The Debtors conducted a virtual auction for the Deidentified Data on Friday, August 14, 2026 and filed a notice of the results the same day. Google LLC was selected as Successful Bidder with total consideration of $10,000,000, and Mercor.io Corporation was designated Alternate Bidder with total consideration of $7,500,000 [Dkt. 1463].

Three of the bids received after the Deidentified Data Final Bid Deadline were designated Qualified Bids. The auction commenced by remote teleconference, was moderated by Davis Polk and PJT Partners, and lasted approximately two and a half hours [Dkt. 1470]. The consumer privacy ombudsman's report dates the auction to August 13, 2026 [Dkt. 1581]; the auction results notice and the supporting declaration both state August 14, 2026.

Google's opening bid was $5 million in cash and provided for a third-party deidentification process for which the buyer would bear the cost. Mercor.io submitted the first overbid, offering either $5.2 million using Google's form bill of sale or $7 million if the terms allowed it to complete the deidentification process with its own tools. The Debtors determined that $5.2 million "was the highest bid for that round despite the lower price." Mercor.io also offered $10 million subject to an in-house rather than third-party deidentification process; the Debtors designated its $7.5 million bid as the Alternate Bid [Dkt. 1470].

The declaration states that the Debtors considered "not only economic factors, but also non-economic factors, such as whether the sale would provide for a documented and acceptable deidentification process," and that "given various privacy laws and other process considerations, these noneconomic factors may be outcome-determinative" [Dkt. 1470]. It further states that one initial bid requested certain customer list information, and that by the first round of the auction the most competitive bidders had agreed to bid on an asset schedule that expressly excluded personally identifiable information. The customer list is subject to a separate marketing process, with approval to be sought at a future hearing.

Sources: Notice of Auction Results [Dkt. 1463]; micro1 Notice of Intent [Dkt. 1556]; objections at [Dkt. 1489], [Dkt. 1508], [Dkt. 1521], [Dkt. 1538], [Dkt. 1539], [Dkt. 1558].

The ombudsman's report states that the Debtors divided their digital assets into three groups: intellectual property, personal data, and deidentified data. The August auction covered the third group, described in the report as enterprise data including deidentified data pertaining to "approximately 190 million airline flights taken by Spirit passengers." The report states that a subsequent auction to sell the personal data of the 97.5 million passengers will be conducted at a later date [Dkt. 1581].

The asset schedule attached to the auction results notice directs the Debtors to "[r]etain and transfer all emails, OneDrive, SharePoint, and Teams data within the native Microsoft 365 environment." The Association of Flight Attendants states the schedule marks as included approximately 100 million emails across 80,000 email accounts, 17,082,644 OneDrive items, 20,577,677 SharePoint items and 500,000,000 Teams items, together with 175,658 employee records dating from August 1986, 3,426,618 payroll records and 148,018 employee tax forms from June 2016, 1,092,000 time card records from December 2012, Crew Base information for 4,600 crew, and 5,014,676 crew pairings from January 2021 [Dkt. 1489].

Sources: Consumer Privacy Ombudsman Report [Dkt. 1581]; AFA-CWA Limited Objection [Dkt. 1489]; ALPA Limited Objection [Dkt. 1558]; Google Preliminary Response [Dkt. 1594].

Counsel for Google advised the ombudsman that the deidentified data "will be used for the training of artificial intelligence (AI) models" [Dkt. 1581]. Springshot's objection quotes a Google spokesperson on August 17: "We acquired part of an enterprise dataset from Spirit Airlines, which can be helpful in improving our products and AI models" [Dkt. 1508].

The Debtors filed a proposed sale order on August 17, 2026 [Dkt. 1469]. The seller is Spirit Airlines, LLC. The order recites that the Debtors "received three Qualified Bids" and would, if entered, find that Spirit "has satisfied the requirements of section 363(b)(1)(A) of the Bankruptcy Code," transfer the assets free and clear under section 363(f) with liens attaching to proceeds in the same order of priority, deem lienholders who did not timely object to have consented, find that "[t]he Successful Bidder acted in good faith as provided in section 363(m)," permanently enjoin successor liability, de facto merger and substantial continuity claims, and provide that objections not withdrawn, waived or settled "are hereby denied and overruled on the merits."

Paragraph 12 waives "[a]ny Bankruptcy Rule or Local Rule that might otherwise delay the effectiveness of this Order," which is to be effective and enforceable immediately upon entry. Rules 6004(h) and 6006(d) are not named. Paragraph 11 provides that if the transaction with Google is not consummated, the Debtors may accept the Alternate Bid on notice, and Mercor.io is then deemed the Successful Bidder.

Two provisions address the nature of the asset. A recital states that the sale "is not intended by the Debtors and the Successful Bidder to be a sale of Personal Data (as defined in the Sale Agreement)." Paragraph 16 provides that "the Buyer may direct the Debtors to deliver the Deidentified Data to one or more Deidentification Agents to Deidentify, prepare, transform and aggregate the Deidentified Data for further delivery to the Buyer."

The proposed order runs to eighteen decretal paragraphs. It contains no re-identification prohibition, no restriction on the buyer's use of the data, no certification requirement running to the Court, and no reporting obligation. The privacy terms of the transaction appear in the Sale Agreement, which is a bill of sale between Spirit Airlines, LLC and Google LLC.

The Court so-ordered a stipulation directing the United States Trustee to appoint a consumer privacy ombudsman on July 15, 2026 [Dkt. 1332]. The United States Trustee appointed Lucy L. Thomson on July 17 [Dkt. 1350], and the Court approved the appointment on July 23 "pursuant to 11 U.S.C. § 332 and Federal Rule of Bankruptcy Procedure 6004" [Dkt. 1380].

On August 12 the ombudsman requested an extension of her report deadline to August 19, 2026. The request states that her appointment was approved "only 21 business days before the sale hearing scheduled for August 19, 2026," that she "gained access to the Spirit Data Room on August 11, 2026," that the Debtors were conducting two auctions that week and had not yet announced the successful bidders, and that the governing order required any CPO report at least seven days before the sale hearing [Dkt. 1446]. The report was filed on September 8 [Dkt. 1581].

The privacy policy

Spirit's privacy policy was effective December 22, 2022 and last updated January 14, 2026. Its sharing section provides that if another company acquires or plans to acquire the company, business or assets, Spirit "will also share information with that company, including at the negotiation stage," and separately states, "We do not sell personal information." The Debtors rely on the first provision. The report states that "the meaning of the sentence is not entirely clear," that it "does not address the sale of personal data or specify in any way what information is to be 'shared,'" and that "[w]hen read in the context of 'including the negotiation stage,' a reasonable interpretation of the sentence does not appear to authorize the sharing (or sale) of all the company's personal data." The report further states that the policy "does not contemplate the transfer of the personal consumer data or e-mails of Spirit consumers to a technology company for the development and/or training of AI models" [Dkt. 1581].

The deidentification standard

The report states that the Debtors and the successful bidder voluntarily agreed to follow the deidentification standard in the California Consumer Privacy Act, Cal. Civ. Code § 1798.140(m), that the successful bid "expressly incorporates the three requirements set forth under that standard," and that it "will require an independent third party to conduct the deidentification based upon industry standards and practice." The report describes these as "good first steps" and states that "[t]he process for deidentification the Debtors have adopted is thoughtful and designed to meet the latest professional standards available" [Dkt. 1581].

The report cites regulatory and published sources on re-identification risk. It states that the Department of Justice's Data Security Program does not exclude anonymized, pseudonymized or deidentified data, that the final rule found advances in technology increasingly enable re-identification, and that the Department agreed the HIPAA de-identification standard no longer protects individuals. It quotes the Department's statement that "[o]pen-source reporting has repeatedly raised concern[s] that supposedly anonymized data is rarely, if ever, truly anonymous." It cites NIST NISTIR 8053, a July 2026 Gartner publication on AI-generated inferences, the U.S.-EU PNR Agreement, and Ligue des droits humains v. Conseil des ministres, Case C-817/19 (21 June 2022). The report states twice that "technology has far outpaced the law."

The report also states that the Federal Trade Commission Act excludes air carriers from that agency's jurisdiction under 15 U.S.C. § 45(a)(2), so Spirit is covered by requirements promulgated by the Department of Transportation; that "[t]here is no duty for a company to report to a federal or state regulator or affected individual if deidentified personal data has been reidentified"; and that "[t]here is no external way to verify if a private entity has privately deidentified 'anonymized' data."

The report identifies eight systems among the enterprise data categories that "had multiple processing purposes, some of which may have involved the processing of personal data," notes that some databases contain identity-related information dating back to 2018, and states that of those eight, the flight reservations database and the Revenue Transactions / PNR Data "currently contain voluminous amounts of personal data" for more than 97 million passengers.

Recommendations

The report does not recommend denial of the sale and does not affirmatively recommend approval. Its formulation is conditional: "To approve this sale, the CPO recommends that the Court adopt the proposed conditions to be provided as Attachment A to this CPO Report." Five condition categories are listed. The report states that "[t]he final list of recommended conditions will be filed promptly"; Attachment A is not part of the 23-page filing.

Source: Consumer Privacy Ombudsman Report to the Court [Dkt. 1581] at 4, 5, 13, 14, 17, 21, 22.

On children's data, the report states that "the COPPA rules do not apply to Spirit because the company collects personal data about children, not from children, nor do the rules apply to deidentified data," that the FTC updated COPPA effective April 22, 2026 to require "distinct, standalone, verifiable parental consent explicitly for AI model training or sharing data with third-party AI vendors," and that "[t]he risk of reidentification is particularly problematic when the deidentified data pertains to children" [Dkt. 1581].

A footnote records that Mercor.io "experienced a supply chain security incident" in early 2026 and that if the Court decides to consider that company as the successful bidder, the ombudsman requests an opportunity to conduct further research into the circumstances of the breach. The same footnote records micro1's notice of intent to submit a competing bid.

Google LLC appeared through Cleary Gottlieb Steen & Hamilton LLP on September 9 and filed a preliminary response the same day [Dkt. 1594]. The response states that the ombudsman's role is to advise the Court where a debtor seeks to sell the personally identifiable information of consumers, citing 11 U.S.C. § 363(b)(1)(B) as "confining the role of a consumer privacy ombudsman only to a sale of 'personally identifiable information'" and 11 U.S.C. § 332(a) to (b), and that "the proposed sale of Deidentified Data is not, and never has been, a sale of Consumer Data."

The response states that databases the Debtors represented to Google as primarily containing consumer data "are completely outside the scope of the transaction, such that they will not be provided to Google in any form, even deidentified form." Any incidental consumer data within in-scope databases is to be deidentified by an independent third-party agent before transfer; Google bears the cost of that agent, which is "an independent party selected by the Debtors." Certified completion of deidentification "is, and always has been, a closing condition under the Sale Agreement," citing section 3(c).

The response discloses that "prior to the filing of the CPO Report, Google agreed to exclude from the scope of the transaction additional databases that the Ombudsman considered may disproportionately contain Consumer Data," identified as "the PNR/Transaction data and the Refunds, Inflight/Onboard Purchases, Timecard Information and WiFi Sales datasets." Google states this "was not an offer to 'narrow the types of personal data items to be included in the sale to reduce the likelihood that the data can be reidentified'" but an exclusion of those datasets from the transaction. Five of the eight systems the ombudsman identified as possibly involving the processing of personal data are among the removed datasets. The docket reflects no change to the $10,000,000 purchase price.

Google states that it "intends to supplement this Preliminary Response prior to the hearing" and "intends to respond to such objections at a later date prior to the hearing to approve the sale." Neither filing appeared on the docket through September 11.

Six objections and joinders directed at the deidentified data sale were filed between August 18 and September 4, 2026. Each states that it does not seek to unwind the auction or reduce the purchase price. AFA states it "does not seek to disrupt the Debtors' sale process, to unwind the Auction, or to prevent the estates from monetizing data assets"; Springshot states it "does not seek to scuttle any sale"; IAE states it "does not oppose the Data Sale in its entirety"; ALPA states it "does not seek to bar the sale of assets of the estate."

Case docket: In re Spirit Aviation Holdings, Inc., No. 25-11897 (Bankr. S.D.N.Y.).

The employee confidentiality filings

AFA states that the Sale Agreement applies "a single content-based screen: the removal or transformation of data elements that would permit the information to be linked to a consumer," that "[d]eidentification addresses whether a record can be traced to a named individual" and "does not address whether the contents of the record are confidential," and that "[t]he privacy architecture of this transaction is consumer-facing; its payload is disproportionately employee-facing." It states that the agreement "not only omits an employee-confidentiality screen, but it functionally forecloses one" [Dkt. 1489].

AFA relies on 11 U.S.C. § 107(b)(1), which it says protects confidential commercial information without regard to identifiability, citing Video Software Dealers Ass'n v. Orion Pictures Corp. (In re Orion Pictures Corp.), 21 F.3d 24, 27-28 (2d Cir. 1994). It states expressly that "AFA does not contend that section 363(b)(1) is triggered here," and cites sections 101(41A), 332 and 363(b)(1) to describe the Code's consumer-directed privacy provisions. It cites Comm. of Equity Sec. Holders v. Lionel Corp. (In re Lionel Corp.), 722 F.2d 1063, 1071 (2d Cir. 1983) for the business justification standard under section 363(b)(1), and sections 105(a) and 363(e) for the proposition that "[t]he same authority that permits approval permits approval on terms."

AFA's alternative relief asks for a review and segregation protocol directed at confidential employee and labor-related information rather than reliance solely on the removal of consumer identifiers, reasonable measures for employee email, Teams, OneDrive and SharePoint content, a prohibition on using the assets to "analyze, profile, evaluate, score, or draw conclusions regarding any individual Spirit flight attendant or any identifiable group or subgroup," and application of the same restrictions to onward transfers under section 1(c), with notice to AFA of the categories transferred. It states that "[n]one of these conditions requires the Debtors to forgo consideration, to reopen the Auction, or to disturb the Successful Bid," and that deidentification has not yet occurred, the protocol remains to be designed, and the buyer already bears its cost without a reduction in the purchase price.

The estate property filings

Springshot states that a threshold determination in any section 363 sale is whether the property is property of the estate, and that section 10 of its Master Software as a Service Agreement with Spirit Airlines, Inc., dated April 1, 2022, gives it ownership of "any data or information generated by the Service or Software," with Spirit holding "a non-transferable and limited right to use." It states that deidentification does not preserve the value of its ownership because that value "resides in the aggregated operational sequencing for modeling purposes, and the proprietary organization and analysis of that data that is output by Springshot's platform," and that a forensic process would be necessary to identify and segregate its intellectual property from Spirit's operational data. It states that Google "has recently announced its desire to operationalize its own AI platform for airline operations, placing it in direct competition with Springshot," citing an announced five-year partnership between Google and Ryanair [Dkt. 1508].

IAE identifies agreements with the Debtors including five it lists by name, the earliest dated October 1, 2013, states that they are governed by New York law and each contains a confidentiality provision, and offers them for in camera review rather than filing them. It states that the IAE Proprietary Information "is not property of the Debtors' bankruptcy estate and [is] not available for the Debtors to transfer to Google pursuant to Section 363(b)(1)," that deidentification is insufficient because copies, modifications and derivatives appear in internal communications, and that "[g]iven the liquidation of the Debtors' businesses, IAE would have no meaningful remedy from the Debtors for such breach of the confidentiality provisions" [Dkt. 1538].

Several objectors address the same two provisions of the Sale Agreement. Section 1(a)(ii) measures deidentification by whether data can be associated with, used to infer information about, or linked to "a particular consumer." Section 3(c) requires the deidentification agent to work "while preserving referential integrity across the data set."

ALPA states that it has represented Spirit pilots since 1996 and that the collective bargaining agreement approved by the Court on December 29, 2025 "remains in full force and effect under Section 1113(f) of the Code as it has not been rejected under Section 1113" [Dkt. 1558].

The objection identifies three voluntary safety programs whose data it says falls within the operations and team member categories of the asset schedule: the Aviation Safety Action Program, Flight Operations Quality Assurance, and Line Operations Safety Audit. It cites 49 U.S.C. § 40123, which protects voluntarily provided safety and security information from disclosure. It states that the FOQA letter of agreement at paragraph C.4 prohibits disclosure of FOQA program information whether identified or deidentified to "any third party except appropriate government agencies," and that at paragraph B.4 disclosure of crew member identity is cause for ALPA to withdraw its participation and further cause for nullification of the agreement, immediate termination of the FOQA program, and destruction of all data.

ALPA cites FAA Order 8000.82 for the requirement that each ASAP report "must contain sufficiently detailed information about a safety event so that it can be identified by a third party," and gives as an example a flight crewmember report of a deviation from an air traffic control clearance, which would include the date, time, place, altitude, flight number and ATC frequency. Its illustration is a pilot's ASAP report of an improper rate of descent on landing: even if deidentified, it states, "the identity of the pilot(s) involved could easily be determined by examining the supporting information," which "could be expected to have been saved in multiple data sets subject to the Sale Agreement (e.g., email, Teams or SharePoint) and if not found there, included in flight records and pairing information."

ALPA states that because the Sale Agreement requires that referential integrity across the acquired data sets be preserved, "it is almost certain that individual pilots and others will be identifiable from the data." It states that disclosure "can be expected to chill voluntary compliance by pilots across the industry as it becomes known that such data can be sold to third parties with no expertise or interest in aviation safety and presumably included in data bases accessible by the public using artificial intelligence software." It reports that it has engaged in discussions with Spirit and that if those discussions have not concluded, "the Court should consider a further adjournment of the hearing."

On September 3, 2026, micro1 Inc. filed a notice of intent to submit a competing and superior bid [Dkt. 1556]. The notice states a purchase price of $12,500,000 payable entirely in cash from cash on hand, "no financing contingency, no board or investment-committee consent condition," and delivery of proof of funds concurrently with execution. It describes the price as a $2,500,000 or 25 percent premium over the Successful Bid and a $5,000,000 premium over the Alternate Bid.

micro1 describes itself as a Delaware corporation operating "a human-data and intelligence platform for AI training" that "has closed more than fifty data transactions in the last forty-five days," and states that deidentification is an in-house function for it rather than a function outsourced to a third-party Deidentification Agent. It states that it will bear all deidentification costs under section 1(a)(iii) of the Sale Agreement with no price reduction.

The notice offers a set of covenants "to be incorporated as findings and decretal provisions in the Sale Order." They comprise exclusion of disciplinary, investigatory, grievance and arbitration, medical, leave and accommodation, EEO, and union or collective bargaining material, with a section 3(e) carve-out and an advance waiver of any price adjustment, walk right, material adverse effect claim, indemnity claim or section 6(a) title representation claim; a prohibition on re-association "not limited to intentional association," with affirmative technical controls; a prohibition on profiling, scoring, evaluating or drawing conclusions about any individual Spirit employee or identifiable subgroup; onward transfer limited to named AI laboratory customers, with a prohibition on transfers of employment-related material to airlines, airline services companies, staffing or background check providers, people analytics vendors or labor relations consultancies, and a provision that "[t]he Assets shall not be sold or transferred to any Chinese entity"; a Data Review Ombudsman selected by the Debtors, reasonably acceptable to the objecting parties and approved by the Court, receiving a sample of one percent of the deidentified assets before any onward transfer at micro1's cost; United States data residency with staged delivery into a segregated, access-logged environment and destruction of raw employment records following processing; an advance waiver of claims arising from removed data; a field-of-use restriction addressed to Springshot, enforceable through a direct stipulation providing for injunctive relief with notice and cure; and free access to micro1's AI training and re-skilling curriculum plus preferential consideration for paid annotation and data transformation work for former Spirit employees.

Procedurally, the notice quotes the Bidding Procedures' reservation of the Debtors' authority to extend deadlines, waive terms and conditions, and modify the procedures, and their right "to deem a bid a Qualified Bid even if such bid does not conform to one or more of the requirements," and cites Lionel. It asked the Court to consider the bid at the then-scheduled September 9, 2026 sale hearing. The docket reflects no response by the Debtors to the notice through September 11.

Each notice states that the objection deadline of 4:00 p.m. on August 17, 2026 has passed. None sets a new objection deadline. Dkt. 1557 set a reply deadline of 12:00 p.m. on September 14, 2026; Dkt. 1601 set a reply deadline of 12:00 p.m. on September 28, 2026 and eCourt appearances by 11:00 a.m. on September 29, 2026.

The sale hearing is scheduled for 11:00 a.m. on September 30, 2026 before Judge Lane, with a reply deadline of 12:00 p.m. on September 28 [Dkt. 1601]. The docket through ECF No. 1601 reflects the following.

No order approving the sale has been entered. The six objections and joinders remain on file, and the September 11 notice states that the Debtors "continue to work constructively with objecting parties in an effort to resolve objections consensually."

The ombudsman's Attachment A, described in the report as containing the final list of recommended conditions, has not been filed [Dkt. 1581]. The report states that the Debtors are in the process of identifying a deidentification vendor and that the ombudsman requests an opportunity to learn the standards that vendor plans to follow once it is selected.

Google's stated supplement to its preliminary response and its response to the objections have not been filed [Dkt. 1594]. Five datasets identified in that response have been removed from the scope of the transaction, and the docket reflects no corresponding change to the $10,000,000 purchase price.

The Debtors have not responded on the docket to micro1's notice of intent to submit a competing bid of $12,500,000 [Dkt. 1556], and no amended notice of auction results or revised successful bidder designation has been filed.

The proposed sale order on file remains the version filed August 17, 2026, which contains no privacy conditions, use restrictions, re-identification prohibition, certification to the Court or reporting obligation in its decretal paragraphs [Dkt. 1469].