At this point, most Americans are aware that their personal information is often up for sale. But few would have expected their domestic flight records to be part of the trade.
You might think that when you book a flight, the data stays between you, the airline and perhaps your travel agency, but a new report suggests otherwise. Internal documents reveal that major U.S. airlines have been funneling detailed passenger data to a little-known broker, which then sells that information directly to the Department of Homeland Security.
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER
Which airlines shared data and how the travel intelligence program works
At the center of the controversy is the Airlines Reporting Corporation (ARC), a company jointly owned by several of the largest U.S. airlines, including Delta, American Airlines and United. ARC’s core business includes managing ticket settlements between airlines and travel agencies. However, under a lesser-known initiative called the Travel Intelligence Program (TIP), ARC collects and monetizes vast amounts of data from domestic flight bookings. This includes names, complete itineraries and payment details.
Internal government records and procurement documents reveal that Customs and Border Protection (CBP), part of the Department of Homeland Security, has purchased access to ARC’s TIP data to track individuals of interest across the U.S. While CBP maintains that this data supports criminal and administrative investigations, critics argue that the arrangement raises major privacy concerns.
The data is shared without travelers’ knowledge or consent, and ARC reportedly requested that the agency keep its identity confidential unless legally required to disclose it.
The documents confirm that CBP’s initial contract with ARC began in June 2024. It has already been extended and may continue through 2029. Although the initial amounts seem modest, around $11,000 with a recent $6,800 update, the implications are far-reaching.
What DHS is collecting from your flight bookings and why it’s concerning
ARC’s Travel Intelligence Program goes far beyond basic passenger manifests. It includes over a billion records spanning both past and future travel, updated daily. The system can be queried by name, credit card or even travel agency. Importantly, it does not include data from tickets purchased directly through airline websites, focusing instead on bookings made via travel agencies, such as Expedia.
The DHS has justified its use of TIP data in a public Privacy Impact Assessment, noting the program helps in active investigations. CBP echoed this, stating that data is only used when a case is already open. Still, this sets a dangerous precedent. It normalizes mass surveillance through third-party data purchases, undermining safeguards designed to limit unnecessary intrusion.
This isn’t an isolated incident. Last month, Immigration and Customs Enforcement also acknowledged purchasing ARC data. Other federal agencies listed in procurement records include the Secret Service, SEC, DEA, TSA and even the Air Force.
6 ways you can protect your privacy from data brokers
If you want to take back control of your personal information, here are six smart steps you can take right now to reduce your exposure to data brokers.
Whenever you can, avoid using third-party travel sites like Expedia, Orbitz or travel agencies. These platforms are the main sources of the data collected by the Airlines Reporting Corporation (ARC) through its Travel Intelligence Program. When you book directly on an airline’s official website or mobile app, your data is far less likely to be shared with ARC or sold to government agencies. While it might be tempting to look for deals on aggregator sites, once you find a fare you like, try to book it directly through the airline.
The ARC system allows queries by credit card number, which means your travel activity can be tracked even if your name is not directly searched. To protect yourself, consider using a virtual credit card or a disposable card number for flight bookings. These are often available through banking apps or fintech services like Revolut, Privacy.com or certain American Express accounts. Virtual cards are tied to your main account but generate a temporary number that can only be used once or at a specific merchant. This makes it much harder for brokers to link future bookings to you.
Be cautious about the personal information you enter during the booking process. Unless it is legally required, avoid adding unnecessary details like your frequent flyer number, passport data for domestic flights or secondary phone numbers. You can also create a separate email address specifically for travel bookings to reduce the risk of cross-linking data with your other online accounts. When it comes to loyalty programs, consider opting out or using a separate identity if you are concerned about data being shared across companies.
The most effective way to take control of your data and avoid data brokers from selling it is to opt for data removal services. While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com/Delete
Prevent tracking at the source by using privacy-first tools. Switch to browsers like Brave, Firefox or DuckDuckGo, which block ads and data collectors by default. Set up a separate, secure alias email address for booking travel using services. This limits how easily brokers can link your travel data to your online identity. See my review of the best secure and private email services by visitingCyberguy.com/Mail
If your travel or payment data is ever leaked or abused, freezing your credit can help prevent identity theft. Identity theft companies can assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals. They can also monitor personal information like your Social Security number, phone number and email address and alert you if it is being sold on the dark web or being used to open an account.
One of the best parts of my No. 1 pick is that is it has identity theft insurance of and a white glove fraud resolution team where a . See my tips and best picks on how to protect yourself from identity theft by visiting Cyberguy.com/IdentityTheft
Kurt’s key takeaway
The ARC incident is yet another example of federal agencies bypassing traditional legal channels by buying sensitive data from private firms. Travelers are not just passengers, they are data points in a growing ecosystem where information is currency. The fact that this trade happened without informed consent and behind legal smokescreens should worry anyone who values privacy.
Would you change how you book flights if it meant protecting your personal data? Let us know by writing to us at Cyberguy.com/Contact
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER
Copyright 2025 CyberGuy.com. All rights reserved.