American Airlines collects health information including medical conditions, vaccination status, COVID-19 test results, and emergency medical data, and may receive this information from travel agents or other third parties in addition to directly from you.
This analysis describes what American Airlines's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Health data is one of the most sensitive categories of personal information and its collection by an airline, including via third-party intermediaries, raises questions about how long it is retained, who it is shared with, and under what legal basis it is processed.
Interpretive note: The policy does not specify the legal basis for health data processing for each category or jurisdiction, and the extent to which third-party-initiated health data transfers are subject to consumer consent is not clearly addressed.
Your health data including vaccination records and medical conditions may be collected not only when you provide it directly but also when passed on by travel agents or other entities, and may be retained as part of your booking record.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
To stop us collecting your location information, you can update your device settings, stop using the Service, or uninstall our mobile apps.
"Health information, some examples of which include: You have sought clearance from us to fly with a medical condition or device; You have otherwise chosen to provide such information to us or it has been passed onto us by a third party, such as the travel agent through which you made your booking or other entity, including information about whether you have symptoms of a communicable disease or virus (such as COVID-19), an appropriate vaccination, or a negative test result; Health information related to a medical emergency that occurs while traveling. Digital identity credentials, including credentials linked to vaccination status or negative test results that you provide for specific purposes, such as compliance with customs and immigration requirements during international travel or services in which you choose to participate.Excerpt from American Airlines's Privacy Policy
REGULATORY LANDSCAPE: Health data collection engages GDPR Article 9 for EU/EEA data subjects, which classifies health data as a special category requiring explicit consent or a specific enumerated legal basis such as vital interests or …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Health data is one of the most sensitive categories of personal information and its collection by an airline, including via third-party intermediaries, raises questions about how long it is retained, who it is shared with, and under what legal basis it is processed.
Your health data including vaccination records and medical conditions may be collected not only when you provide it directly but also when passed on by travel agents or other entities, and may be retained as part of your booking record.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by American Airlines.