American Airlines Group Inc. (AAG), a Delaware-incorporated public company traded on Nasdaq, operates the world's largest airline and the AAdvantage loyalty program. Its privacy policy (updated March 12, 2026) describes collection of booking records, biometric identifiers used in authentication programs, health information, and digital identity credentials, plus cross-device targeted advertising. It permits sharing with co-branded credit card partners and vendors, and states booking data is provided to border authorities as a legal obligation. The AAdvantage program is heavily monetized: co-brand partners paid $6.2 billion in 2025, and the program was pledged as collateral for a 2021 financing through a Cayman Islands subsidiary. A third-party pilot-recruitment vendor breach was disclosed in 2023.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
9 ON FILE
[2026-03-12] · COLLECTION
American Airlines' privacy policy (updated March 12, 2026) lists collected personal data categories including biometric identifiers, health information related to in-travel medical emergencies, digital identity credentials (including vaccination status credentials), and booking and travel records.
An 8-K filed March 24, 2021 reports that American completed its AAdvantage financing through AAdvantage Loyalty IP Ltd., a newly formed Cayman Islands exempted company, with the notes and loans secured by a first-priority security interest in agreements and intellectual property of the AAdvantage loyalty program.
American Airlines Group Inc. is an SEC-reporting public company; its Form 10-K for fiscal year 2025 (filed February 18, 2026) is filed jointly by AAG and its wholly-owned subsidiary American Airlines, Inc., with the corporate structure disclosed in public filings.
American's privacy policy (updated March 12, 2026) names a Data Protection Officer, Russell Hubbard, reachable at privacy@aa.com, and provides rights channels for users in the EU, UK, Switzerland, Uruguay, Brazil and other jurisdictions.
American's Form 10-K for fiscal year 2025 (filed February 18, 2026) reports that co-branded credit card and other partners paid $6.2 billion in cash in 2025, that Citibank became the exclusive US issuer of AAdvantage co-branded cards starting in 2026, and that a 2025 Mastercard agreement will use Mastercard's analytics to deliver more personalized offers to AAdvantage members.
The privacy policy (updated March 12, 2026) states that American, like other airlines, provides border-control agencies and customs authorities with access to booking and travel data as a legal obligation in the US, UK, EU and other countries, and that American has no control over that data once delivered; the same policy permits sharing with AAdvantage travel and co-brand partnerships and payment networks.
In June 2023 American Airlines disclosed a data breach caused by the hack of Pilot Credentials, a third-party vendor managing pilot application portals; per notifications filed with Maine's Attorney General, 5,745 American pilots and applicants were affected, with the incident limited to the vendor's systems.
American's Form 10-K for fiscal year 2025 (filed February 18, 2026) documents a cybersecurity risk management program assessed against NIST security standards, overseen by an Executive Cybersecurity Risk Group and a Chief Information Security Officer reporting to the Board of Directors.
The privacy policy (updated March 12, 2026) states American uses information about browsing across devices to serve targeted advertising on its own and third-party websites, and directs users to the Digital Advertising Alliance and Network Advertising Initiative to opt out of interest-based advertising.