Two senior U.S. lawmakers have formally asked the Government Accountability Office to investigate the Department of Transportation’s failure to enforce rules protecting airline passengers’ personal data.
Senator Ron Wyden and Representative Shontel Brown cited what they described as decades of inaction by the USDOT, which has never brought an enforcement case related to passenger data despite repeated privacy breaches affecting hundreds of millions of travelers. The lawmakers’ letter to the GAO argues that the department’s ‘abdication of its role as a privacy regulator’ has left sensitive travel records exposed to corporate misuse and warrantless government surveillance.
The request follows a March 2024 review initiated by then-Transportation Secretary Pete Buttigieg, which examined how the 10 largest U.S. airlines collect and use passenger information. Two years later, the lawmakers said it remains unclear whether the review produced any public findings or led to enforcement actions. A USDOT spokesperson did not immediately respond to requests for comment.
The GAO confirmed receipt of the letter and said it would determine how to proceed. Airlines for America, an industry group representing major carriers, declined to comment.
The call for scrutiny also highlights broader concerns about the handling of passenger data. The Airline Reporting Corporation, a database collectively owned by U.S. airlines, previously sold access to a system containing approximately 722 million passenger travel records to federal agencies including the Department of Homeland Security and the Internal Revenue Service. That arrangement ended in November 2025, but the DHS has since issued a public request for contractors to develop a replacement airline passenger surveillance system.
A 2016 Justice Department audit also found that the Drug Enforcement Administration paid airline employees millions of dollars to obtain private passenger data without warrants. The lawmakers’ letter warns that foreign adversaries may find travel data held by airlines and travel agencies of intelligence value.
Federal rules allow the USDOT to treat mishandling of consumer data as an unfair or deceptive practice, potentially subjecting airlines to civil penalties.
