Where flight booking data goes

One booking can create records in several places

American Airlines' March 12, 2026 policy describes records for American flights bought through other airlines or agencies, including itinerary changes, cancellations, baggage, companion and payment information. It can link bookings with loyalty records. The booking website and operating airline can be separate record holders. American Airlines: booking data, codes and retention

Expedia shares reservation information with suppliers that fulfill bookings, including airlines and hotels. Suppliers have their own privacy notices and may receive payment details depending on the payment model. A booking-platform choice does not necessarily control each supplier's records. Expedia: suppliers, preferences and retained records

Some passenger information is required to provide the trip

American's Secure Flight guidance lists the traveler's full name as shown on the travel ID, date of birth, gender and a redress number if applicable. It says this information must be in the reservation at least 72 hours before departure, or at booking for a reservation made within that window. This is airline guidance about required passenger data, not a description of every government database or retention period. American Airlines: Secure Flight booking requirements

DOT's airline privacy page distinguishes airlines and ticket agents from TSA and CBP, which have separate authority over passenger information. Do not combine commercial booking records and government screening systems into one supposed database with one deletion switch. U.S. DOT: airline and ticket-agent privacy

A booking reference can reveal more than a flight number

Delta's October 2026 policy says a booking reference should remain confidential because disclosure may allow access to booking details. It also notes that people traveling on the same booking may see individual details. This makes a reservation code different from an ordinary public route or flight number. Delta: booking references and retention scope

IATA's Common Use Standards page explains that two-dimensional boarding-pass barcodes convey encoded boarding-pass data on paper and mobile devices. The code itself carries information. Treat the full boarding pass, including the code, as private when deciding what to post or forward. This guide has not decoded or tested any traveler's pass. IATA: boarding-pass barcode standards

Browser choices and record retention have different scopes

Expedia's cookie statement describes device identifiers, viewed pages, advertising interactions and app activity, alongside essential functions for signing in and managing bookings. Advertising choices can affect browser or app tracking without deleting the reservation needed to deliver a trip. Its essential cookies have different rules from optional targeting cookies. Expedia: optional cookies and advertising choices

American generally retains travel or program information for up to seven years after travel completion or membership termination, with stated legal qualifications. This is not a deadline for every data category. American Airlines: booking data, codes and retention

Delta describes retention according to processing needs, its retention policies and legal requirements, and directs specific-period questions to its privacy request route. A receipt disappearing from a screen does not establish that every associated record has been erased. Delta: booking references and retention scope