Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Airbnb maintains separate privacy supplements for at least seven geographic jurisdictions, indicating that applicable data rights, processing terms, and disclosures vary by the user's country of residence or location.
This analysis describes what Airbnb's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The existence of jurisdiction-specific supplements indicates that data subject rights (such as access, deletion, portability, and opt-out), lawful processing bases, and data sharing disclosures are defined at the supplement level and are not uniform across Airbnb's user base.
Interpretive note: The operative content of each geographic supplement is not reproduced in this index page; compliance assessment requires review of individual supplement documents.
Under this structure, the specific data rights available to a user, including the right to access, delete, or restrict processing of personal information, are defined in the geographic supplement applicable to their location rather than in the main Privacy Policy.
Cross-platform context
See how other platforms handle Geographic Privacy Supplements and similar clauses.
Compare across platforms →Monitoring
Airbnb has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Outside the United States Privacy Supplement United States Privacy Supplement Brazil Privacy Supplement China Privacy Supplement Korea Privacy Supplement Colombia Privacy Supplement Türkiye Privacy SupplementExcerpt from Airbnb's Privacy Policy
1) REGULATORY LANDSCAPE: Each geographic supplement engages the data protection regime of its target jurisdiction: GDPR and national implementing legislation for EU/EEA users (Outside the United States supplement); CCPA/CPRA for California residents (United States supplement); Brazil's Lei Geral de Proteção de Dados (LGPD) for Brazilian users; China's Personal Information Protection Law (PIPL) for Chinese users; South Korea's Personal Information Protection Act (PIPA) for Korean users; Colombia's Law 1581 of 2012 and Decree 1377 for Colombian users; and Turkey's Law on Protection of Personal Data (KVKK) for Turkish users. Enforcement authorities vary by jurisdiction. 2) GOVERNANCE EXPOSURE: High for multi-jurisdiction operators. Organizations deploying Airbnb for Work or Enterprise services across multiple geographies must assess which supplement governs employee or guest data in each jurisdiction. Inconsistent or inadequate supplement content relative to local law creates enforcement exposure in each affected jurisdiction. 3) JURISDICTION FLAGS: China (PIPL) and South Korea (PIPA) impose particularly prescriptive requirements on cross-border data transfers and localization; the adequacy of Airbnb's cross-border transfer mechanisms for these jurisdictions is not assessable from this index page. EU/EEA and California present heightened exposure for data subject rights fulfillment timelines and opt-out mechanisms. 4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise and business customers operating across multiple jurisdictions covered by these supplements should verify that their data processing agreements with Airbnb reference the applicable geographic supplement and address controller/processor allocation for each relevant jurisdiction. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should obtain and review each applicable geographic supplement to confirm that data subject rights procedures, retention periods, cross-border transfer mechanisms, and lawful bases for processing are adequately documented and operationally implemented. The index page alone does not provide sufficient information to assess compliance posture.
The existence of jurisdiction-specific supplements indicates that data subject rights (such as access, deletion, portability, and opt-out), lawful processing bases, and data sharing disclosures are defined at the supplement level and are not uniform across Airbnb's user base.
Under this structure, the specific data rights available to a user, including the right to access, delete, or restrict processing of personal information, are defined in the geographic supplement applicable to their location rather than in the main Privacy Policy.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Airbnb.