The published document showed an attempt to hide the owner line, the ID number and the address. The technical examination found two independent failures.

First failure: three white rectangles were drawn inside the PDF over the scanned image. Such a rectangle is a drawing layer placed above the content; it changes not a single pixel beneath it. Extracting the image from the file, an ordinary operation requiring no security bypass, returns the full scan.

Second failure: beneath the rectangles, the details had been covered with marker on paper before scanning. But the scan was saved in 256 shades of grey, and the text under the marker is slightly darker than the marker itself. A simple contrast stretch brings the digits back. The recovered ID number is the citizen's, and its check digit is valid.

And beside what was hidden, much was left open from the start: chassis number, engine number, ownership date, number of previous owners, last roadworthiness test, odometer reading and the payment details to the licensing authority. This is precisely the data set needed by anyone wishing to impersonate in a vehicle transaction or forge registration papers.

"Visible only to the winning bidder": a promise kept only on screen

Next to the document link, on the vehicle page itself, appeared the sentence: "This document was attached to the vehicle details, but after the sale it is visible only to the winning bidder". In practice the file opened for anyone.

The page code explained the gap. The restriction was implemented as a display condition in the visitor's browser only. On the storage server there was no access control at all, and the site's data interface (API) handed the file's full address to any anonymous caller, even for an auction that had ended three years earlier.

The same pattern appeared with the photographs. The API response for the item included a field named hideImageAfterAuction, with a second field for the number of days. Both were switched off. The licence plate was fully readable in the photographs, as was the plate of another car, unrelated to the proceeding, parked in the background. What was switched on: a repeating "bidspirit" watermark across every image. The technical measure protecting the image as the site's commercial asset was active; the measure that would have protected the owner's privacy was not.

Who is the publisher? Each one points at the other

This is the question at the heart of the investigation, so we tested it against the documents the parties themselves published: terms of use, privacy policies, sale pages and written replies. We focused on two parties with a direct contractual link: Bidspirit, the platform operator, and the Netanya law firm Chen, Fisher, Gabbay, which runs a branded auction site at auction.cf-law.co.il on Bidspirit's infrastructure. All quotations below were collected on 23 September 2026 and preserved with hashes and a timestamp, unless stated otherwise.

Contradiction 1: who owns the firm's auction site

The terms of use displayed on Chen, Fisher, Gabbay's auction site open with the words:

"Welcome to the website cf-law.co.il, owned and operated by Bidspirit (R.A.) Ltd., company no. 09-8890900, postal address: 9 Dov Street, Ramat Gan, e-mail: eladg@cf-law.co.il."

So according to the firm's own site, the site belongs to Bidspirit. Except that "company no. 09-8890900" is not a company number: it is the telephone number of Chen, Fisher, Gabbay, as shown at the top of the same page. The postal address is a Ramat Gan address Bidspirit uses in its own terms, and the e-mail is the firm's. The text is identical, word for word, to the opening of the terms on Bidspirit's own site, which reads: "Welcome to the website bidspirit.com, owned and operated by Bidspirit (R.A.) Ltd., company no. 514945559, postal address: 10/10 Derech Sheba, Ramat Gan". On the firm's site the site name, phone and e-mail were replaced, and the company number was replaced with a phone number.

On the very same page, in the receiver's sale terms, it says a copy of the sale agreement can be obtained "at the receiver's office and/or on the receiver's website (cf-law.co.il) and/or on the Bidspirit system website". Here the site is already "the receiver's website", separate from "the Bidspirit system website". And the privacy policy on the firm's main site opens: "Chen Fisher Gabbay Law Office (hereinafter: the Company, we or the Site)". Three documents from the same firm, three answers to whose site it is.

Contradiction 2: who publishes

In its reply to the citizen of 8 September 2026 Bidspirit wrote:

"Bidspirit is a technological system, software only... Bidspirit does not publish any content and/or any part of the sale process... Those who actually upload the vehicle information... are the office holders only. Sellers are aware that in every action they perform through the software they must ensure that no personal information of debtors is published by them publicly."

Its terms of use, displayed on the firm's site too, say otherwise. Clause 5.2: content is "published without prior review". Clause 5.16: the photographs were delivered "to the site by the sellers, for publication on the site". Clause 8.2: "All rights and/or intellectual property published on the site are owned by the site". Clause 8.3: "Content on the site is presumed to be the exclusive property of the site". An entity that declares itself owner of the content, stamps its name on every photograph and writes a title in its own name for every page, publishes.

And from the other side: the firm's site says "Yes, a copy of the relevant vehicle registration document can be downloaded from the site". That is, the firm sees itself as the one making the document available. Both parties publish, and each points at the other.

Contradiction 3: who can remove

Bidspirit removed the citizen's listing and document within days of receiving the demand, without referring to the receiver. Clause 5.10 of the terms: "The site reserves the right to modify, remove or omit details from any content uploaded to the site at its sole discretion". Whoever can remove at its sole discretion controls the content. The Privacy Protection Law defines the "controller" of a database as "whoever determines, alone or with another, the purposes of processing". The question is not who pressed the upload button, but who decides what stays, for how long and for what purpose.

Contradiction 4: which privacy policy applies to the auction site

Clause 7 of the terms on the firm's auction site says: "To view the privacy policy click here". The words "click here" are not a link. The auction site's privacy page, reachable at auction.cf-law.co.il/privacy-policy-2, is the untouched English default text of the WordPress system. Its first sentence:

"Who we are. Our website address is: https://demo.bidspirit-themes.com."

In other words: the privacy policy of a Netanya law firm's auction site declares that the site's address is the demo site of Bidspirit's website product. The rest of the page deals with blog comments, the Gravatar service and login cookies for editing articles. Not a word about vehicles, debtors or registration documents. The firm's main site has a different privacy policy, in Hebrew, naming a privacy officer, but it defines itself as applying to "users of the site" who submitted details in forms. None of the three documents, Bidspirit's, the auction site's and the firm's, mentions the person whose car and document are displayed on the site.

Contradiction 5: who is responsible for legal compliance

Clause 3.8 of the terms: "The Company is not responsible for the compliance of car dealers and receivers with the relevant law. The sole responsibility for verifying the compliance of car dealers and receivers with the law rests with you alone". "You" is the buyer. In its reply to the citizen Bidspirit wrote that sellers "are aware" they must ensure no debtor's personal data is published. The firm, for its part, does not address the question. The debtor, who is the data subject, is party to none of the documents.

Contradiction 6: what the Database Registry says

Two databases are registered in the name of Chen, Fisher, Gabbay, among them "Odkanit" (700073126), whose data types include "financial information: debts" and "financial information: assets", with the purpose "financial operations, accounting and collection". Bidspirit is not registered in it as a holder. In Bidspirit's own database (700064681, "customers and service providers") the holders field is empty, and the registered data types are "professional experience", "contact details" and "consumption habits". A registration document bearing an ID number fits none of these categories, and neither party registered the other as holding data on its behalf. From these documents it appears that the link through which the data actually flows, from the firm to Bidspirit's servers and from there to the public, appears in neither party's registration.

Contradiction 7: who is behind the site at all

In the registration form of the firm's auction site the user is asked to confirm: "I agree to and accept the terms for processing personal data" and "Allow 'Chen, Fisher law office crm' to send me messages". The site's name, as shown in the browser title, is "Chen, Fisher law office crm". The personal-data terms the user accepts are the ones that point to a "click here" that is not a link.

Question	Bidspirit's answer	Chen, Fisher, Gabbay's answer
Who owns auction.cf-law.co.il	By e-mail: "software only"	Terms of use: "owned and operated by Bidspirit"; sale terms: "the receiver's website"
Who publishes the car and the document	E-mail 8.9.2026: "does not publish any content"; terms 8.2 and 8.3: everything owned by the site	Firm's site: "Yes, a copy of the registration document can be downloaded"
Who can remove	Removed within days; clause 5.10: removal "at its sole discretion"	Not asked; did not respond
Which privacy policy applies	Bidspirit's policy: for "users" of bidspirit.com	Auction site: default text, "demo.bidspirit-themes.com"; main site: policy for site users
Who is responsible for compliance	Clause 3.8: not the Company; verification is on the buyer	Does not address it
What the registry says	"Customers and service providers"; holders: empty	"Odkanit"; Bidspirit not registered as holder

The picture emerging from the documents is not of two parties disagreeing over where responsibility lies. It is of two parties each of which drafted its documents so that responsibility sits with someone else, and of a third person, the debtor, mentioned in none of them. The law, however, does not permit that vacuum: whoever determines the purposes of processing is a controller, whoever holds data for another is a holder, and section 17 of the Law places the duty of data security on both.

63,218 pages, every night, to Google

The robots.txt file of Bidspirit Cars blocks nothing and points to a sitemap rebuilt every night around 01:55. On 2 September 2026 the item sitemap listed 63,218 vehicle pages. 63,217 of them carried the instruction changefreq: yearly, a declaration to the crawler that the page is stable and should be revisited once a year. The citizen's vehicle page was among them.

Year of last update	Vehicle pages in the sitemap
2023	1,074
2024	41,758
2025	11,881
2026	8,505

From these documents it appears that the overwhelming majority of pages submitted to search engines belong to auctions that have ended. Every such page carries, in the first version the crawler receives, the same marketing title: "Bidspirit | Repossessed car auctions up to 68% below list price | Participation is free". After the page loads, the address and title are rewritten with the make, model and year, and the alt text of every photograph carries the model, odometer reading, number of owners and colour.

In other words, every repossessed car becomes one more landing page bringing traffic to the site. The company's business site, bidspirit-themes.com, presents figures it attributes to itself: more than 3,300 auction houses, 4.5 million lots listed in 2024, activity in more than 25 countries. To auction houses it offers a branded site "for free" under a rebate plan and "up to 20% increase" from buyer's premium.

That is the chain of benefit: the receiver is obliged to publish the sale; the platform lets him do so cheaply; every listing stays online and is submitted to Google; and the accumulated traffic is the platform's asset. The raw material is the property and documents of debtors, and in our case, by his account, of someone who is not a debtor at all.

Three statements, three versions

Bidspirit. Its privacy policy exists in two versions. The Hebrew version (last updated 21.12.2025) lists in clause 10 only two rights: access and correction. The English version (24.11.2024) grants the full European catalogue of rights, including, in its words, "Right to erasure ('right to be forgotten'): You can request that we delete all your personal data", and by its own terms applies to every site Bidspirit operates, with no geographic limit. The Hebrew version states that only it is binding. Moreover, both versions speak of "users" who registered on the site. The citizen never registered. He is not a customer, not a user and not a party to the terms. His data was simply there.

Chen, Fisher, Gabbay. The contradictions between the firm and Bidspirit are set out above. One addition: a screenshot of the firm's site footer from early 2026 shows an "Accessibility statement" but no privacy policy link. Today the main site has a privacy policy. It names a privacy officer, grants "the right to access, correct or delete personal information", and lists among its purposes "direct mail, marketing updates and special offers". On debtors, receivership and registration documents offered for download it says nothing.

Y. Shapira & Co. The Tel Aviv law firm publishes repossessed cars on its own website, shap.co.il, in addition to Bidspirit. On 15 September 2026 the firm's sitemap counted 310 pages, 293 of them vehicle pages. 292 carried a visible link named "Download vehicle registration". Five of the cars had been marked "sold" as far back as April 2024, and their documents were still downloadable two years and five months later. The site has no privacy policy at all: it is absent from the sitemap, absent from the list of pages the site itself reports, and an on-site search for "privacy" does not find one. That same search returns the profile of one of the firm's lawyers, described as "certified as a privacy protection officer". At the bottom of every page is a contact form in which the ID number is a mandatory field.

	Bidspirit	Chen, Fisher, Gabbay	Y. Shapira & Co.
Privacy policy	Two different versions, Hebrew and English	Main site: exists today; auction site: default text of a demo site	None
Right to erasure	In English yes ("right to be forgotten"); in Hebrew access and correction only	Access, correction and deletion	No statement
What is said about debtors	Responsibility of "office holders only"	Nothing	Nothing
Registration document	"Visible only to the winner", in practice to anyone	"Yes, a copy of the registration document can be downloaded"	"Download vehicle registration" on 292 pages
Registered database	"Customers and service providers"	"Odkanit", purpose: collection	"Debtors", purposes: performance of duties, financial operations and collection, customer contact

And what does the Enforcement and Collection Authority do, which also sells seized vehicles on the same platform? Its sale terms state in clause 2: "The bidder is aware that in vehicle sales the vehicle registration document cannot be viewed, except for the information displayed on the site". The item page shows vehicle type, make, model, year, number of owners, engine capacity, key and storage location, alongside the plate number. The registration document itself is not shown. The public body performing exactly the same act, under the same law, considers it unnecessary to expose the document in order to hold a proper public sale.

What the Privacy Protection Law says

Purpose limitation. Section 2(9) of the Privacy Protection Law, 5741-1981, defines as an infringement of privacy "use of information on a person's private affairs, or delivering it to another, for a purpose other than that for which it was given". Section 8(b) provides: "No person shall process personal data in a database except for the purpose for which the database was lawfully established". The owner's details were given to the licensing authority for registration and reached the receiver for realisation. They were not given to generate traffic for a commercial site.

Processing includes disclosure and granting access. Since Amendment 13 came into force on 14 August 2025, "processing" is defined in section 3 as "any operation performed on personal data, including receiving, collecting, storing, copying, viewing, disclosing, exposing, transferring, delivering or granting access to it". Leaving a registration document on a public path, day after day, is continuous processing. Bidspirit itself used the word when it wrote "we have stopped the processing".

Correction and deletion of inaccurate data. Section 14(a) provides that a person who finds the data about him "incorrect, incomplete, unclear or not up to date" may ask for its correction or deletion, and section 14(b) obliges whoever agrees to correct it to notify "everyone who received the personal data from him". Bidspirit cites the same right in clause 10.2 of its own privacy policy. Here the data is wrong twice over: it presents the citizen as owner of a car he says he never bought, and as a debtor whose car was realised, when he says he never took the loan.

Data minimisation. In its policy paper published for public comment on 25 March 2021, the Privacy Protection Authority held that data relevant when collected may become excessive while stored, "in light of a change of circumstances such as completion of the purpose", and gave as an example copies of licences collected for a specific purpose. Regulation 2(c) of the Privacy Protection (Data Security) Regulations, 5777-2017, requires a database owner to examine at least once a year whether the data held exceeds what is needed.

Data obtained under an order. In AAA 7043/12 IDI Insurance Co. v. Ministry of Justice (15.1.2014) the Supreme Court upheld the position that an insurer that received attachment-order data in order to comply with the order may not use it for another purpose. The Authority cites that judgment as an example that "information may not be used... outside the original permitted use". If that holds for a body that received such data for the proceeding only, all the more so for one that exposes it to the public long after the proceeding ended.

Compensation without proof of damage. An infringement of privacy is a civil wrong under section 4 of the Law, and section 29A(b) allows the court to award up to NIS 50,000 without proof of damage, and up to double that where the infringement was intended to cause harm. The amounts are index-linked since 2007.

Google Spain: the case that began exactly here

In 1998 the Spanish newspaper La Vanguardia published, on the order of the Ministry of Labour, two notices of a forced auction of a property over social security debts. The owner, Mario Costeja González, settled the debt. More than a decade later, every Google search of his name still returned the auction notice.

On 13 May 2014 the Court of Justice of the European Union held in Google Spain (C-131/12) that a search engine must remove links to information that appears, with the passage of time, "inadequate, irrelevant or no longer relevant, or excessive" in relation to the purposes of processing. The Court held that the information need not be inaccurate or prejudicial to justify removal. To be precise: the Spanish data protection authority rejected the complaint against the newspaper, because the original publication was lawful and ordered by an authority, and upheld it against Google. From there came the term that Bidspirit itself now quotes in its English privacy policy: "the right to be forgotten".

The difference between the cases is instructive. Costeja was a real debtor with a real debt; he only asked that the past stop following him. In our case, by the citizen's account, there was no debt of his to begin with. And whereas in Spain the auction notice was a printed newspaper item that Google merely pointed to, here the identity document itself, with the ID number, sat on the platform's servers and was submitted to search engines on its own initiative.

And in Europe it was held almost three years ago that vehicle data itself is not neutral. In Scania (C-319/22, 9.11.2023) the Court held that a vehicle identification number is not, as such, personal data, but becomes personal data when whoever has access to it has the means to identify the owner. In the published document the chassis number and the owner appeared on the same page. Israel's Privacy Protection Authority reached a similar conclusion as early as Guideline 4/2012, which listed licence-plate recognition systems first among systems whose output is data on an identified or identifiable person.

What happened after the demand

Date	Event
21.6.2023	Sale of the car on Bidspirit (auction house ghm)
1.9.2026	Registration document opens for any visitor (HTTP 200); documentation and timestamp
2.9.2026	Demand letter; documentation of the sitemap and the 63,218 pages
3.9.2026	Complaint to the Privacy Protection Authority against Bidspirit and Geller & Co.
4.9.2026	Bidspirit's sitemap still includes the vehicle page
4.9 to 8.9.2026	Listing, document and photographs removed from public access
7.9.2026	Further demand: cessation of processing, access, notification and preservation of evidence
8.9.2026	Bidspirit's reply: "we have stopped the processing"; 19 of 19 other documents in the same auction still open
10.9.2026	Complaint to the Authority against Chen, Fisher, Gabbay and Bidspirit
15.9.2026	Complaint to the Authority against Y. Shapira & Co.

The removal was made, but it was item-specific. The server now returns "AccessDenied" for the citizen's file, a response that does not distinguish between a deleted file and one still stored but blocked from the public. Bidspirit has not confirmed in writing deletion from storage and backups, and has not disclosed to whom the data was passed since 2023, as section 14(b) requires. The updated sitemap of 8 September still pointed to the base file listing the removed page's address.

Most importantly: in the same check, 19 of the 19 registration documents of the other cars in the same auction opened for anyone. In the catalogue of the Israel Electric Corporation, a public body, the API handed out 88 document paths, and all five sampled paths opened. Bidspirit showed it can remove a document within days when it chooses to. Leaving the others is not a technical limitation.

Bidspirit wrote that the letter had been passed to its legal counsel and that it would answer the remaining requests "shortly". No further reply had been received by publication. Bidspirit, Geller & Co., Chen, Fisher, Gabbay and Y. Shapira & Co. may respond at any time, and their responses will be published here.

The questions that remain open

Who decided that a registration document, with name, address and ID number, is part of a sale advertisement? Why was the "visible only to the winner" restriction implemented on screen and not on the server? Why does the post-auction image-hiding mechanism exist and sit switched off? Which of the parties, the receiver or the platform, controls the data after the receiver has ended his role? And if neither sees itself as responsible, why is the data still there?

The Enforcement and Collection Authority sells seized vehicles without exposing their documents. The European Court held back in 2014 that an old forced-sale notice need not follow a person forever. And in Israel, three years after the receiver sold the car and ended his role, the registration document of a citizen who says he was never its owner was still being submitted to Google under the title "car from receivership".

Sources

• Privacy Protection Law, 5741-1981, sections 2(9), 3, 4, 8(b), 14, 29A, as amended by Amendment 13 (in force since 14.8.2025).
• Privacy Protection (Data Security) Regulations, 5777-2017, regulation 2(c).
• Privacy Protection Authority, Data Minimization policy paper for public comment, 25.3.2021; Registrar of Databases Guideline 4/2012, section 2.7.1.
• AAA 7043/12 IDI Insurance Co. Ltd. v. Ministry of Justice (15.1.2014).
• CJEU, C-131/12 Google Spain SL v AEPD and Mario Costeja González (13.5.2014); CJEU, C-319/22 Gesamtverband Autoteile-Handel v Scania (9.11.2023).
• Bidspirit: terms of use; privacy policy in Hebrew (21.12.2025) and English (24.11.2024); robots.txt and sitemaps as collected 1-2.9.2026; reply of 8.9.2026.
• Chen, Fisher, Gabbay: cf-law.co.il, "standing content for vehicles" page and privacy policy; auction.cf-law.co.il, terms of use and privacy policy; collected 23.9.2026 and preserved with SHA-256 hashes and an RFC-3161 timestamp.
• Y. Shapira & Co.: shap.co.il, sitemaps and on-site search, collected 10.9.2026, 15.9.2026 and 23.9.2026.
• Enforcement and Collection Authority: vehicle sale terms on its auction site, clause 2. Database Registry, data.gov.il, checked 2.9.2026 and 23.9.2026.

This section is documented factual reporting, not legal advice. The claim that the loan was taken and the car registered without the citizen's knowledge is his claim and is before the courts. Technical findings rest on checks made by anonymous access to addresses the sites themselves disclosed, without bypassing any security measure, and are documented with hashes and timestamps. Third-party documents were not published and will not be. The parties concerned may respond at any time and their responses will be published.

AI tools were used in preparing this article to process source material and for translation. The investigation, the findings and responsibility for them are the author's.