• by Wendy Davis , Staff Writer @wendyndavis, November 22, 2023

Apparently not content with merely transporting passengers from one city to another, United Airlines reportedly may get into the behavioral targeting business.

The air carrier is said to be considering sharing data it collects about passengers with brands so that they can target passengers with personalized ads, which could appear either on in-flight entertainment screens or in United's app. That's according to a report in Wednesday's Wall Street Journal. The specifics are still vague, and United declined to answer MediaPost's questions about the initiative.

The company plans to allow people to opt out “in accordance with privacy laws,” according to the Journal.

It's not clear what privacy laws United is referring to. While around a dozen U.S. states now have laws that allow people to opt out of some forms of behavioral targeting, those laws may not apply to air carriers. That's because a federal measure -- the 1978 Airline Deregulation Act -- explicitly prevents states from enforcing any law relating to carriers' “rates, routes, or services.”

Delta Air Lines already prevailed with that argument. In 2016, the airline convinced a California appellate court that a California privacy law didn't apply to air carriers.

That ruling grew out of a battle dating to 2012, when Vice President Kamala Harris -- then serving as California attorney general -- sued Delta for allegedly violating a state law requiring website operators to display links to privacy policies. Harris alleged that even though Delta's website has a privacy policy, the document doesn't detail everything collected by the Fly Delta app -- including geolocation data and photos.

Harris sought an injunction banning Delta from continuing to offer the app until it adds a privacy policy, and fines of up to $2,500 per download.

Delta successfully argued that the federal Airline Deregulation App overrode California's then-existing privacy law, the Online Privacy Protection Act (OPPA).

"If each state were to require Delta to comply with its own version of the OPPA, it would force Delta to design different mobile applications to meet the requirements of each state," the appellate court wrote. "Enforcement of the OPPA’s privacy policy requirements might well make it impossible for an airline to use a mobile application as a marketing mechanism at all."

Attorney Daniel Goldberg, a privacy expert and partner at Frankfurt Kurnit Klein & Selz, says United also has “good arguments that they're exempt” from state privacy laws in the U.S., based on a historical reading of cases.

But, he adds, the situation could change, depending on judges' interpretation of the relevant statutes.

Goldberg also notes that even if state privacy laws were held unenforceable against United, the company would still have to comply with Europe's broad data protection laws.

Legalities aside, United may still want to tread lightly when it comes to behavioral targeting. People who agree with critics' assessment that behavioral advertising is “creepy” will likely find it more so when their in-flight ads differ from the ones shown to their seatmates.