DOT finds no airline data privacy violations

The US Department of Transportation has completed a multi-year review of data privacy practices at the nation's biggest airlines. The Biden-era review, initiated in March 2024 by then-Transportation Secretary Pete Buttigieg, identified no violations of applicable laws or departmental policies. No penalties were imposed. A department memo dated September 4 stated it had comprehensively evaluated the ten largest carriers.

Lawmakers and advocates challenge the findings

Senator Ron Wyden criticized the DOT's conclusion. He argued that having a privacy policy and training is insufficient given evidence of privacy abuses. "The DOT claims that merely having a privacy policy and training is good enough, despite clear evidence of privacy abuses," Wyden said. He has urged the department to address ongoing privacy concerns.

Major data sharing revealed through airline-owned broker

More than 700 million passenger travel records were sold to federal agencies in recent years. The Airlines Reporting Corporation, a third-party broker jointly owned by major US carriers, sold a database containing some 722 million records. Federal agencies that received the data include Customs and Border Protection, the Department of Homeland Security, and the Internal Revenue Service. The data was passed on without any court oversight or warrants.

The ARC is jointly owned by carriers including Alaska Airlines, American, Delta, JetBlue, Southwest, and United. It processes transactions between airlines and travel agencies and reportedly handles data sales amounting to some $100 billion a year. Data passed on included passengers' names, itineraries, and potentially payment details. ARC shut down its Travel Intelligence Program in November 2025 amid pressure from data privacy advocates and lawmakers.

Concerns over surveillance pricing and misuse of data

Lawmakers argued that the airlines misused passenger information and that safeguarding standards fell short. Concerns were raised that travel data held by airlines and travel agencies may be of interest to foreign adversaries. The department's memo reminded airlines of ongoing responsibilities to safeguard passenger data, adhere to published privacy policies, and prevent unlawful discrimination in dynamic pricing practices. It said US airlines should avoid setting pricing based on individual data.

Surveillance pricing concerns involve using AI to price tickets differently based on factors beyond route, date, and time. Delta Air Lines started testing surveillance pricing methods in late 2024. The carrier has repeatedly denied it uses AI to set individualized prices. JetBlue faced a federal lawsuit earlier this year over allegations of raising fares based on customer data. In one instance, a social media user was told by JetBlue to clear their browser cookies to get cheaper fares.

In August, Wyden and Representative Shontel Brown said the Drug Enforcement Administration paid airline employees millions of dollars to obtain some Americans' data. Transportation Secretary Sean Duffy said last year he would quickly investigate any personalized pricing. The DOT's memo reminded airlines of their responsibilities to safeguard passenger data, adhere to privacy policies, and prevent unlawful discrimination in dynamic pricing.