Consumer Apps · Travel · Data breach
Expedia
Headline
Expedia's Terms are described by consumer-legal guides as nearly identical in one-sidedness to Booking.com's (this same tab) — heavy disclaimers, strict limits on recourse, courts historically enforcing them against…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Expedia's Terms are described by consumer-legal guides as nearly identical in one-sidedness to Booking.com's (this same tab) — heavy disclaimers, strict limits on recourse, courts historically enforcing them against travelers. Separately, Expedia bookings were among those exposed in the 2020 Prestige Software incident — a THIRD-PARTY VENDOR's misconfigured cloud storage holding more than 10 million reservation log files across several booking sites — the same 'it wasn't technically our system' pattern found at Marriott, Booking.com, and Target elsewhere in this tracker.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
In 2020, a misconfigured AWS S3 bucket belonging to Prestige Software, a Spain-based hotel channel-manager vendor (not Expedia itself), exposed more than 10 million log files of hotel-reservation data — including guest names, contact details and card data — tied to bookings made through Expedia, Hotels.com, Booking.com, Agoda and other sites (per Website Planet, Nov 2020) — consistent with the broader travel-industry third-party-vendor breach pattern already documented in the Booking.com row (Prestige Software, Eurail, KLM/Air France, Hertz/Dollar/Thrifty).
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (EXPE). Service route: c/o General Counsel / Corporate Secretary, Seattle, Washington — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy expedia.com/service/privacypolicy | Not fetched yet | NO (HTML only) |
| Terms of service expedia.com/service/termsandconditions | Not fetched yet | NO (HTML only) |
| Website expediagroup.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No comprehensive state privacy statute on file for Washington