Google buys bankrupt Spirit data to train AI

Google has purchased the data of the bankrupt American airline Spirit Airlines for $10 million. The dataset includes hundreds of millions of emails, phone calls, flight records, and customer data, all anonymized to protect personal information. The goal? Fuel for AI models, particularly for aviation applications. But while the sale is nearly finalized in the US, this deal raises questions in Europe about strategic autonomy and the limits of the General Data Protection Regulation (GDPR).

An unexpected auction winner

Spirit Airlines' bankruptcy auction drew attention last week. Not because of the sale of aircraft or catering carts, but because of the data. Google won the bidding with $10 million, beating out competitor Mercor, and thereby secured a wealth of operational and customer data. The data includes 100 million emails, 500 million Microsoft Teams messages, 17 million OneDrive files, and 30 million customer service call recordings. Also among the haul are 763,000 flight records and 5 million crew schedules. Spirit permanently stopped flying in May 2026 after years of financial trouble caused by COVID-19, and has since been selling off assets to pay down debt.

Cleaned, but not risk-free

Google emphasizes that the data has been "cleaned": personal data has been removed or made unrecognizable. Still, the deal remains controversial. The European Data Protection Board (EDPB) published new guidelines in July 2026 that set strict requirements for anonymization. Data can only be considered anonymous if individuals cannot be isolated, linked, or inferred from the dataset. If even one of these criteria is not met, the data falls under the GDPR, which entails obligations. A specific customer inquiry is relatively easy to link back to a person. In Europe, then, the dataset would still fall under privacy law.

The GDPR requires a legal basis for processing personal data, such as consent or a legitimate interest. During bankruptcy proceedings, the trustee must demonstrate that the sale of data meets these requirements. Moreover, the bankrupt company's privacy policy must have explicitly permitted such a sale; if not, a consumer privacy ombudsman (CPO) can block or restrict the deal. In the Netherlands, the situation is unclear: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) stated in 2001 that trustees may not sell personal data, but withdrew that position again in 2017.

Should this be allowed in Europe too?

Google's acquisition underscores the growing demand for data for AI training. But is this kind of trade desirable?

The Spirit deal serves as a warning for European companies and governments. Once data has been sold, it's difficult to regain control over it. For tech companies, the lesson is clear: invest in robust anonymization techniques and legal certainty before acquiring data. For the EU, the challenge lies in balancing innovation with protection. The new EDPB guidelines are a step in the right direction, but practice will show whether they are sufficient to protect Europe's strategic interests.