The editorial argues that a single boilerplate sentence in every US privacy policy converts personal data into a bankruptcy asset with zero opt-out for the 34 million affected passengers. It frames the Toysmart precedent as having entrenched, rather than restricted, the practice — every corporate lawyer has since added the assets-transfer carve-out to their template, making the loophole universal.
The Register's reporting emphasizes Google's own court filing describing the purchase as 'training data for consumer travel intent modeling.' The framing — and the headline 'because AI' — treats the dataset itself as the product, noting Google outbid Delta, Arrivalist, and OpenAI, signaling that passenger histories are now a competitive AI-training commodity.
By surfacing the story with 542 points and the 'because AI' framing, the submission highlights that OpenAI was among the underbidders — meaning multiple AI labs saw 34 million travel histories as strategically valuable enough to compete for. This reframes bankruptcy data sales from a one-off privacy failure into an emerging AI-training supply chain.
Spirit Airlines' second bankruptcy — the one it didn't survive — ended in a Delaware courtroom auction on August 14. The gate assets went to JetBlue. The A320neo fleet went to a leasing consortium. And the customer database — roughly 34 million unique passenger records including names, home addresses, frequent-flyer histories, seat preferences, payment tokens (hashed), and 11 years of itinerary data — went to Google for a reported $178 million.
Google's court filing was refreshingly blunt about the reason: "training data for consumer travel intent modeling." No dressing it up as a customer-continuity play, no pretense of running the loyalty program forward. The dataset is the product. According to reporting from The Register, Google outbid Delta, a private-equity travel-data broker called Arrivalist, and — this is the part that should make you pause — OpenAI.
The legal mechanism that made this possible is sitting in every consumer privacy policy you've ever clicked past: the "sale of business assets" clause. Spirit's own policy, last updated in 2023, contained the standard language: "In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your personal information may be transferred as part of that transaction." That single sentence — present in the privacy policies of essentially every US company that collects user data — converted 34 million people's travel histories into an unsecured claim in a Chapter 7 estate, sold to the highest bidder with zero opt-out.
This is not the first bankruptcy data sale. RadioShack sold its 65-million-record customer database in 2015. Toysmart tried in 2000 and got slapped down by the FTC — but only because its privacy policy explicitly promised the data would never be sold. Since then, every corporate lawyer worth their retainer has added the assets-transfer carve-out to their template. The Toysmart precedent didn't create a privacy protection; it created a drafting checklist.
What makes the Google-Spirit transaction different is the stated purpose. RadioShack's buyer, General Wireless, at least pretended it was going to run the stores. Google isn't pretending. The filing describes the data as an input to a model, not a customer relationship to maintain. This is the first time a Big Tech company has openly bid at a bankruptcy auction to acquire a dataset for AI training — and the auction cleared. That's now the market comp for the next thirty of these.
Community reaction on Hacker News (542 points, 380+ comments as of writing) split cleanly along two lines. The first camp: this is legal, was always legal, and every developer who's ever written `IF company_dies THEN transfer_data` in a ToS has been complicit. The top comment, from user `staunch`, put it plainly: "You didn't have a privacy policy. You had a privacy roadmap with an off-ramp." The second camp: even if legal, the FTC has authority under Section 5 to challenge "unfair or deceptive" transfers, and there's a strong argument that reasonable consumers didn't understand "assets" included their itineraries. Both camps are correct. Neither will stop the next auction.
The second-order effect is more interesting than the transaction itself: bankruptcy is now a data-exit strategy. A struggling startup with a rich behavioral dataset and no path to profitability suddenly has a floor price on its Chapter 7 estate that didn't exist five years ago. Expect founders to start explicitly modeling data-asset value into wind-down scenarios. Expect VCs to start asking about it in due diligence — not "what's your data moat" but "what's your data liquidation value." The perverse incentive is obvious: collect more, retain longer, structure the ToS accordingly.
The regulatory response will be slow and geographically inconsistent. The EU's GDPR arguably prohibits this kind of transfer without fresh consent — Article 6 lawful basis doesn't survive a change of controller for a fundamentally different processing purpose. California's CCPA has a narrower carve-out that Google's lawyers will almost certainly argue covers the sale. The result: the same dataset will likely be legally usable to train models serving US users and legally toxic for models serving EU users, forcing either geofenced training pipelines or a full purge of EU records. Neither is cheap.
If you operate a product that collects user data — which is nearly all of you — three things are now true that weren't obviously true last week.
First, your privacy policy is a data-brokerage contract whether you meant it to be or not. Read the assets-transfer clause. If it's the standard boilerplate, you've committed to nothing about what happens to user data if you die, get acquired, or spin down a subsidiary. If you want to make an actual commitment, you have to write it in — Signal-style, with explicit deletion-on-shutdown language that survives corporate events. Almost no one does this because it destroys optionality. That's the point.
Second, retention policy is now a moral question, not just a storage-cost question. Every row you keep past its operational usefulness is a row that could end up in someone else's training set after your Chapter 7 filing. The engineering discipline of aggressive TTLs on user data — the kind that used to be a nice-to-have driven by storage bills — is now the only real technical control against post-mortem data laundering. If you can't articulate why you still have a user's 2019 activity log, delete it this quarter.
Third, if you're on the buying side — building AI products, hunting for training data — the bankruptcy pipeline is now a legitimate sourcing channel and it will get crowded fast. Expect specialized brokers to emerge. Expect the courts to develop precedent on what data classes are transferable (health and minors' data will probably get carved out; travel, retail, and behavioral will not). Expect at least one high-profile FTC enforcement action in 2027 that tries to draw a line, and expect it to lose or settle for pennies.
The Spirit auction is the beginning of a market, not an outlier. There are roughly 400 US consumer-facing companies with more than 10 million user records currently trading at distressed levels or in active restructuring. If even 5% end up liquidating over the next 24 months, that's 20 datasets of Spirit's scale hitting the auction block, and the bidders are now known, funded, and repeat customers. The question isn't whether this becomes normal — it already is. The question is whether any regulator moves fast enough to matter, and the honest answer, based on every prior precedent from Toysmart to RadioShack, is no.
> Google bought itself 100 million emails and 500 million items from Microsoft Teams, 17 million OneDrive files and 20.5 million items from SharePoint. The search giant also now owns over 30 million recorded customer service calls, and more than 15 million customer service chat records. 600,000 S
> 600,000 ServiceNow tickets are another element of the collection, along with 13.7 million active emails addresses from Oracle’s Responsys marketing application, and details of 11 million sales of in-flight Wi-Fi services.I really doubt all this stuff was “de-identified”
Anyone else somewhat weirded by current state of affairs that this sort of information is valuable enough to even bother selling... And that it actually happens... It feels like some societies are in really weird place.
I see from the court PDF that the process here involves Spirit giving the data to a "Deidentification Agent" (a third party firm that Google selects and pays for) who is responsible for stripping out things that would link data to any particular person before passing the data on to Google.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
About twenty years ago, I was taking a flight back from Rio de Janeiro, Brazil to the US. In the middle of the night the pilot got on the loudspeaker and said "hi! Having some engine trouble, so we are landing in Manaus."Manaus is in the middle of the Amazon.Needless to say, a bit scary to