The Transportation Department plans to conduct a probe of what airlines are doing with customer data.
This year, the DOT said it will review the 10 largest mainline U.S. carriers: American, Delta, United, Southwest, Alaska, JetBlue, Spirit, Frontier, Hawaiian and Allegiant. The reviews will focus on how airlines collect, handle, maintain and use passengers' personal information.
"The review will examine airlines' policies and procedures to determine if airlines are properly safeguarding their customers' personal information," the department said. "In addition, DOT will probe whether airlines are unfairly or deceptively monetizing or sharing that data with third parties. As DOT finds evidence of problematic practices, the department will take action, which could mean investigations, enforcement actions, guidance or rulemaking."
Airlines gather personal data on flyers as part of the ticketing process and for purposes of security reviews. Airlines are also increasingly making use of other types of data, such as flight history and flight preferences as well as seatback entertainment system viewing preferences.
In a statement, airline trade group Airlines for America (A4A) said that it looks forward to demonstrating industrywide cybersecurity successes to the DOT. Annual IT expenditures by U.S. passenger airlines increased from $5.8 billion in 2018 to $7.4 billion in 2023, according to A4A data. However, those expenditures include a wide range of initiatives, much of which is unrelated to personal data security.
"U.S. airlines take customers' personal information security very seriously, which is why they have robust policies, programs and cybersecurity infrastructure to protect consumers' privacy," A4A said.
To initiate the privacy review, the DOT sent letters to the 10 airlines requesting three types of information. They include airline policies and procedures relating to the collection, maintenance, handling, and use of airline passengers' personal information; any complaints alleging an airline, its employees or its contractors have mishandled personal information or have violated an individual's privacy; and information regarding privacy training conducted by airlines.
The DOT said this will be the first of what will be periodic reviews of airline privacy practices.