Track 1 platform and get the weekly governance digest. No credit card required.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This is American Airlines' privacy policy, covering all personal data the airline collects when you book flights, use the AAdvantage loyalty program, visit aa.com, or use its mobile app. The most important thing to know is that American collects sensitive categories of data including biometric identifiers, health information, vaccination status, and geolocation, and shares this data with a wide network of travel, loyalty, credit card, and advertising partners, while using cookies and cross-device tracking to deliver targeted advertising both on its own platforms and on third-party websites. California residents and certain other state residents have specific rights to access, delete, or opt out of certain data uses, which can be exercised through the privacy portal linked in the policy.
This Privacy Policy governs the collection, use, sharing, and protection of personal information by American Airlines, Inc. across its Travel Services, Program Services, and Interactive Services, including the AAdvantage loyalty program, and applies to all interaction channels regardless of device. The agreement states that American collects a broad range of data including biometric identifiers, health information, geolocation, payment data, and communications content; the terms authorize sharing this data with travel partners, loyalty partners, credit card partners, government and law enforcement agencies, advertising networks, and third-party analytics providers, and permit combining online and offline data for targeted advertising purposes. Notably, the policy asserts broad cross-device tracking and data combination practices for behavioral advertising, collects sensitive categories such as biometric, health, and vaccination data, and conditions certain opt-out rights on state residency rather than applying them universally, though applicable law including GDPR, CCPA, and state biometric statutes may constrain how some of these asserted rights operate in practice. The policy engages GDPR for EU/EEA data subjects, the California Consumer Privacy Act and California Privacy Rights Act for California residents, state biometric privacy laws such as Illinois BIPA where biometric data is collected, and federal aviation security and customs regulations that independently compel collection of certain traveler data; the dual role of American as both a commercial data controller and a regulated air carrier creates layered compliance obligations across multiple frameworks and jurisdictions.
Institutional analysis available with Professional
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Professional.
Start Professional free trialMonitoring
American Airlines has updated this document before.
Watcher includes same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
Professional Governance Intelligence
Need provision-level monitoring and regulatory mapping?
Professional includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.
Start Professional free trialCross-platform context
See how other platforms handle Biometric Data Collection and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.