Expedia
- The policy allows AI training; it does not describe an opt-out.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- Staff may review your content; the policy does not describe an opt-out.
Expedia collects a lot of travel, device, and ad data, uses it for AI and targeting.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
- Uses your content for AI training with no opt-out
Collected
They collect bookings, IDs, payments, device data, location, photos, chats, and data about other travelers.
Read the exact line
Privacy policy
“We also receive personal data from affiliated companies within Expedia Group, as well as business partners and other third parties, which help us improve our platform”
Training
They use your data for bookings, ads, loyalty, fraud, and many AI tools including chatbots and rankings.
Read the exact line
Privacy policy
“We use artificial intelligence (AI) and machine learning (ML) for various purposes to deliver our platform and associated services.”
Sharing
Expedia Group, hotels and airlines, service providers, and ad and social platforms can get your data.
Read the exact line
Privacy policy
“We may disclose your personal data to our third-party marketing partners for targeted advertising.”
Kept
They keep data as long as they say they need it for those purposes or the law.
Read the exact line
Privacy policy
“We will retain your personal data in accordance with all applicable laws, for as long as it may be relevant to fulfill the purposes set forth in this Privacy Statement”
Controls
You can change marketing settings, cookie choices, and ask to access or delete data in your account or by contacting them.
Read the exact line
Privacy policy
“You can access, amend, inquire about deletion of, or update the accuracy of, your personal data at any time by either logging into your account or contacting us”
Fine print
They can change rewards rules, and they limit their .
No exact line could be verified.
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Opt out of marketing emails
Unsubscribe link in marketing emails, account communication settings, or Contact Us
Control non-essential cookies
Cookie Statement / cookie preferences on the site
Ask to access or delete personal data
Log into your account or Contact Us / Privacy Section
Leave the loyalty program
Delete your Account as described in Rewards Terms section 2
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They build ad profiles from your account and device IDs and show targeted ads.
Read the exact line
Privacy policy
“Deliver targeted advertising and advertising based on your profile and identifiers (e.g. user ID, device advertising ID, email address, phone number).”
For example, searching for beach hotels can follow you as ads on other sites.
They share personal data with ad partners. Some US residents can opt out.
Read the exact line
Privacy policy
“We may disclose your personal data to our third-party marketing partners for targeted advertising. This may be considered to be “sharing” of data under California law.”
For example, California users can use their opt-out rights so partners get less of this sharing.
People can listen to or read your support calls and chats for training and quality.
Read the exact line
Privacy policy
“Monitor or record calls, chats, and other communications with our customer service team and other representatives, as well as platform communications between or among partners and travelers for quality control, training, dispute resolution”
For example, a chat with the virtual agent about a canceled flight may be reviewed later.
Your personal data can feed many AI systems, with no training opt-out described.
Read the exact line
Privacy policy
“We use artificial intelligence (AI) and machine learning (ML) for various purposes to deliver our platform and associated services. We may use your personal data for the following purposes:”
For example, your searches and chats can help ranking, recommendations, and embeddings.
They collect location from IP and, if you allow it, exact live location.
Read the exact line
Privacy policy
“Geolocation data – including inferred location from IP address, country selected to use our website, and exact, real-time location (with your consent)”
For example, the app can use your phone’s live location to show nearby hotels.
Calls with support can be recorded and stored as personal data.
Read the exact line
Privacy policy
“Voice data – in certain instances, your voice may be recorded in specific interactions with our Customer Services Teams.”
For example, calling about a booking can create a voice recording they keep for service purposes.
They say they will warn you before big privacy changes, except urgent legal or security cases.
Read the exact line
Privacy policy
“If we propose to make changes that will materially impact your rights or obligations, we will provide you with reasonable advance notice of such changes, unless the changes are urgently required to meet security, legal, or tax requirements.”
For example, a new ad-sharing practice should come with notice before it starts.
They describe security controls and payment-card certification.
Read the exact line
Privacy policy
“We have established an information security protection system based on industry standard practices and perform regular assessment and certifications, such as PCI-DSS certification.”
For example, card data is supposed to be handled under PCI-DSS rules.
The loyalty program is offered as-is with almost no promises it will work.
Read the exact line
Terms of service
“The Programs are provided without any (either express or implied) or implied term of any kind, including but not limited to any or implied terms of satisfactory quality, , or non-infringement.”
For example, if points fail to post, they disclaim most .
Words to know
Legal words from the lines above, in plain English.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- targeted advertising
- Ads chosen for you based on what you have done across other apps and websites, not just this one. For example, you look at shoes in one app and see shoe ads in a totally different app the next day.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- device identifiers
- Codes that single out your phone or computer, used to recognise you across apps and sites. For example, the advertising ID on your phone lets two unrelated apps know they are seeing the same person.
- precise geolocation
- Your exact position, usually from GPS, often accurate to within a few metres. For example, an app can tell not just your city but which building you are in right now.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
- warranty
- A promise that a product will work as described; most apps say they make no such promise at all. For example, if a paid feature never works on your phone, a no-warranty clause says that is your problem.
How we got here · grade D · score 37/100 · 15 of 15 policy answers backed by a verified quote · 2 not stated
What does the app collect beyond what it needs to work?
They collect far more than a booking needs, including device IDs, clickstream, exact location with consent, photos, co-traveler data, and data from third parties.
Does it record your voice, face or body, and what happens to that?
Support calls can be recorded, and they also collect images and facial photos you upload or pull from social login.
Are your chats and uploads used to train AI models, and is that off by default?
They say they may use personal data in many AI and ML systems, including embeddings, with no training opt-out described.
Can employees or contractors read your conversations, and when?
They monitor and record calls and chats for quality, training, and disputes, and do not describe an opt-out.
Are you profiled or tracked for advertising?
They run targeted ads using your profile and share data with marketing, social, and online ad platforms.
Do they sell or share your data, and can you opt out?
They share with Expedia Group, suppliers, and ad partners, and say California residents can opt out of sharing for targeted ads.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
They keep data as long as needed for stated purposes or law. You inquire about deletion in your account or by contacting them, with no 30- or 90-day wipe promised.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They build and enrich a profile across Expedia brands. You can update some account info, but there is no described off switch for that profile.
Do they commit to basic security, and have they leaked data?
They describe encryption, access controls, MFA, and PCI-DSS certification and regular assessments.
Is there a real age gate, and are teens protected?
The site is not directed at minors. Loyalty membership requires being 18 or the age of majority, self-declared. They say they cannot tell users’ ages on the site.
Will they tell you when the rules change, and is the policy specific?
The privacy statement is dated and says they will give reasonable advance notice of material changes, and it lists data types and purposes in detail.
Can they close your account without warning, and can you get your data out first?
For suspected fraud or improper loyalty activity they may close or freeze your account immediately and you can lose OneKeyCash.
If something goes wrong, who pays?
Loyalty terms disclaim warranties and limit what they will pay if the program goes wrong.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 9,391 words at a professional or legal expert level (Flesch reading ease 27.7); the terms are 11,544 words at a college level.
