The DOT has closed its review of airline privacy policies. This review was opened in March 2024 to investigate how airlines collected, maintained, used, and sold protected passenger information.
Unsurprisingly, this DOT has not “identified any violation of applicable laws or departmental policies.”
However, the airlines likely did violate the law by selling passenger data to federal agencies, including CBP, DHS, and the IRS.
The airlines sell or provide the data to a company they jointly own: the Airlines Reporting Corporation. That company subsequently sold passenger data. Data privacy advocates believe that the airlines even sold payment details. ARC shut down its Travel Intelligence Program in late 2025 due to pressure from Congress and privacy advocates.
In 2016, the Department of Justice found that the DEA paid airline employees for passenger itineraries and other personal information.
The DOT did not address either of these.
Another major win for the airlines in 2026.
