Google’s $10M Spirit Data Auction: What the Docket Actually Includes

The Register’s headline is true. Several of its counts are not. Google LLC won a $10 million bankruptcy auction on August 14, 2026 for Spirit Aviation’s Deidentified Data. The underbidder, Mercor.io Corporation, was $7.5 million, not a rounding error. A sale hearing is set for August 19 in the Southern District of New York (Case No. 25-11897, notice ECF 1463). Until Judge Sean H. Lane signs an order, Google has a winning bid, not a hard drive.

What the docket actually does is more interesting than the puns: it is a two-column asset schedule. Customer call recordings, chat sessions, and 13.7 million marketing email addresses sit in Not Included. One hundred million work emails, five hundred million Teams items, yield-management tables, and ~30 million lines of Spirit-owned code sit in Included. If you only read the viral summary, you were trained on the wrong mix.

The primary source is the auction-results notice and bill of sale (also on Epiq’s Spirit docket). Google told reporters the lot “can be helpful in improving our products and AI models,” and that it is not buying customer or credit-card information.

TL;DR

Included vs Not Included (the table The Register flattened)

Figures below are from the Assets Schedule attached to Google’s form bill of sale. “Not Included” is not a rumor; it is a column.

That last block is exactly what most passengers worry about — and it is not the Google lot. The first block is what employees, contractors, and anyone who mailed spirit.com should worry about.

Wi-Fi codes and deidentified PNRs are still in. Those are operational traces, not a CRM dump, but they are also the kind of high-cardinality leftovers re-identification papers love.

What people are asking

How is this even legal?

US bankruptcy sales under § 363 transfer estate assets free and clear of most claims, after notice and a hearing. Spirit’s bill of sale is explicit that Personal Data is carved out of the Assets, then everything else is run through a Deidentification Agent before Google takes delivery. Google pays that agent; the $10 million purchase price is not reduced by scrubbing costs.

This is not GDPR-by-default. It is New York bankruptcy plus a contractual CCPA deidentification standard “regardless of whether such statute does, or does not, apply.” If you wanted a European-style purpose limitation (data collected for flying cannot later train Gemini), this docket is the counterexample.

Does “deidentified” mean I cannot be found?

The contract’s own language is the tell. Deidentification must remove or transform elements so the data cannot reasonably be associated with a particular consumer, while preserving referential integrity across the data set. Join keys stay. That is how you still train on “this ticket, this delay, this refund, this aircraft” as one trajectory.

Google also publicly commits (i) to keep the data deidentified and (ii) not to intentionally associate it with a person or household. It may on-sell Deidentified Data to others who sign the same clause. “Not intentionally” is not “cannot.” Hacker News’s first long comment was stylometry: writing style as a fingerprint even after names are stripped. That concern is technically real. It is also the class of risk the contract pushes onto Google’s promise, not onto a zero-knowledge proof.

Yahoo’s old “anonymized” search logs and medical de-identification failures are the historical prior. This filing cites CCPA and, for health-like fields, 45 C.F.R. § 164.514. Certification is to Google’s reasonable satisfaction, not to an independent public auditor named in the notice.

Why buy a famously messy airline?

Because training data for how work actually happens is scarce. Public web text is blogs and docs. Spirit’s Included set is IRROPs recommendations (3.0 billion rows in ITS), ServiceNow, sap-ish finance, CrewTrac pairings, git review threads, and a decade of internal email. That is closer to an enterprise simulator than to a FAQ scrape.

Same week, Razorpay Vulcan is the living-company version of this idea: pretrain on proprietary operational events. Google is buying the corpse version — one org’s full trace, once, AS IS, no warranty of accuracy (Section 7 of the bill of sale is a classic “WHERE IS / WITH ALL FAULTS” dump).

The ~30 million lines of code, 372,585 commits, and PR comment threads are a private cousin of The Stack: not 5 trillion open tokens, but airline-specific software with the human review text still attached.

Will Gemini start denying my boarding the way Spirit did?

Not from this lot in any simple “upload PNR → refuse you” way: customer profiles are Not Included, and Google promised not to buy credit-card files. The more plausible product use is domain post-training — customer-ops agents, disruption recovery, pricing, and code models that have seen real MRO and Navitaire-shaped schemas.

If a future Gemini answer ever regurgitates a unique complaint thread from a Spirit inbox, that is the SNAFU The Register is waiting for. The legal theory will be “deidentified + no intentional re-ID,” not “we never ingested workplace mail.”

What this means if you build with AI

1. Bankruptcy is now a data market. When a company dies, collaboration suites and git become inventory. If you are designing a data-retention policy, add “363 sale to a frontier lab” next to “e-discovery” and “subpoena.”

2. Read the Included column. Viral coverage will keep flattening schedules. For this story the correction is the product: calls out, emails in.

3. Referential integrity is the training feature. A pile of isolated, shuffled sentences is weak. Linked tickets → aircraft → crew pairing → refund is how you get long-horizon trajectories for agents. The contract requires keeping those links.

4. Deidentification is a vendor you do not pick. Spirit delivers to an agent acceptable to or designated by Google. Builders evaluating “safe to train” third-party dumps should ask who paid the scrubber.

5. License tables still matter elsewhere. Getty’s OpenAI deal is the consent-and-check path. This is the estate-sale path. Both feed models. Only one looks like a marketplace with a price list.

6. Keep personal compute off the corporate tenant. The bill of sale’s M365 clause is to transfer email, OneDrive, SharePoint, and Teams in the native Microsoft 365 environment. That is the whole corpus, then scrubbed — not a curated export of “non-personal” folders.

Honest limitations

• Hearing not held as of this writing. Terms can still move.
• Schedule OCR from the PDF is messy (typos like “Reponsys,” “Sharpoint”). Volumes are Spirit’s own counts.
• Privileged material is carved out with a clawback; plenty of “legal memos” are still listed as Included — expect fights at the edges.
• Spirit may still sell a customer list (traveler spend by year) to hospitality/travel buyers. That is a different lot than Google’s.
• We have not seen the Deidentification Agent’s name, methods, or error rates.
• Google can transfer Deidentified Data onward under contract. Downstream use will not all be public.

Related on explainx.ai

• Hanover Institute — retrieval-time GEO farms vs buying a training dump
• Razorpay Vulcan — live payments foundation model — operational pretraining while the company still exists
• The Stack v3 — 5T open code tokens — the public-code analogue to Spirit’s 30M private LOC
• Getty × OpenAI — licensing instead of a fire sale
• Claude shared chats indexed by Google — another Google-shaped privacy surprise, different mechanism
• Cloudflare: AI crawlers vs human traffic
• EU AI Act after enforcement — GPAI training-data duties this US sale does not have to meet
• How AI text watermarking works — stylometry is the other direction of “who wrote this”
• Deidentification · Training data · PII

Sources

• S.D.N.Y. notice of auction results + Google/Mercor bills of sale (ECF 1463, Aug 14, 2026)
• Spirit Airlines bankruptcy claims / docket portal (Epiq)
• The Register — viral write-up this post fact-checks
• Contemporaneous reporting: Bloomberg Law, Skift, Business Insider, Axios (Google spokesperson: internal data and custom software, not customer or credit-card files)

Auction results and asset volumes are from the August 14, 2026 court notice and attached form agreements. The sale remains subject to Bankruptcy Court approval at the August 19, 2026 hearing. Deidentification quality cannot be verified from the docket alone. This is not legal advice and is not affiliated with Google, Spirit, or Mercor.