The editorial argues this deal exposes how the boilerplate 'we may transfer your information as part of a merger or sale of assets' clause — written for the pre-LLM era when buyers were peer companies inheriting a customer relationship — now enables foundation model operators to legally acquire structured, longitudinal PII from defunct firms. It frames bankrupt-company data as a newly recognized AI asset class that should reshape how privacy policies are read.
The editorial notes Google already dominates travel-intent signals via Search, Maps, Flights, and Android, but argues Spirit's operational database is a different asset class — structured, longitudinal, and tied to bookings that actually happened rather than searches that may or may not have converted. That distinction explains why Google outbid at auction and stated AI training, not customer acquisition, as its rationale.
Submitted The Register's story under the framing 'Google buys crashed airline Spirit's data at auction, because AI,' surfacing the point that the acquisition's sole justification is model training rather than any airline-adjacent business use. The 346-point score signals broad agreement that this rationale is itself the newsworthy angle.
Google was the winning bidder for Spirit Airlines' customer data trove at the airline's post-bankruptcy asset auction, according to a report in The Register on August 18. The dataset — reportedly covering years of passenger records, itineraries, loyalty program profiles, and behavioral telemetry from Spirit's mobile app — was one of the more valuable line items on the liquidator's manifest, ranked alongside gate slots and aircraft.
Google's stated rationale, per the filing, was AI training — not customer acquisition, not a loyalty tie-in, not a rewards partnership. The company already sits on more travel-intent data than almost any entity on earth via Search, Maps, Flights, and Android location history. Buying a defunct carrier's raw operational database is a different category of asset entirely: it's structured, longitudinal, and tied to real bookings that actually happened rather than searches that may or may not have converted.
Spirit filed for Chapter 11 in late 2024, restructured, then collapsed into Chapter 7 liquidation earlier this year after a second failed merger attempt. Its passenger data — everything from the last decade of bookings to app-side clickstreams — became a saleable asset the moment the trustee took over. There is no federal law that treats airline PII as anything other than inventory in a liquidation.
This is the clearest signal yet that bankrupt-company data is now a recognized AI asset class, and it should reshape how you read every privacy policy your users click through. The mechanism is a clause every major carrier includes and almost no passenger reads: 'we may transfer your information as part of a merger, acquisition, or sale of assets.' That clause was written for the pre-LLM era, when the buyer was almost always another company in the same industry inheriting the same customer relationship. Google is not another airline. It is a foundation model operator that will use your booking history to train systems that predict, summarize, and act on behalf of other people.
The FTC has, in past bankruptcies, occasionally intervened to strip out PII before an asset sale — the RadioShack case in 2015 being the canonical example, where the agency negotiated destruction of most consumer data before it could change hands. There is no public indication of comparable intervention here. That silence is the story. If the FTC's revealed preference in 2026 is that bankrupt-carrier PII can flow directly into a foundation model training pipeline, every other data broker just got a green light.
Community reaction on Hacker News (346 points at time of writing) skewed toward grim resignation rather than outrage. The top comments zeroed in on a specific technical point: even if Google formally de-identifies the records, high-cardinality itinerary data is trivially re-identifiable. If someone flew Spirit from Fort Lauderdale to Medellín on a Tuesday in March 2023, that itinerary plus rough demographic priors is often enough to pin a single individual. Aggregation into a model doesn't erase this; it just moves the identifiability from the query interface to the training weights, where nobody can audit it.
There's also the second-order question of what a general-purpose model actually learns from raw airline data. Contrary to the framing in Google's filing, the interesting signal here probably isn't 'people who fly Spirit tend to X.' It's the operational layer: how cancellations propagate, how fare classes correlate with rebooking behavior, how ancillary fee acceptance rates vary by route. That's the sort of structured, real-world business data that current models are notably bad at, and it's exactly the gap a bankruptcy-sourced dataset fills cheaply. Expect more of these purchases, not fewer.
If you operate a product that stores user PII, the operational takeaway is unambiguous: your privacy policy's 'sale of assets' clause is now effectively a training-data license with a delay fuse. Any startup that fails and liquidates hands its users' data to whoever bids highest — and the highest bidder for the foreseeable future is going to be an AI lab or a company adjacent to one. Users who assumed their data would die with the company are wrong, and telling them otherwise in your policy without carveouts is arguably misleading.
The concrete engineering response is to build data-minimization into the schema, not just the retention policy. Fields that are never queried for product functionality — precise geolocation, full IP history, device fingerprint deltas — should not be persisted at all past their operational window. Cryptographic separation helps: encrypt PII columns with keys held in a KMS that is contractually and technically distinct from the primary database, so that a liquidator selling 'the database' cannot in practice deliver decrypted records without a separate legal act. A 'data will be destroyed on wind-down' commitment in your terms is now a real differentiator, especially for B2B customers whose own compliance obligations flow through you.
For consumers, the practical hygiene is to treat any account with a struggling company as radioactive on a rolling basis. Delete loyalty accounts at carriers you no longer use. Rotate emails on services you suspect are near-death. GDPR erasure requests filed before Chapter 7 stick; requests filed after are legally ambiguous, because the entity you filed against no longer exists in the same form. The window closes fast.
The Spirit deal is not the last of these — it's the first one to be publicly framed as an AI purchase rather than a customer-acquisition play. Expect a cottage industry of bankruptcy-data brokers to formalize in the next 12 months, and expect at least one state attorney general to try to build a case around consent scope. The federal path is harder: the FTC's authority here is narrow, and the underlying contract clauses have been enforceable for two decades. Regulation, if it comes, will more likely come from the EU treating bankruptcy PII transfers as a new processing purpose that requires fresh consent under GDPR — a position that could effectively firewall EU passenger data from these auctions and leave the US market as the primary training-data supply. The uncomfortable version of this story is that discount airlines just became a strategic input to frontier models, and nobody asked their passengers.
> Google bought itself 100 million emails and 500 million items from Microsoft Teams, 17 million OneDrive files and 20.5 million items from SharePoint. The search giant also now owns over 30 million recorded customer service calls, and more than 15 million customer service chat records. 600,000 S
> 600,000 ServiceNow tickets are another element of the collection, along with 13.7 million active emails addresses from Oracle’s Responsys marketing application, and details of 11 million sales of in-flight Wi-Fi services.I really doubt all this stuff was “de-identified”
Anyone else somewhat weirded by current state of affairs that this sort of information is valuable enough to even bother selling... And that it actually happens... It feels like some societies are in really weird place.
I see from the court PDF that the process here involves Spirit giving the data to a "Deidentification Agent" (a third party firm that Google selects and pays for) who is responsible for stripping out things that would link data to any particular person before passing the data on to Google.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
About twenty years ago, I was taking a flight back from Rio de Janeiro, Brazil to the US. In the middle of the night the pilot got on the loudspeaker and said "hi! Having some engine trouble, so we are landing in Manaus."Manaus is in the middle of the Amazon.Needless to say, a bit scary to