Could your workplace messages be sold to train AI?

What changed

Steven Horsford, Elizabeth Warren and fellow US lawmakers have asked Google and Spirit Airlines to protect workers before a proposed $10 million internal-data sale proceeds. Their 8 October letter says court findings describe roughly 100 million emails and 500 million Teams messages, alongside employment records. These are figures attributed to the letter, not a dataset independently inspected by this publication.

The distinction between a proposal and a completed transfer matters. The lawmakers' public statement says the transaction is being considered in Spirit's bankruptcy proceedings, while the letter asks Google and Spirit to agree protections before data changes hands. Neither source establishes that Google has received the records, that a final dataset exists, or that a court has approved final terms. The $10 million figure is the proposed purchase price reported in the lawmakers' documents, not a valuation checked by this publication.

The requested protections include removing employee information wherever possible, reviewing confidentiality independently, limiting subsequent use and protecting voluntary aviation-safety records. These are demands from lawmakers, not safeguards we can confirm have been implemented. A reader should therefore treat this as a dispute about conditions for a possible sale, not as evidence of a completed disclosure or a successful AI-training project.[1][2]

What the proposed corpus could contain

The congressional letter describes an unusually large mixed workplace corpus: about 100 million emails, 500 million Microsoft Teams messages and employment-related records. Volume is not the same as fitness for training. Business communications can include duplicates, routine notices, confidential legal or commercial material, safety reports, personal exchanges and references to people who never expected their words to become model-training data. The sources do not publish a data dictionary, retention period, sampling plan or breakdown showing how much material falls into each category.

The denominator also needs care. Six hundred million messages are not six hundred million employees, conversations or independent examples. One employee can generate thousands of related messages, automated systems can create repeated notices, and long threads can reproduce earlier text. Without a deduplication and provenance report, the headline record count says little about the information content or representativeness of the corpus. It also cannot show whether any training use would improve a model or merely reproduce a narrow airline's internal language and practices.[2]

Why this reaches beyond one airline

Our analysis: a work message may reveal much more than a name. A role, shift, location or unusual event can make a record distinctive. That is why the useful question is what a recipient could infer from the whole collection, rather than whether a name field was deleted.

De-identification can reduce risk, but its performance depends on the method, the surrounding information and the recipient's access to other data. Redacting names and email addresses would not necessarily remove an uncommon job title, a dated incident description or a combination of locations and shifts. The letter asks for an independent review because a promise to remove personally identifiable information does not, by itself, disclose the test used, the residual risk accepted or the procedure for material that cannot safely be transformed.

For employees, the practical issue is whether information supplied to do a job can acquire a different purpose later. For managers, it is an opportunity to ask what their organisation retains, who can access it and how any proposed reuse would be reviewed with affected staff. A responsible assessment should also consider contractors, customers and other correspondents whose words may appear inside an employee's mailbox even if they are not part of the workforce named in the dispute.[2]

Questions workers and buyers can ask now

Workers do not need to speculate about model architecture to ask concrete governance questions. Which record classes are in scope? Who selected them? What communications will be excluded? Is the data being sold, licensed or accessed temporarily? Will raw text leave a controlled environment? How long will copies and derived datasets be kept? Who can audit compliance, and what remedy exists if an exclusion fails? The public sources do not yet answer those questions.

For an AI buyer, a large corpus is also a liability if consent, ownership, confidentiality and provenance are unclear. Contract terms can limit use, but technical and organisational controls still matter: access logs, separation of raw and processed material, deletion schedules, testing for memorisation and restrictions on onward transfer. None of those controls should be assumed from the announcement. They would need to be documented and, where possible, independently tested.

Safety-related material deserves special attention. Aviation reporting systems can depend on people being willing to describe mistakes and near misses. The lawmakers specifically seek protection for voluntary safety records. That request does not prove such records are included, but it identifies a public-interest reason to define exclusions carefully: a secondary data use that chills candid reporting could affect people far beyond the individuals whose messages were collected.[2]

Google's position—and what remains unverified

The congressional documents record Google's position that it will not receive personally identifiable information and that a third party will scrub the records before transfer. The lawmakers question whether de-identification alone is sufficient. Their letter does not prove that a particular worker could be identified from the final dataset.

That distinction prevents two opposite overclaims. It would be wrong to say workers' private messages have already trained a Google model; the sources do not establish that. It would also be premature to call the proposal safe solely because a third party is expected to scrub identifiers. The relevant evidence is the final scope, transformation method, validation results, contractual controls and oversight—not a label such as anonymous or de-identified.

We have verified the dated letter and public statement. We have not reviewed the final data, a completed transfer, the technical de-identification assessment or a final court decision. The assessment would change if the parties publish binding terms, an independent risk test and an auditable list of excluded data; it would also change if a court filing or regulator confirms that a transfer occurred on materially different conditions. Until then, the most defensible account is that a consequential proposal is being challenged before its safeguards are publicly demonstrated.[1][2]