Updated October 2026
How de-identification was handled in reported data sales
Data de-identification decided more of the Spirit Airlines bankruptcy sale than the bid amounts suggest. A declaration filed after the auction said de-identification and privacy factors "may be outcome-determinative". This page sets out, side by side, how each bidder in that case and each wind-down buyer describes the step.1
Spirit's bidders
Three bidders, three ways to scrub the same archive
Google's plan, as the ombudsman described it on 2026-10-05: Tonic.ai de-identifies the unstructured data and files a certification with the court before every transfer. Google is the successful bidder; the sale had no approval as of 2026-10-14, and the hearing sits on the 2026-11-06 calendar.2,3
Mercor's bids tracked the method. With third-party de-identification on Google's form it offered $5.2M; with its own tools, $7.0M; and it went to $10.0M on condition that it could de-identify in-house. The court record keeps its $7.5M as the alternate bid.4
micro1 proposed doing the work in-house at its own cost, giving an independent reviewer a 1% sample before any onward transfer, storing data in the US, destroying raw employment records after processing, and passing data on only to AI lab customers bound by confidentiality and no-reassociation terms. Those are micro1's own terms.5
| Fact | Value and source |
|---|---|
| Ombudsman's recommendation | On 2026-10-05 the ombudsman recommended approving the sale to Google. Tonic.ai de-identifies the unstructured data and files a certification with the court before every transfer. She did not assess risks to employees or third parties |
| Mercor's bids at the Spirit auction | Mercor bid $5.2M (Google's form, third-party de-identification) or $7.0M (its own tools), then offered $10.0M conditioned on in-house de-identification. Google's $10.0M was chosen; Mercor's $7.5M stands as the alternate |
| micro1's proposed terms | In-house de-identification at micro1's cost, an independent reviewer given a 1% sample before any onward transfer, U.S. storage, raw employment records destroyed after processing, and onward transfers only to AI lab customers bound by confidentiality and no-reassociation terms |
The ombudsman
What the privacy ombudsman asked for
Her first report set five categories of conditions: verified de-identification with certification, transparency, protection of children and teens, a ban on re-identification, and security in the AI training environment.6
On the other bidders she was specific. If the court considers Mercor, she wants to examine its 2026 security incident. For micro1, she wants to review its plan to de-identify the data itself rather than through an independent party. She also said she did not assess risks to employees or third parties.7,2
Outside court
What wind-down buyers and brokers say they do
SimpleClosure says every dataset is processed for PII before licensing, with sensitive information and credentials de-identified. Turing says Project Lazarus processes data in an air-gapped environment.8,9
For operating companies, micro1 says PII is removed "when relevant", and Polyshares says a third-party PII partner scrubs data before it is licensed. Each is a company's description of its own process, not an audit, and none of them publishes a test of how well the scrubbing works on free text such as email bodies or chat threads. Ask for a sample of scrubbed output before signing.10,11
Comparing offers
Five questions to put to every bidder
Our reading of the record: ask who performs the de-identification (independent firm or the buyer), who verifies it and on what sample, whether a certification goes to the court or the fiduciary, where the data is stored and processed, and who it can be passed to afterwards. Spirit's bidders answered each of these differently.2,5,4
FAQ
Questions, answered with sources
Tonic.ai, which files a certification with the court before each transfer, per the ombudsman's 2026-10-05 recommendation.2
Its bids depended on the method: $5.2M with third-party de-identification, $7.0M with its own tools, and $10.0M conditioned on in-house de-identification.4
micro1 proposed that an independent reviewer receive a 1% sample of the data before any onward transfer to AI lab customers.5
Mercor's 2026 security incident, and micro1's plan to de-identify the data itself rather than through an independent party.7
SimpleClosure says every dataset is processed for PII first, and sensitive information and credentials are de-identified.8
Turing says Project Lazarus processes data in an air-gapped environment.9
We do not answer legal questions. Ask the licensing company: their team reviews this with you before anything is signed.
Before you sign
Legal questions go to the licensing company
We do not answer legal questions. Ask the licensing company before you sign: their team reviews these with you.
Questions for this kind of business
- What standard of de-identification would satisfy the court or a privacy ombudsman in our case?
- Does an in-house de-identification by the buyer carry different risk from an independent firm's certification?
- How do state privacy laws treat employee names and identifiers that survive scrubbing in free text?
- How do CCPA, GDPR, UK GDPR and state privacy laws apply, and is de-identified data still personal information?
Questions for any buyer
- Is the license exclusive, and for how long?
- Can you sublicense the data, and to whom?
- Which AI labs will receive it, and will you tell us?
- How long do you keep it, and how is it deleted?
- What is your liability cap, and who indemnifies whom?
- Will the contract ban re-identification of people in the data?
- Who removes personal data, by what method, and do we approve it first?