# Spirit's data sale: the privacy review covered passengers, not employees

https://licensethedata.com/blog/spirit-data-sale-privacy-review-scope/

A court-appointed ombudsman recommended approval and stated plainly that risks to employees and third parties were outside her review. The safeguards added to the deal are the part an ordinary seller can reuse.

Published 2026-10-16. 6 minute read.

## A recommendation is a stage, not a completed sale

On October 5, 2026 the consumer privacy ombudsman in Spirit Airlines' bankruptcy filed a supplemental report recommending that the court approve the sale of Spirit's deidentified data to Google. She wrote that the parties had taken "consequential steps to protect the privacy of the personal data of the Spirit consumers", that passenger databases had been excluded from the deal, and that "the potential privacy losses or costs to consumers have been eliminated or mitigated". The filing supplements and does not supersede her earlier September 8, 2026 report.

Status as of October 16, 2026: this is a recommendation, not an order, and the sale has not closed. Google LLC was named successful bidder at $10 million in the August 14, 2026 auction notice, with Mercor.io named alternate bidder at $7.5 million. micro1 filed a notice of intent to submit a competing bid on September 3, 2026, and the report records that the court has not settled whether to consider it. A hearing listed for October 14 was moved to November 6 by a notice Spirit's counsel filed on October 9, after more than 120 lawmakers wrote to both companies on October 8 asking that former employees' information be kept out of the transaction as far as possible.

- Bid, recommendation, approval and closing are four different events. Only an entered order and a completed transfer would change the sale's status.
- The recommendation is offered "for the Court's consideration", in the report's own words, not as a decision.

Source: Consumer privacy ombudsman supplemental report, October 5, 2026, nine pages — https://document.epiq11.com/document/getdocumentbycode?docId=4619971&projectCode=SPJ&source=DM
Source: Travel Weekly: court delays hearing on Google's purchase of Spirit data, October 9, 2026 — https://www.travelweekly.com/Travel-News/Airline-News/Court-delays-hearing-on-Google-purchase-of-Spirit-data
Source: Court auction notice and asset schedule, docket 1463, August 14, 2026 — https://cdn.arstechnica.net/wp-content/uploads/2026/08/In-RE-Spirit-Aviation-Bankruptcy-Notice-of-Auction-Results-8-14-26.pdf

## The review was consumer-facing, and the report says so

The report lists the factors the ombudsman may address under Bankruptcy Code section 332: the seller's privacy policy, potential losses or gains of privacy to consumers, potential costs or benefits to consumers, and alternatives that would mitigate privacy losses or costs to consumers. In its third footnote the report states that the ombudsman "did not investigate or reach any conclusion about whether the data offered for sale or the deidentification process to be followed presents any risks to affected employees or third parties".

That carve-out matters because the records that stay in the deal are largely workplace records. The report states that corporate emails "that include employee data and possibly consumer personal data will be included in the sale", and it identifies further systems that would include employee data. Reporting on the statutory gap and the unions' objections make the same point from the other direction: the consumer privacy ombudsman is triggered by a sale of customer information, and no equivalent independent reviewer was appointed for employee records here. For an operating business, the employee and third-party lane is exactly where most of the licensable operating history sits.

- Map which records are customer, employee and third-party before agreeing a scope. Independent privacy review is usually built around the customer category.
- Ask who verifies the employee and third-party material, under which standard, and who signs that verification.
- Ask what happens if an employee, contractor or client objects after the agreement is signed.

Source: Consumer privacy ombudsman supplemental report, October 5, 2026, section I — https://document.epiq11.com/document/getdocumentbycode?docId=4619971&projectCode=SPJ&source=DM
Source: Las Vegas Sun: 121 lawmakers press Spirit and Google on employee data, October 14, 2026 — https://lasvegassun.com/news/2026/oct/14/horsford-cortez-masto-among121-lawmakers-fighting/
Source: The Airside: hearing pushed to November 6, statutory scope and review limits — https://theairside.news/en/news-spirit-google-data-sale

## The safeguards added here are the reusable part

The report describes the changes made during the review, and they read like a list a seller can ask for. Consumer transaction systems, passenger name records, refund systems, inflight purchases and WiFi sales were excluded and, in the report's words, "will not be provided to Google in any form (deidentified or otherwise)". Passenger databases were taken out "to eliminate much of the Spirit passenger PII". Unstructured material such as corporate email is deidentified by a third-party agent, and under the sale terms that agent files a certification with the court before every transfer confirming that the court-approved procedures were performed and that the transferred data is deidentified.

The deidentification commitment is tied to a published standard rather than a vendor's summary. The parties voluntarily adopted the three deidentification requirements of the California Consumer Privacy Act, and the report states the successful bid "expressly incorporates" them: reasonable measures so the data cannot be associated with a person, a public buyer commitment not to attempt reidentification, and a contractual bar on passing the data on unless the recipient makes a similar public commitment. Certification is also a closing condition, which the report puts plainly: the sale occurs, and data moves, only if and when the data is deidentified.

- Ask for a named exclusions list in writing, plus confirmation that an excluded system stays excluded.
- Ask who performs deidentification, under which named standard, and whether that party certifies each transfer to someone other than the buyer.
- Ask for a no-reidentification commitment that binds onward recipients, not just the first buyer.
- Get any safety assurance as an enforceable term attached to a named standard, not as a description of process.

Source: Consumer privacy ombudsman supplemental report, October 5, 2026, sections II.A to II.D — https://document.epiq11.com/document/getdocumentbycode?docId=4619971&projectCode=SPJ&source=DM
Source: Google Research: Our approach to protecting AI training data — https://research.google/pubs/our-approach-to-protecting-ai-training-data/
Source: The Next Web: ombudsman backs Google's $10m data deal — https://thenextweb.com/news/google-spirit-airlines-data-ombudsman-approval

## The buyer's identity changes which questions get asked

The report shows what buyer-specific diligence looks like. Mercor, the alternate bidder, reported a supply chain security incident in early 2026, and the ombudsman asks for an opportunity to research the circumstances and whether that company is an appropriate, qualified buyer if the court turns to it. micro1 proposed to deidentify the data itself instead of using an independent party, and the ombudsman asks for an opportunity to review that proposal on the same basis. Neither request is a finding against either company; both describe what would still have to be examined.

For a seller the useful conclusion is that safeguards are negotiated per counterparty and per asset. A statement that the process is safe is a claim. Who performs the work, who certifies it, who may receive the data afterwards and what a departing buyer's copy obligations are, are terms.

- Ask whether the party deidentifying your records is independent of the buyer.
- Ask for the record of any security incident and how it was closed out.
- Ask whether an independent expert would review the buyer's approach, and what that review would cover.

Source: Consumer privacy ombudsman supplemental report, October 5, 2026, section II.E — https://document.epiq11.com/document/getdocumentbycode?docId=4619971&projectCode=SPJ&source=DM
Source: The Next Web: what the ombudsman report does not cover — https://thenextweb.com/news/google-spirit-airlines-data-ombudsman-approval

## What these documents do not establish

As of October 16, 2026 there is no approval order, no closing and no payment to the seller. Whether employee material is excluded, and whether the other bids are considered, remain open. The asset schedule is described as still subject to change, though the ombudsman records an assurance that any system designated as excluded will remain excluded. The commonly quoted volumes, including roughly 100 million emails, 500 million Microsoft Teams items, 175,658 employee records and more than 3.4 million payroll records, come from filings as quoted in reporting rather than from an audit.

None of this prices your own records. It is one deidentified enterprise-data asset in one bankruptcy case, reviewed under a framework aimed at consumer personal information. Its value here is what it shows about stages, verification, exclusions and scope, not as a comparable for a single operating business.

- Treat the $10 million figure and the volume counts as reported, not verified.
- Check the docket for the current hearing date and any entered order before relying on the status.
- A bid is a proposal and a payment is money received. Do not substitute one for the other.

Source: Consumer privacy ombudsman supplemental report, October 5, 2026, sections II.A and III — https://document.epiq11.com/document/getdocumentbycode?docId=4619971&projectCode=SPJ&source=DM
Source: Republican Herald: the data sale, employee records and the November 6 hearing, October 14, 2026 — https://republicanherald.com/2026/10/14/spirit-airlines-data-sale-google/
Source: Las Vegas Sun: bid amounts, backup bidder and the employee-risk limitation — https://lasvegassun.com/news/2026/oct/14/horsford-cortez-masto-among121-lawmakers-fighting/