Ryanair Holdings plc is an Irish, Nasdaq-listed (ADS ticker RYAAY) low-cost airline group whose FY2026 Form 20-F (filed 2026-06-22) discloses that in October 2024 the Irish Data Protection Commission (DPC) launched an inquiry into Ryanair's booking-verification process, which requires passengers whose bookings were made through unauthorized intermediaries (e.g. some OTAs) to re-verify contact or payment details; the filing states the inquiry is ongoing and could lead to a substantial GDPR fine if the DPC finds non-compliance. Ryanair's own privacy-policy page (ryanair.com/gb/en/lp/privacy-policy) is a client-side rendered single-page app whose legal text loads via a runtime data call not present in the static HTML, so it could not be cited directly with the pipeline's fetch method (one Wayback snapshot attempt returned the same empty shell); the App Store privacy label was used instead and shows data linked to identity spanning precise/coarse location, contact info and identifiers, used for analytics and app functionality, with no "Data Used to Track You" (cross-app tracking) category declared. The 20-F's own "Marketing and Advertising" section describes co-operative advertising campaigns with other travel-related entities and direct-marketing outreach to its customer database. No independent security audit, breach-notification filing, or completed privacy fine was found in primary sources within scope; the DPC matter remains an open inquiry, not a finding.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
9 ON FILE
COLLECTION
Ryanair's Apple App Store privacy label (self-reported by developer Ryanair Ltd.) discloses that data linked to the user's identity includes precise and coarse location, contact info (email address, name, phone number), and identifiers (user ID, device ID), among other categories.
Ryanair Holdings plc's FY2026 Form 20-F states that the Irish Data Protection Commission's October 2024 inquiry concerns Ryanair's requirement that passengers verify their details where a booking raises suspicion that contact or payment details were withheld from Ryanair by an unauthorized intermediary and replaced with single-use (virtual) contact or payment details — i.e., Ryanair re-collects/re-verifies passenger contact and payment information in these cases.
Ryanair's corporate website states that Ryanair Holdings plc is the parent company of Buzz, Lauda, Malta Air, Ryanair and Ryanair UK, describing itself as Europe's largest airline group.
Ryanair Holdings plc's FY2026 Form 20-F identifies its American Depositary Shares (each representing two Ordinary Shares) and its Ordinary Shares as both registered on The Nasdaq Stock Market LLC under ticker RYAAY, and reports 1,043,931,708 Ordinary Shares outstanding as of the period covered by the report.
Ryanair's FY2026 Form 20-F, describing its marketing strategy, states that its marketing activities include co-operative advertising campaigns with other travel-related entities, including local tourist boards, and that Ryanair regularly contacts people registered in its own database about promotions and special offers.
Ryanair's FY2026 Form 20-F discloses that in October 2024 the Irish Data Protection Commission launched an inquiry into Ryanair's booking-verification process, that Ryanair has engaged with the DPC arguing the process complies with GDPR, and that the inquiry is ongoing and could lead to a substantial fine if the DPC finds the process non-compliant. No fine or adverse finding had been issued as of the filing date.
Ryanair's App Store privacy label states that identity-linked data (including usage data) may be used for the purposes of Analytics, Product Personalization, and App Functionality; the label does not include a "Data Used to Track You" (cross-app/cross-site tracking) section at all, unlike labels that declare an advertising/tracking purpose for linked data.