Google's $10M Spirit Airlines Deal: 100M Emails for AI Training

Spirit Airlines ran 80,000 email accounts. After the carrier announced in May that it would shut down, the mail inside those accounts became something its bankruptcy estate could sell. On August 14, Google won it at auction for $10 million, to train AI models.

On October 8, 121 members of Congress asked Google and Spirit to stop until former workers are protected, The Record reported. Their main objection applies to every inbox: taking the names out of an email does not make it anonymous.

Key Takeaways

• Google LLC won Spirit Airlines' bankruptcy auction for its internal data on August 14, 2026 with a $10 million bid, and the sale still needs approval from the U.S. Bankruptcy Court for the Southern District of New York.
• The asset schedule filed with the court lists about 100 million emails across 80,000 accounts, 500 million Microsoft Teams items, 175,658 employee records, 3,426,618 payroll records and 148,018 employee tax forms, while excluding 97.5 million passenger profiles.
• Rep. Steven Horsford and Sen. Elizabeth Warren led a letter signed by 121 members of Congress on October 8, warning that removing names and email addresses "does not necessarily make a dataset anonymous."
• The sale agreement lets Google pick or approve the firm that scrubs the data, requires that firm to preserve "referential integrity across the data set," and bars Google only from intentionally linking the data back to people.
• Reuters reported that the court's consumer privacy ombudsman recommended approving the sale at an October 14 hearing, provided Spirit customers' personal information is excluded.

What Data Is Google Buying From Spirit Airlines?

Google is buying Spirit's internal records: its Microsoft 365 mail and chat, HR and payroll systems, operations and pricing data, legal files and source code, delivered after a third party scrubs them. The notice of auction results filed on August 14 attaches the full asset schedule. It instructs Spirit to "Retain and transfer all emails, OneDrive, SharePoint, and Teams data within the native Microsoft 365 environment." Marked "Included":

• Microsoft 365: about 100 million emails dating from 2018 across 80,000 email accounts, 500 million Teams items, 17,082,644 OneDrive items and 20,577,677 SharePoint items.
• People: 175,658 employee records going back to August 1986, 3,426,618 payroll records and 148,018 employee tax forms from June 2016, crew training records and employment contracts such as NDAs.
• Code and legal: 516 source code repositories holding about 30 million lines of code, litigation case files, M&A contracts and board presentations.

Marked "Not Included": 97.5 million passenger profiles, 50.2 million Free Spirit loyalty members, 13.7 million active customer email addresses and about 30.9 million recorded customer calls. The schedule also listed 1,092,000 time card records, which Google later agreed to drop along with passenger transaction data, according to a docket analysis by bankruptcy services firm Stretto. We could not retrieve that Google filing, and the October 8 letter still lists timecards.

The bidding shows what the scrub was worth. A declaration by Spirit's investment banker, Dylan Friesner of PJT Partners, says Google opened at $5 million. Mercor, the AI training data firm that lost 4TB of data in a supply chain attack this spring, offered $10 million if it could do the deidentification with its own tools. Spirit's advisers declined that version and kept Mercor's $7.5 million bid, which used an outside scrubber, as the backup.

Who Objected to the Google Spirit Deal, and Why?

Spirit's unions objected first, then a privacy group, then Congress, all on one point: the protections were written for customers, and the data is mostly about employees.

The Association of Flight Attendants-CWA filed its limited objection on August 18, writing that "The privacy architecture of this transaction is consumer-facing; its payload is disproportionately employee-facing." The pilots union ALPA, the IAM and TWU Local 570 followed. On October 1, the Electronic Privacy Information Center and law professor Seema N. Patel filed a proposed amicus brief arguing that the sale would "create perverse incentives for employers to over-collect employee data."

Then came the congressional letter. We counted 121 signatures: 108 House members, Horsford among them, and 13 senators, Warren among them. It states: "Consumers have more privacy protections than workers, yet Spirit has collected far more private information about its employees than about its customers." Its six demands start with excluding employee information "to the greatest extent possible" and end with keeping out pilots' voluntary safety reports.

Google says it is "not looking to buy any personal information from Spirit" and that the data "will either be completely excluded or will be deidentified by an independent third party before Google receives any data," according to a statement given to PYMNTS. The Record notes that almost 1,000 people lost their jobs at Spirit in Las Vegas after the shutdown announcement. Horsford, a Nevada Democrat, said former employees did not hand over their information "so it could be sold to train a different company's AI."

Can 100 Million Emails Really Be Deidentified?

Not reliably, going by the research the lawmakers point to, and the sale agreement makes it harder. Section 3(c) adopts the California Consumer Privacy Act standard but requires the scrub to run "while preserving referential integrity across the data set." One person keeps one pseudonym everywhere, so their emails, chats, payroll rows and crew base stay linked. The lawmakers warn that workers could be identified "through combinations of communications, operational records, crew base information, employment history, or other datasets."

Email is the hardest case. In its report on deidentification, NIST IR 8053, NIST warns that in free text "Direct identifiers such as names and addresses may not be clearly marked," and that information "may remain that allows identification" after the standard identifiers are removed. Three findings show how little it takes:

• A 2019 Nature Communications study by Rocher, Hendrickx and de Montjoye found that "15 demographic attributes would render 99.98% of people in Massachusetts unique."
• A 2026 paper on LLM deanonymization matched pseudonymous people from unstructured text at "up to 68% recall at 90% precision compared to near 0% for the best non-LLM method." We covered how AI now unmasks anonymous accounts for a few dollars each.
• In a 2021 USENIX Security paper, Carlini and colleagues pulled training text back out of GPT-2, including "names, phone numbers, and email addresses."

Researchers have been here before, at a far smaller scale. The Enron corpus, which Carnegie Mellon distributes after federal regulators made it public, holds about 0.5 million messages from about 150 users. Even that set had messages deleted "due to requests from affected employees." Spirit's archive is 200 times as many messages from roughly 530 times as many accounts, and it is headed for model training, not a research shelf.

The contract also leaves control with the buyer. The scrubber must be "acceptable to or designated by Buyer." Google commits that it "will not intentionally associate the Deidentified Data with any person or household," and it may pass the data to third parties that sign the same promise.

Why Email Users Should Care: Your Messages to Spirit Are in the Archive

If you emailed a Spirit address since 2018, your message sits in the mailboxes being sold. The schedule transfers "all emails," not just what employees wrote, so a refund complaint counts the same as a vendor quote. Spirit's customer databases are excluded. The employee mailboxes those customers wrote to are not.

Your protection there is a scrub, not an exclusion: the outside firm is supposed to strip information "reasonably capable of being associated with a consumer." Catching every name, booking reference and signature line across 100 million messages is the free text problem NIST describes. Separately, Friesner's declaration says Spirit is running its own sale process for its customer list. The asset schedule counts 13.7 million active customer email addresses, and the filings do not say what that second sale will include.

Spirit is not an isolated case. In April, Forbes reported that shuttered startups were selling Slack archives, internal email and Jira tickets to AI companies, and wind down firm SimpleClosure said it had handled about 100 such deals paying $10,000 to $100,000, as summarized by Fast Company. Spirit moves that trade into a public courtroom. The same question came up in 2025, when 23andMe's bankruptcy put its genetic database up for sale. Every email you send to a company lands in an archive the company owns. When the company fails, that archive is an asset.

What Can Former Spirit Employees and Customers Do Now?

Act before the hearing, because once the data transfers there is little recourse. EPIC's brief notes that the sale agreement disclaims third party rights, so workers cannot enforce Google's promises themselves.

1. Former employees: contact your union. AFA, ALPA, the IAM and TWU Local 570 are all in the case. AFA's Spirit page posts hearing updates.
2. Read the filings yourself. The auction notice says every public document in the case is free at dm.epiq11.com/SpiritAirlines.
3. Track the hearing date. It has slipped from August 19 to, according to Reuters, October 14.
4. Customers: use a separate address for travel bookings. If the customer list sells, a dedicated alias shows you who bought it and can be shut off.
5. Keep sensitive documents out of email to companies. Use an upload portal for IDs, medical notes or tax forms when one exists, so the file does not land in employee mailboxes.
6. Use deletion rights while a company is still operating. California residents can ask businesses to delete personal information under the CCPA, and EPIC's brief cites similar rights in Colorado and Texas.

What Happens Next?

Judge Sean H. Lane decides whether the sale goes ahead and on what terms. The case docket shows a supplemental report from the consumer privacy ombudsman filed October 5. That is the day, according to Reuters as relayed by PYMNTS, that the ombudsman recommended approval at an October 14 hearing, provided Spirit customers' personal information is excluded.

Most coverage asks whether Google can be trusted with the data. The larger issue for compliance teams is structural. The Bankruptcy Code defines personally identifiable information as data provided "in connection with obtaining a product or a service," which is customer data. Customers get an ombudsman. The 80,000 mailboxes, and the workers who filled them, get whatever the unions can win in court.

EPIC's brief warns that if employee data can be sold as an asset, employers "will be encouraged to collect as much data as possible and store it indefinitely." Compliance teams do not need to wait for Judge Lane to act on that. The asset schedule shows Spirit's employee records reaching back to 1986 and its mailboxes to 2018. A retention schedule that deletes old mail on time shrinks what any future buyer, or attacker, can take.