Southwest Airlines Co. (NYSE: LUV) is a U.S. public airline whose Privacy Policy & Data Options page (last updated March 30, 2026) discloses collection of a broad range of personal information, including government-issued ID, precise geolocation, and (for some individuals) genetic or biometric information, and states Southwest engages third-party ad networks and analytics providers (including Google Analytics) for retargeting while explicitly declining to honor browser Do Not Track signals. The policy names secondary sharing with business partners and "financial institution Rewards Partners" for co-branded credit-card marketing, and offers a CCPA-style opt-out for consumers who do not want information "sold or shared ... for valuable consideration." Southwest's own FY2025 Form 10-K (filed 2026-02-05) confirms it is a Texas-incorporated, NYSE-listed public company, and separately discloses that in December 2023 the U.S. DOT assessed a $140 million civil penalty tied to the December 2022 operational meltdown — a consumer-protection/operational action, not a privacy-enforcement matter, later partly waived in December 2025. A California AG breach-notification record for "Southwest Airlines co." shows a breach dated October 1, 2017 (tied to third-party booking vendor Orbitz); no privacy-specific regulator finding or independent security audit was found in primary sources within scope.
TRACK RECORD
1 ENFORCEMENT ACTION
California's Attorney General maintains a public data-breach notification record naming "Southwest Airlines co." with a breach date of October 1, 2017, submitted via a sample notice titled "Orbitz- SW- CA Letter.pdf," indicating the incident was tied to third-party booking vendor Orbitz rather than a first-party Southwest system compromise.
Southwest's Privacy Policy & Data Options page (last updated March 30, 2026) states that the "Personal Information" it collects may include sensitive categories such as present and future health status (e.g., to assist with wheelchair boarding or safety requirements), citizenship, government-issued ID number, precise geolocation, and genetic or biometric information.
Southwest Airlines Co.'s FY2025 Form 10-K (period ended 2025-12-31, filed 2026-02-05) identifies it as a Texas corporation trading on the NYSE under ticker LUV, reporting 491,317,990 shares of common stock outstanding as of February 3, 2026.
Southwest's Privacy Policy lists secondary purposes for sharing information, including sharing with business partners, affiliates, and other third parties for their own marketing/promotional purposes, and specifically with financial-institution Rewards Partners for direct marketing including co-branded credit cards. The same page offers a consumer-rights mechanism letting individuals request that Southwest not "sell or share" their personal information to third parties "for valuable consideration" — a self-declared CCPA-style sale/share disclosure with an opt-out link.
California's Attorney General maintains a public data-breach notification record naming "Southwest Airlines co." with a breach date of October 1, 2017, submitted via a sample notice titled "Orbitz- SW- CA Letter.pdf," indicating the incident was tied to third-party booking vendor Orbitz rather than a first-party Southwest system compromise.
Southwest's FY2025 Form 10-K discloses that in December 2025 the U.S. Department of Transportation amended a December 2023 order that had assessed a $140 million civil penalty on the company resulting from its December 2022 operational disruption, waiving the final cash installment and issuing an $11 million credit for improved on-time performance. This is a consumer-protection/operational-reliability enforcement action, not a privacy-specific finding, and is cited here only as documented federal regulatory enforcement history, not as evidence of a privacy violation.
Southwest's Apple App Store privacy label (self-reported by the developer, Southwest Airlines Co.) discloses that data "linked to your identity" — including contact info, search history, identifiers, usage data, Health & Fitness, Financial Info, and Sensitive Info — may be collected and used for the developer's "Advertising or Marketing" purpose.
Southwest's Privacy Policy states the company engages third-party ad networks and exchanges that use cookies, web beacons, pixels, and other technologies for retargeting and interest-based advertising, uses Google Analytics, and explicitly states that Southwest does not alter its practices when it receives a Do Not Track browser signal.