American Airlines Security & Privacy Scorecard
Android
In-app behavior, including flight searches and booking activity, is captured by session-recording tools from QuantumMetric and Celebrus. Interactions are also shared with Adobe Experience Cloud, Google Analytics, and Firebase for marketing and behavioral tracking. Users have limited ability to opt out of this data collection within the app.
Best for
Frequent flyers comfortable with behavioral analytics
Avoid if
You prefer travel activity not session-recorded
Findings
- 1 critical
- 2 high
- 1 medium
- 0 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- Unencrypted OAuth Token Storage
- Hardcoded Airship Production Credentials
- Unencrypted Boarding Pass Storage with Flight Boarding Credentials
Top privacy issues
- Excessive Session Recording Without Visible Consent
- Auto Opt-In to Celebrus Tracking Without Consent
- PII Transmitted to Multiple Analytics Vendors
Full analysis
American Airlines
Version: 2026.2 | Platform: Android | Scan Date: February 12, 2026
What This Means for You
In-app behavior, including flight searches and booking activity, is captured by session-recording tools from QuantumMetric and Celebrus. Interactions are also shared with Adobe Experience Cloud, Google Analytics, and Firebase for marketing and behavioral tracking. Users have limited ability to opt out of this data collection within the app.
Recommendation: Use With Caution
Best For: Frequent flyers comfortable with behavioral analytics
Avoid If: Session recording of travel activity is a concern
Key Findings
Data Security - 3 findings (1 critical, 1 high, 1 medium)
Network Security - 2 findings (2 high)
Code Safety - 0 findings
Privacy - 4 findings (1 critical, 2 high, 1 medium)
Privacy Concerns
What Data is Collected
American Airlines collects behavioral data across user sessions, including flight searches, booking interactions, and browsing patterns. This data may be linked to the user's account and device across multiple sessions.
Third-Party Data Sharing
Data is shared with the following third-party services:
- QuantumMetric - Session recording and behavioral analytics
- Adobe Experience Cloud - Marketing and behavioral tracking
- Celebrus - Session recording and digital analytics
- Firebase Analytics - App usage and performance tracking
- Google Analytics - Behavioral analytics
- Airship - Push notifications and in-app messaging
- ASAPP Chat - In-app customer support chat
- LocusLabs - Airport mapping and indoor navigation
- Akamai Bot Manager - Traffic filtering and access control
- PairIP - Application integrity checks
- BouncyCastle - Cryptographic library
Understanding the Scores
| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 35/100 |
| Data Security | 40/100 |
| Network Security | 75/100 |
| Code Safety | 70/100 |
| Data Collection | 50/100 |
| Data Sharing | 55/100 |
| User Control | 40/100 |
Positive Security Features
No notable positive security features were identified in this version.
Areas for Improvement
- Travel activity and in-app behavior is shared with multiple advertising and analytics platforms, with very limited controls available to reduce this sharing.
- Session recording tools capture detailed logs of how users interact with the app, including search patterns and navigation through the booking flow.
- The app provides minimal in-app options to opt out of behavioral data collection or limit how data is used for marketing purposes.
About This Analysis
This scorecard reflects the security and privacy posture of the American Airlines Android app at the time of analysis. Findings are based on static analysis of the application package.
App Details
- App Name: American Airlines
- Package ID: com.aa.android
- Version: 2026.2
- Platform: Android
- Scan Date: February 12, 2026
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #2 (current) | 40/100 |