You book a flight on Expedia. You pick your seat, punch in your credit card, and close the tab. Transaction over, right? Not even close. Sitting between the airline and your booking platform is a company called the Airlines Reporting Corporation — ARC — an airline-owned data intermediary most travelers have never heard of. According to documents obtained by 404 Media, the SEC gained access to an surveillance app-scale ARC database reportedly containing more than a billion ticketing records. Not just domestic flights. Flights between foreign countries. Flights entirely within foreign countries.
The Data Broker You’ve Never Heard Of
ARC quietly processes booking data from over 270 carriers and thousands of travel agencies worldwide — and has done so for decades under almost no public scrutiny.
Five billion plane ticket records. More than 270 carriers. Over 12,800 travel agencies. That’s the reported scale of ARC’s full database leak-era dataset. Every time you buy a ticket through a major booking site, ARC receives the transaction data — your name, credit card number, departure and arrival cities, flight dates, flight numbers, and the agency that sold the ticket. Think of ARC as the facial-recognition-scale data broker of air travel, except unlike companies whose surveillance practices drew congressional hearings, ARC has operated quietly for decades with almost no public scrutiny or regulatory pushback.
“ARC’s data was not limited to U.S. domestic travel; it also included flights between foreign countries and flights entirely within foreign countries.” — 404 Media
ARC built its Travel Intelligence Program (TIP) after September 11, 2001, originally framing it as a national security tool for tracking terrorists, human traffickers, and drug networks. That framing made sense in 2001. What’s harder to explain is a financial regulator reportedly running daily search alerts — up to 25 per day — on passenger names through the same system, according to 404 Media. The SEC has not commented on why a markets regulator needs that kind of reach.
What the SEC Was Actually Looking At
The program’s geographic reach extended well beyond American airspace, raising questions about legal oversight that no agency has yet answered publicly.
According to 404 Media’s reporting, the SEC’s access covered the full TIP dataset: searchable ticketing records with daily name-alert functionality, spanning routes between foreign cities and domestic routes inside other countries. This is surveillance infrastructure with effectively no geographic boundary. The legal basis for that access remains publicly unknown — the SEC did not respond to requests for comment, leaving the justification entirely opaque.
Prior 404 Media reporting prompted ARC to stop selling ticketing records and drew lawmaker scrutiny. But newly obtained documents suggest the dataset’s scope ran broader than anyone previously understood. The same commercial data pipeline that makes your booking seamless quietly routed your payment and itinerary information to federal agencies, mirroring concerns raised by reports of secretly tracking users across government platforms.
That legal basis remains publicly unknown — and no agency, airline, or lawmaker appears to be in a hurry to explain it to the travelers whose data quietly funded the investigation. Booking a flight now means generating a data trail you never consented to share with federal regulators, and the infrastructure enabling that arrangement shows no signs of disappearing.
