A two-and-a-half-year review by the US Department of Transportation has ended with no penalties for the country's ten largest airlines, even though more than 700 million passenger travel records ended up in the hands of federal agencies. The DOT concluded it had found no violations of laws or its own policies, a decision that has not gone down well with several US senators.
The story centres on the Airlines Reporting Corporation, or ARC, a little-known but hugely influential intermediary. ARC processes transactions between airlines and travel agencies — flows of money worth roughly $100 billion a year — and is jointly owned by the big carriers themselves, including American, Delta, United, Southwest, Alaska and JetBlue. Along the way, it accumulates enormous amounts of passenger data.
According to earlier reporting by Reuters, ARC sold a database containing around 722 million travel records to federal agencies, among them Customs and Border Protection, the Department of Homeland Security and even the Internal Revenue Service. The records included names, itineraries and, apparently, payment details — and they were handed over without court oversight or warrants. Senator Ron Wyden was blunt in his criticism, arguing the DOT treated a privacy policy and some training as sufficient despite "clear evidence of privacy abuses".
Under pressure from lawmakers and privacy campaigners, ARC shut down its Travel Intelligence Program in November 2025. The DOT review, launched in March 2024 under then-Transportation Secretary Pete Buttigieg, has now wrapped up with the airlines walking away without fines.
There is also a second, more direct way this touches your wallet: surveillance pricing. Regulators and consumer groups are worried that airlines could use AI to analyse personal data and charge different flyers different fares for the same seat, based on what the system thinks each person will pay. Delta began testing such methods in late 2024, and JetBlue faced a federal lawsuit this year alleging it raised fares using customer data — a case sparked after a social media user was told that clearing browser cookies would unlock cheaper prices. Lawmakers have also flagged that airline-held travel data could be of interest to foreign adversaries.
Why should holidaymakers care? Because the price you see online may increasingly reflect assumptions about you rather than the seat itself. Simple steps like browsing in incognito mode, clearing cookies, and comparing fares across devices or VPNs remain sensible habits. More broadly, the saga is a reminder that the details you enter when booking — name, route, payment card — don't necessarily stay between you and the airline. With ARC's data programme now closed but no fines issued, the question of how US carriers handle passenger privacy is clearly not settled, and further political pressure looks likely.
