United Airlines Holdings, Inc. (Nasdaq: UAL) is a Delaware holding company whose wholly-owned subsidiary United Airlines, Inc. operates one of the largest U.S. airline networks. Its privacy policy describes collection of passport and government ID data, images and biometric information, travel and non-travel purchase history, and website/app activity data, and states that all collected categories except health, biometric and security information may be "sold" or "shared" for cross-context behavioral advertising under U.S. state-law definitions. United monetizes MileagePlus through a Chase co-brand card agreement, launched the Kinective Media ad network built on travel-behavior insights in 2024, and in 2020 pledged MileagePlus IP including member data as bond collateral. It publishes a vulnerability disclosure program and SEC-filed cybersecurity disclosures.
TRACK RECORD
1 ENFORCEMENT ACTION
[2025-02-27]
In Item 1C (Cybersecurity) of its Form 10-K for fiscal year 2024, United Airlines Holdings discloses a cybersecurity risk management program informed by industry-standard frameworks such as those published by NIST, integrated with enterprise risk management and subject to board oversight.
United's privacy policy (state-specific section last updated November 15, 2023; archived December 31, 2023) lists collected categories including passport information and photograph, government ID, images and biometric information, purchase information for both travel and non-travel purchases, and user activity data from its websites and apps; it also describes optional participation in biometric travel programs such as CBP's Traveler Verification Service.
United Airlines Holdings' Form 10-K for fiscal year 2024 (filed February 27, 2025) states that in regular business operations the company collects, processes, stores and transmits sensitive data, including customers' and employees' personal information, to commercial partners.
United's privacy policy (state-specific section last updated November 15, 2023; archived December 31, 2023) publishes a dedicated U.S. state-specific rights section describing residents' privacy rights and how to exercise them, alongside a dated change log for the policy itself.
United Airlines Holdings' Form 10-K for fiscal year 2024 (filed February 27, 2025) discloses a transparent corporate structure: United Airlines Holdings, Inc., a Delaware-incorporated holding company listed on Nasdaq, whose wholly-owned subsidiary is United Airlines, Inc.
A United Airlines Holdings Form 8-K dated July 2, 2020 discloses that, as part of the MileagePlus senior secured notes financing, United and MileagePlus Holdings contributed their rights to certain MileagePlus intellectual property — explicitly including brands and member data — to MIPA, a bankruptcy-remote subsidiary, as part of the collateral structure securing $3.8 billion of 6.50% notes and a related credit agreement.
United's privacy policy (state-specific section last updated November 15, 2023; archived December 31, 2023) states that, under broad U.S. state-law definitions, United may "sell" or "share" for cross-context behavioral advertising all categories of personal information it collects, excepting health information, images and biometric information, and security information.
United Airlines Holdings' Form 10-K for fiscal year 2024 discloses a Co-Brand Agreement with JPMorgan Chase Bank under which MileagePlus members earn miles on purchases with a Chase-issued MileagePlus credit card, an agreement that also provides for joint marketing between the companies.
United Airlines operates a published vulnerability disclosure (bug bounty) program, which its program page (archived October 5, 2024) describes as the first of its kind within the airline industry, rewarding researchers who report security vulnerabilities affecting its websites, apps and online portals.
In Item 1C (Cybersecurity) of its Form 10-K for fiscal year 2024, United Airlines Holdings discloses a cybersecurity risk management program informed by industry-standard frameworks such as those published by NIST, integrated with enterprise risk management and subject to board oversight.
United's privacy policy (last updated March 12, 2021; archived December 31, 2023) documents the use of cookies, web beacons and similar technologies, third-party analytics tools such as Google Analytics, and participation in NAI/DAI third-party advertising networks that deliver targeted advertisements, with links to industry opt-out pages.
In its Form 10-K for fiscal year 2024, United Airlines Holdings describes launching Kinective Media, an advertising media network that uses insights derived from customers' travel behaviors to deliver personalized advertising and offers from other brands.