Google just paid $10 million for a dead airline’s email. Not its planes, not its gates — its inbox.
On August 17, Dr. Alex Wissner-Gross reported in The Innermost Loop that Google had won a bankruptcy auction for Spirit Airlines’ data trove. The court filings behind that headline are the part business owners should actually read: roughly 100 million emails and 500 million Microsoft Teams chats, plus HR files, financial databases, audits, marketing materials, and presentations, as Axios reported. The day before, Wissner-Gross flagged the live-company version of the same trend: AI labs’ contractors cold-emailing startups to buy their old Slack threads and support tickets.
Selling company data has quietly become an asset class. Here is what that means for your business, and the five legal limits that decide whether your records are yours to sell.
What the Spirit Airlines Deal Actually Sold
The carve-out is the tell. Spirit ceased operations in May after failing to emerge from its second Chapter 11. When the estate monetized what was left, the passenger profiles and frequent-flyer records were excluded from the Google transaction. What sold was the company’s own operational exhaust — the internal correspondence, the payroll history, the project files, the spreadsheets nobody thought of as inventory.
Google’s stated position is that it will receive no personal information, that the dataset will be deidentified by a third party before receipt, and that it will not attempt re-identification. A federal judge still has to approve the transfer. The AI hiring platform Mercor was the backup bidder at $7.5 million.
Read that structure again, because it is the whole lesson. The individuals’ data was protected. The company’s own files were the product.
Why Your Privacy Policy Protects Your Customers, Not You
That asymmetry is not an accident of negotiation. It is written into the Bankruptcy Code.
Under 11 U.S.C. § 363(b)(1), if a debtor disclosed a policy prohibiting the transfer of personally identifiable information to unaffiliated parties, and that policy was in effect when the case commenced, the trustee may not sell that information unless the sale is consistent with the policy — or unless a consumer privacy ombudsman is appointed and the court separately approves. Section 332 defines that ombudsman’s job: present the debtor’s privacy policy to the court, weigh the gains and losses to consumers, and identify alternatives that would mitigate the privacy cost.
Notice what the statute does not cover. It guards personally identifiable information about individuals. It says nothing about your internal emails, your Teams history, your support tickets, your audit files, or your payroll records going back decades. Those are ordinary estate assets. In a distressed sale they can be marketed, bid on, and sold like a fleet of aircraft.
Five Legal Limits on Selling Company Data
Whether you are the seller, the target, or the founder fielding a surprisingly specific cold email, these are the five places the answer actually lives.
1. Your privacy policy is a binding promise, not marketing copy. Section 363(b)(1) only bites if you actually made the promise. A narrowly drafted policy can block a data sale outright; a loose one protects no one and constrains nothing. Most owners have never read theirs against this scenario.
2. Customer contracts often prohibit what bankruptcy law would allow. Confidentiality provisions in master services agreements routinely define “Confidential Information” broadly enough to sweep in the very support tickets and message threads a buyer wants. Our note on how “Confidential Information” gets defined covers the clause that decides this, and it is usually skimmed.
3. Inbound NDAs run against you. Data you received under someone else’s non-disclosure agreement is not yours to monetize, and those obligations typically survive termination — and survive the sale of the business.
4. Employment records carry their own rules. Personnel files, payroll history, and internal communications about employees sit under a patchwork of state employment and privacy law. Illinois businesses have already learned this the expensive way through biometric litigation; see our discussion of biometric privacy law and business risk. “Deidentified” is a legal conclusion, not a checkbox.
5. Your own records may not be entirely yours. Jointly developed work product, third-party licensed content sitting inside your files, and the terms of the collaboration tools themselves can all limit transfer. Whether the deal is structured as an asset sale or an equity sale changes who inherits those limits — and who inherits the liability if the limits were ignored.
Someone Wants to Buy Your Slack History
The bankruptcy scenario at least comes with a judge. The cold-email scenario does not.
When a lab’s contractor offers real money for archived internal communications, the transaction looks simple and is not. You are selling a corpus you never audited, assembled by employees who assumed it was private, containing counterparties’ confidential information you agreed to protect, and possibly customer data your own policy says you will not transfer. The offer arrives priced as found money. It is closer to an unindemnified representation about every contract you have ever signed.
This is also becoming a diligence item in ordinary deals. Buyers are starting to ask what data a target holds, what rights travel with it, and whether anyone has already sold a copy. If your contracts lack an AI training clause, that silence now gets negotiated at the table rather than assumed away — and unresolved data questions are exactly the kind of issue that becomes a post-closing dispute for litigation counsel to clean up.
What Business Owners Should Do Now
Four concrete steps, none of which require a project:
- Read your own privacy policy against a sale. Ask one question: if this company were sold tomorrow, does this document stop anything? If you cannot answer, neither can a court.
- Check the confidentiality definition in your ten largest customer contracts. That definition, not your intentions, determines what you may transfer.
- Inventory where the value sits. Most owners can name their equipment and their receivables. Very few can say who controls twenty years of email, or under what terms.
- If a buyer approaches about your data, do not respond with a price. Respond after counsel has looked at what you would actually be warranting.
Data questions rarely arrive labeled as data questions. They show up as a line item in a purchase agreement, a diligence request, a dispute over what was included in the sale, or an unexpectedly generous email. The businesses that handle them well are the ones that read the paperwork before the offer, not after.
If you are preparing to sell, fielding an approach, or simply unsure what your contracts already committed you to, Howard East advises business owners on data rights, confidentiality obligations, and transaction structure. Schedule a consultation to review where your company’s records actually stand. For matters already in dispute, our litigation practice at Howard Law Group handles the contested side.
This article is for informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship. Laws vary by jurisdiction and change over time; consult qualified counsel about your specific situation.
Source: Dr. Alex Wissner-Gross, The Innermost Loop, August 16 and 17, 2026.
