American Airlines shares your personal information with a broad network of partners including airlines, hotels, car rental companies, credit card issuers, travel agents, and tour operators when you use your AAdvantage account or book travel through partner channels.
This analysis describes what American Airlines's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Your travel and loyalty data, including booking details, transaction history, and contact information, flows to a wide range of third-party businesses whose own privacy practices are not governed by this policy.
Providing your AAdvantage number to earn or redeem miles with partner airlines, hotels, or credit card companies results in your personal information being shared with those partners, each of whom applies their own privacy practices to that data.
How other platforms handle this
We may share your personal data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to such information to do that work. We may also share your personal data with advertising partners to display relevant advertising to y...
In order to provide you with services, Valve needs to share some data with the publisher or developer of the game (for example to verify your ownership of the game and register your Steam ID with the publisher), or with other third parties that Valve works with to provide services to you. Valve will...
When you ask us to open an Account, we or someone acting for us will ask for information about you and where the money you will put in your Account comes from. We do this for a number of reasons, including to check your credit score and identity, and to meet our legal and regulatory requirements. Ou...
Monitoring
American Airlines has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"Our travel and loyalty business partners that you interact with as an American customer or loyalty member, such as travel agents, other airlines (e.g., code share and alliance partners), travel and hospitality service providers (e.g., transportation or tour operators), and other loyalty partners (e.g., our credit card partners). Information about your transactions with our loyalty or business partners, such as another airline, hotel, car rental, or credit card company that you have provided your AAdvantage® account number for purposes of earning or redeeming miles or receiving loyalty benefits.— Excerpt from American Airlines's American Airlines Privacy Policy
REGULATORY LANDSCAPE: Third-party data sharing engages GDPR Article 13 and 14 disclosure requirements for EU/EEA data subjects, which require identification of recipients or categories of recipients at the time of data collection. Under CPRA, sharing personal information with third parties for business purposes must be disclosed and, where it constitutes sharing for cross-context behavioral advertising, must include an opt-out mechanism. The FTC's unfairness and deception authority applies where data sharing practices are inconsistent with disclosed privacy policy terms. GOVERNANCE EXPOSURE: Medium. The policy discloses partner categories at a high level but does not enumerate specific partner entities, which may limit the specificity of disclosure required under GDPR and CPRA. The breadth of the partner network, spanning airlines, hotels, car rental, credit card, and tour operators, creates a wide data distribution footprint that is operationally difficult to audit comprehensively. JURISDICTION FLAGS: EU/EEA data subjects have rights under GDPR to know the identity or categories of recipients of their data at the time of collection. California residents have rights under CPRA to know third parties to whom their data is sold or shared and to request deletion from those parties. Data transfers to non-EU partners may require Standard Contractual Clauses or other transfer mechanisms under GDPR Chapter V. CONTRACT AND VENDOR IMPLICATIONS: Data sharing agreements with loyalty and travel partners should be reviewed to confirm they include required GDPR data processing or controller-to-controller transfer terms, CPRA-compliant contractual provisions, and limitations on secondary use of shared data. Credit card partner data sharing arrangements may also implicate Gramm-Leach-Bliley Act financial privacy requirements. COMPLIANCE CONSIDERATIONS: Compliance teams should maintain an up-to-date inventory of all partner entities receiving personal data, confirm that data sharing agreements include appropriate restrictions on secondary use, and evaluate whether GDPR transfer mechanisms are in place for international partner data flows.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Your travel and loyalty data, including booking details, transaction history, and contact information, flows to a wide range of third-party businesses whose own privacy practices are not governed by this policy.
Providing your AAdvantage number to earn or redeem miles with partner airlines, hotels, or credit card companies results in your personal information being shared with those partners, each of whom applies their own privacy practices to that data.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by American Airlines.