Global Airlines (Top 40) · Airline (Europe, ULCC) · Data breach
Ryanair
Headline
Ryanair's facial-recognition verification requirement is the finding: passengers who book through third-party travel agents have been pushed to submit a biometric facial scan to access their own booking, a step not…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Ryanair's facial-recognition verification requirement is the finding: passengers who book through third-party travel agents have been pushed to submit a biometric facial scan to access their own booking, a step not required of people who book direct. That converts a privacy intrusion into a commercial weapon - the biometric demand functions as friction aimed at a distribution channel Ryanair dislikes, with passengers as the leverage. The Vienna-based digital-rights group noyb has filed GDPR complaints over the practice in Spain (July 2023) and Italy (Dec 2024); no regulator decision on either was located as of Oct 2026. Under GDPR, biometric data is a special category requiring an unusually high bar for lawful processing, and 'we would prefer you had booked directly' is not one of the recognised bases.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected; UK/EU GDPR framework applies to the complaints above.
Data sharing
MULTIPLE GDPR COMPLAINTS (no regulator decision located; status not re-verified as of Oct 2026): (1) Vienna-based digital-rights group noyb filed a complaint (2024-2025) alleging Ryanair's mandatory account-verification system — which can require 'invasive biometrics' (facial recognition) — violates GDPR, with noyb estimating a potential fine of up to EUR 450 MILLION (4% of Ryanair's 2023 turnover; complaint filed with Italy's data protection authority, Dec 2024); noyb specifically argues Ryanair could use a less-intrusive method (e.g., two-factor authentication) instead of collecting biometric data, and separately alleges the verification system discourages bookings through independent online travel agencies (OTAs) in favor of direct Ryanair bookings, potentially reducing competition — an issue the complaint links to a related, PRE-EXISTING investigation by the Italian Competition Authority into Ryanair limiting air-travel competition. A SEPARATE, earlier noyb complaint (filed July 27, 2023 with Spain's AEPD) over the same facial-recognition requirement cited a possible fine of up to EUR 192 million. (2) The complaint also raises GDPR Article 17 ('right to erasure') concerns about account deletion. Ryanair's own defense: it argues the verification step is necessary because independent OTAs sometimes 'scrape' Ryanair's inventory, mis-sell flights with hidden markups, and provide incorrect customer contact/payment details — framing the biometric requirement as a customer-protection measure rather than a competition-limiting one. (3) SEPARATE, MOST RECENT (April 2026, unverified attacker claim): per Cybernews reporting summarized by SC World (Apr 30, 2026), a threat actor on underground forums claimed to have stolen Ryanair internal emails, booking and flight records, and data from a passenger-compensation legal claims platform including banking details; Ryanair had not confirmed the breach (a Nov 2025 forum leak titled "Ryanair Internal Communications" by the actor "888" was also reported) — part of a broader 2025-2026 surge in cyberattacks against airlines/aviation suppliers (WestJet, Hawaiian Airlines, Collins Aerospace, Malaysia Airlines, and others all separately confirmed breaches in the same window, per Cybernews reporting).
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy ryanair.com/gb/en/useful-info/terms-conditions/privacy | Not fetched yet | NO (HTML only) |
| Terms of service ryanair.com/gb/en/useful-info/terms-conditions | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.