WHAT THE POLICIES SAY

Expedia is the flagship online travel agency brand of Expedia Group, Inc. (NASDAQ: EXPE), whose B2C portfolio also includes Hotels.com, Vrbo, Orbitz, Travelocity, ebookers and Wotif Group. One unified privacy statement family governs the brands; it states personal information is collected directly and from other Expedia Group companies, including identification data, geolocation (exact real-time location with consent) and browsing and purchase history. One Key unifies loyalty data across Expedia, Hotels.com and Vrbo. The policy permits disclosure to third-party marketing partners for targeted advertising — possibly "sharing" under California law, with a US opt-out — and Expedia Group runs an advertising arm ($758M revenue in 2025). Orbitz disclosed a legacy-platform breach in March 2018. Expedia Group holds EU-U.S. DPF and APEC CBPR certifications and publishes SEC filings.

TRACK RECORD

1 ENFORCEMENT ACTION

[2018-03-22]

In a breach notification letter dated March 22, 2018 and filed with the California Attorney General, Orbitz (an Expedia Group brand) disclosed that an attacker may have accessed personal information on a legacy Orbitz travel booking platform between October 1, 2017 and December 22, 2017, including full name, payment card information, date of birth, phone number, email address, physical and/or billing address, and gender, for certain purchases made between January 1, 2016 and June 22, 2016.

oag.ca.gov ↗

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

11 ON FILE

[2023-10-18] · COLLECTION

Expedia's US privacy statement (Last Updated 18/10/23, Expedia Group unified statement) states that personal information — including identification data, browsing and purchase history, and geolocation — is collected directly from users, automatically from devices, and from other Expedia Group companies, and that geolocation includes exact real-time location collected with consent.

legal.expediagroup.com ↗

[2026-02-13] · COLLECTION

Expedia Group's FY2025 Form 10-K (filed with the SEC on 2026-02-13) describes One Key as a unified loyalty program spanning Brand Expedia, Hotels.com and Vrbo, launched in the United States and expanded to the United Kingdom in 2024, which consolidates traveler earn-and-redeem activity across the brand family.

sec.gov ↗

[2023-10-18] · OWNERSHIP TRANSPARENCY

Expedia's US privacy statement (Last Updated 18/10/23) documents cross-border data governance certifications: Expedia Group holds APEC Cross-Border Privacy Rules (CBPR) certification with measures established across all Expedia Group companies, and the statement also describes participation in the EU-U.S. Data Privacy Framework.

legal.expediagroup.com ↗

[2026-02-13] · OWNERSHIP TRANSPARENCY

Expedia Group's FY2025 Form 10-K (filed with the SEC on 2026-02-13) publicly discloses its B2C brand portfolio — Brand Expedia, Hotels.com and Vrbo as core consumer brands, plus other portfolio brands including Orbitz, Travelocity, ebookers and Wotif Group — under a single NASDAQ-listed parent, Expedia Group, Inc.

sec.gov ↗

[2023-10-18] · SHARING

Expedia's US privacy statement (Last Updated 18/10/23) states that personal information may be disclosed to third-party marketing partners for targeted advertising, that this may be considered "sharing" data under California law, and that some US residents have the right to opt out of such sharing.

legal.expediagroup.com ↗

[2026-02-13] · SHARING

Expedia Group's FY2025 Form 10-K (filed 2026-02-13) reports that its Expedia Group Advertising business generates advertising revenue on its global online travel brands through digital marketing solutions, with $758 million of advertising and media revenue in 2025, a 19% increase over 2024.

sec.gov ↗

[2026-05-14] · SHARING

Expedia Group's "Third-Party Data Sharing - Controllers & Joint Controllers" page (Last Updated 14 May 2026) states that personal data is shared with third parties that in some instances act as independent or joint data controllers rather than as Expedia's processors.

legal.expediagroup.com ↗

[2018-03-22] · TRACK RECORD

oag.ca.gov ↗

[2026-02-13] · TRACK RECORD

Expedia Group's FY2025 Form 10-K (Item 1C, Cybersecurity; filed 2026-02-13) documents a board-overseen cybersecurity risk management program, describing the company's process for assessing, identifying and managing cybersecurity threats, informed by industry frameworks and standards bodies.

sec.gov ↗

[2023-10-18] · TRACKING TECH

Expedia's US privacy statement (Last Updated 18/10/23) states that the company collects a chronological sequence of visitor actions on its websites and may reconstruct a user's site journey from the timing and location of their actions, for purposes including marketing and analytics.

legal.expediagroup.com ↗

[2023-10-18] · TRACKING TECH

Expedia Group's Cookie Statement (Last Updated 18/10/23) discloses the use of targeting cookies by Expedia Group and third-party partners to build personalized advertising profiles, along with pixels, web beacons and proximity-based beacons, and states that Expedia currently does not take action in response to browser do-not-track signals.

legal.expediagroup.com ↗

LAST REVIEWED 2026-08-04 · METHODOLOGY v1.7