American Airlines Privacy Policy

This Privacy Policy governs the collection, use, sharing, and protection of personal information by American Airlines, Inc. across its Travel Services, Program Services, and Interactive Services, including the AAdvantage loyalty program, and applies to all interaction channels regardless of device. The agreement states that American collects a broad range of data including biometric identifiers, health information, geolocation, payment data, and communications content; the terms authorize sharing this data with travel partners, loyalty partners, credit card partners, government and law enforcement agencies, advertising networks, and third-party analytics providers, and permit combining online and offline data for targeted advertising purposes. Notably, the policy asserts broad cross-device tracking and data combination practices for behavioral advertising, collects sensitive categories such as biometric, health, and vaccination data, and conditions certain opt-out rights on state residency rather than applying them universally, though applicable law including GDPR, CCPA, and state biometric statutes may constrain how some of these asserted rights operate in practice. The policy engages GDPR for EU/EEA data subjects, the California Consumer Privacy Act and California Privacy Rights Act for California residents, state biometric privacy laws such as Illinois BIPA where biometric data is collected, and federal aviation security and customs regulations that independently compel collection of certain traveler data; the dual role of American as both a commercial data controller and a regulated air carrier creates layered compliance obligations across multiple frameworks and jurisdictions.