Google Buys Bankrupt Spirit Airlines' Data for $10 Million: 100 Million Emails Now Fuel for AI

The Auction Nobody Expected to Watch

Spirit Airlines permanently stopped flying in May 2026 after years of financial trouble triggered by COVID-19, and has been selling off assets to pay down debt ever since. Last week's bankruptcy auction drew attention for none of the usual reasons. Not the aircraft, not the catering carts. The data.

Google beat out competitor Mercor with its $10 million bid, securing a dataset of staggering scale:

• 100 million emails
• 500 million Microsoft Teams messages
• 30 million customer service call recordings
• 17 million OneDrive files
• 5 million crew schedules
• 763,000 flight records

The goal: fuel for AI models, particularly for aviation applications.

"Cleaned" Data, Unresolved Risk

Google emphasizes the data has been cleaned, with personal information removed or made unrecognizable. In Europe, that claim would face a much tougher test.

The European Data Protection Board published new guidelines in July 2026 setting strict requirements for anonymization. Data only counts as anonymous if individuals cannot be isolated, linked or inferred from the dataset. Fail even one of those three criteria and the data falls under the GDPR, with all the obligations that entails.

That bar is hard to clear with this kind of material. A specific customer inquiry, for example, is relatively easy to link back to a person. Under European rules, the Spirit dataset would likely still qualify as personal data.

What GDPR Would Demand

Selling personal data out of a bankruptcy is not a free-for-all under European law. The GDPR requires a legal basis for processing, such as consent or a legitimate interest, and in bankruptcy proceedings the trustee must demonstrate the sale meets those requirements.

There is another catch: the bankrupt company's own privacy policy must have explicitly permitted such a sale. If it did not, a consumer privacy ombudsman can block or restrict the deal.

Even within Europe, the rules are murky. In the Netherlands, the Dutch Data Protection Authority stated in 2001 that trustees may not sell personal data, then withdrew that position in 2017, leaving the question unsettled.

A Warning Shot for Europe

The Spirit deal lands as a case study in a bigger fight over strategic autonomy. Once data has been sold, regaining control over it is close to impossible.

The lessons cut two ways. For tech companies, the message is to invest in robust anonymization techniques and legal certainty before acquiring data. For the EU, the challenge is balancing innovation against protection. The new EDPB guidelines are a step in that direction, but whether they are strong enough to protect Europe's strategic interests remains untested.

The buyer's regulatory history adds an edge to the debate: Google was recently fined €890 million by the European Commission for breaching the Digital Markets Act in Search and the Play Store.

What Comes Next

The sale awaits final approval in the US, where bankruptcy courts have so far treated the data as just another asset. The harder questions arrive later: whether AI models trained on the dataset ever face European scrutiny, and whether the next bankrupt company with a large customer base sees its data auctioned the same way. The precedent, once set, will outlive Spirit Airlines by decades.