Lawmakers warn Google Spirit Airlines AI deal exposes sensitive employee data

US lawmakers are warning that a proposed $10 million agreement between Google and Spirit Airlines could expose vast amounts of sensitive employee data to artificial intelligence training models. According to a press release from Rep. Steven Horsford (D-NV), the deal would provide Google with access to hundreds of millions of private communications and financial records.

The proposed sale includes approximately 100 million emails and 500 million Microsoft Teams messages, according to The Record. Beyond communications, the dataset reportedly contains employment contracts, employee timecard records, and payroll and tax information. These documents represent highly sensitive personal and financial data belonging to Spirit Airlines employees.

Context and Background

The warning comes as major technology companies increasingly seek large datasets to train and refine their artificial intelligence systems. The specific nature of the data in this proposal—internal corporate communications and financial records—raises significant privacy concerns. Rep. Steven Horsford highlighted the scope of the data in his press release, emphasizing the volume and sensitivity of the records involved.

The inclusion of payroll and tax information is particularly notable, as this data is typically protected by strict confidentiality agreements and legal standards. The combination of this financial data with hundreds of millions of internal messages creates a comprehensive profile of employee activity and compensation.

Who Is Affected

The primary individuals affected by this potential data exposure are Spirit Airlines employees. Their private communications, employment terms, and financial details are the subject of the proposed transfer. The scale of the data, involving hundreds of millions of items, suggests a large portion of the workforce is involved.

Security professionals are watching this development as a potential case study in data governance and AI ethics. The incident highlights the risks associated with selling internal corporate data to third-party technology vendors for AI purposes.

What should you do?

Organizations should review their data sharing agreements with third-party vendors, particularly those involving AI training. Employees should be aware of how their data is being used and stored. Companies should ensure that any data sold or shared is properly anonymized and stripped of personally identifiable information. Regulators may need to scrutinize these deals more closely to protect employee privacy.

What to do and how to stay safe: Google

• Review internal data sharing policies to ensure sensitive employee information is not being sold or shared without explicit consent.
• Audit third-party vendor agreements, especially those involving AI training, to understand what data is being accessed and how it is used.
• Ensure that any data shared with external partners is properly anonymized and stripped of personally identifiable information before transfer.
• Monitor regulatory developments and legislative warnings regarding AI data usage and employee privacy protections.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What data is included in the proposed Google and Spirit Airlines deal?

The deal includes approximately 100 million emails, 500 million Microsoft Teams messages, employment contracts, timecard records, and payroll and tax information.

Who issued the warning about this data exposure?

Rep. Steven Horsford (D-NV) issued a press release warning about the potential exposure of Spirit Airlines employee data in the proposed deal.

What is the value of the proposed agreement?

The proposed sale is valued at $10 million, according to reports from The Record.