Updated October 2026
How de-identification was handled in reported data sales
If you are selling a company's archive, the buyer will strip out names and personal details first, a step lawyers call de-identification, and who does it can matter as much as the price. In the Spirit Airlines bankruptcy sale, a declaration filed after the auction said de-identification and privacy factors "may be outcome-determinative". Here is how each bidder in that case, and the buyers outside court, describe the step.1
Spirit's bidders
Three bidders, three ways to scrub the same archive
Google's plan, as the ombudsman described it on 2026-10-05: Tonic.ai strips personal details from the unstructured data and files a certification with the court before every transfer. Google is the successful bidder; the sale had no approval as of mid-October 2026, and the hearing sits on the 2026-11-06 calendar.2,3
Mercor's bids tracked the method. With a third party doing the scrubbing on Google's form it offered $5.2M; with its own tools, $7.0M; and it went to $10.0M on condition that it could do the work in-house. The court record keeps its $7.5M as the alternate bid.4
micro1 proposed doing the work in-house at its own cost, giving an independent reviewer a 1% sample before any onward transfer, storing data in the US, destroying raw employment records after processing, and passing data on only to AI lab customers bound by confidentiality and no-reassociation terms. Those are micro1's own terms.5
| Fact | Value and source |
|---|---|
| Ombudsman's recommendation | On 2026-10-05 the ombudsman recommended approving the sale to Google. Tonic.ai de-identifies the unstructured data and files a certification with the court before every transfer. She did not assess risks to employees or third parties |
| Mercor's bids at the Spirit auction | Mercor bid $5.2M (Google's form, third-party de-identification) or $7.0M (its own tools), then offered $10.0M conditioned on in-house de-identification. Google's $10.0M was chosen; Mercor's $7.5M stands as the alternate |
| micro1's proposed terms | In-house de-identification at micro1's cost, an independent reviewer given a 1% sample before any onward transfer, U.S. storage, raw employment records destroyed after processing, and onward transfers only to AI lab customers bound by confidentiality and no-reassociation terms |
The ombudsman
What the privacy ombudsman asked for
Her first report set five categories of conditions: verified removal of personal details with certification, transparency, protection of children and teens, a ban on re-identification, and security in the AI training environment.6
On the other bidders she was specific. If the court considers Mercor, she wants to examine its 2026 security incident. For micro1, she wants to review its plan to scrub the data itself rather than through an independent party. She also said she did not assess risks to employees or third parties.7,2
Outside court
What buyers outside court say they do
SimpleClosure says every dataset has personal details stripped out before licensing, including sensitive information and credentials. The buyers we work with describe similar steps: names and contact details removed in a secure workspace, originals deleted after processing, and a before-and-after sample for you to check. Pewter adds that no method removes every risk.8,9,10,11
For operating companies, each buyer describes its own scrubbing process, some in-house and some through a third-party partner. Each is a description, not an audit, and none of them publishes a test of how well the scrubbing works on free text such as email bodies or chat threads. Ask for a sample of scrubbed output before signing.12,13
Comparing offers
Five questions to put to every bidder
FAQ
Questions, answered with sources
Tonic.ai, which files a certification with the court before each transfer, per the ombudsman's 2026-10-05 recommendation.2
Its bids depended on the method: $5.2M with a third party scrubbing the data, $7.0M with its own tools, and $10.0M conditioned on doing the work in-house.4
micro1 proposed that an independent reviewer receive a 1% sample of the data before any onward transfer to AI lab customers.5
Mercor's 2026 security incident, and micro1's plan to scrub the data itself rather than through an independent party.7
SimpleClosure says every dataset has personal details stripped out first, including sensitive information and credentials.8
Every business is different, so this one is best talked through with the buyer you're working with. Their team goes over it with you before anything is signed.
Before you sign
Questions to talk through with your buyer
Every business is different, so these are best talked through with the buyer you're working with. Their team goes over them with you before anything is signed.
Questions for this kind of business
- What standard for stripping personal details would satisfy the court or a privacy ombudsman in our case?
- Does scrubbing done in-house by the buyer carry different risk from an independent firm's certification?
- How do state privacy laws treat employee names and identifiers that survive scrubbing in free text?
- How do CCPA, GDPR, UK GDPR and state privacy laws apply, and is de-identified data still personal information?
Questions for any buyer
- Is the license exclusive, and for how long?
- Can you sublicense the data, and to whom?
- Which AI labs will receive it, and will you tell us?
- How long do you keep it, and how is it deleted?
- What is your liability cap, and who indemnifies whom?
- Will the contract ban re-identification of people in the data?
- Who removes personal data, by what method, and do we approve it first?