
Our friends at 404 Media discovered multiple airlines have been pooling travelers’ data and selling it to the US Government. The way it works is that the major US airlines (including Delta, Southwest, United, American Airlines, Alaska Airlines, JetBlue, and European airlines Lufthansa and Air France, and Canada’s Air Canada) set up a that a data broker for a few purposes.
One of the primary services offered by ARC is ticket settlement services and determining travel trends. But another one is to monetize the data collected. They can break up all the data and sell it on an aggregate basis. There are several large companies that look for IP and behavioral trends from a host of data sources.
The troubling part here is that ARC sell its data to the US Government and it can use this data for surveillance of any other permitted uses. They are not selling anonymized data (which is data that has removed personally identifiable information) but actual personalized flight records, credit card information and the like. The Customs and Border Protection as part of the Department of Homeland Security uses data to track people’s travel across the county. 404 Media also reported that ICE has purchased this data as well.
Most surprising to me was the fact that ARC has received so little for this data. 404 Media reported that the contract with CBP started in June 2024 and may extend to 2029. The payments recorded were a $11,025 transaction plus an additional $6,847.50 for an additional extension year to it. To me it sounds like that the US Government received all of this sensitive information for less than $18,000.
The value of the information and the amounts paid do not see to line up. I would have expected that ARC to reap much more than this to violate its customers privacy expectation. If you are going to alienate your passengers, you should at least make real money on it.
I also do not recall seeing any way to opt out of ARC’s data aggregation and sale process. Normally, companies permit their users to keep their data private and not subject to sale. Once again, airlines do not seem to care about their users and the airlines themselves do not follow normal corporate procedures.
Our recommendation is to always opt out of any data collection requests by corporations. It seems that they use the data and sell it in ways we cannot imagine. It is possible that the corporation did not envision this type of sale at the time but the opportunity arose and they took advantage. So the question arise is how much is your data and information worth and shouldn’t you decide who has access to it.