The seat-back screen sees more than you think: in-flight entertainment and privacy

On a plane we think about flight safety, not data. Yet the seat-back screen and on-board Wi-Fi are a computer and a network that know your seat number, flight, route and often your loyalty number. I checked what manufacturers of in-flight systems, connectivity providers and the carriers themselves say about it.

In short

• Of 13 companies checked, only Delta openly describes a viewing log on seat-back screens — and links it to a person via the seat number and SkyMiles. The others are silent, even though viewing history, recommendations and on-screen ads clearly work on their systems.
• Screen manufacturers (Panasonic, Thales) call themselves processors: the airline is responsible for the logs, and requests go to the airline.
• On-board internet is disclosed in the most detail. Viasat collects visited domains, MAC address, aircraft location and loyalty number, and shares data with airlines, police, courts and tax authorities.
• Seat-back advertising is already here: since 2024 United shows targeted ads through Kinective Media; Panasonic picks ads on the Wi-Fi login page by seat and route.
• Cameras are built into some Panasonic screens. Airlines say they have never been switched on.
• In Russia, internet access through on-board Wi-Fi is tied to a phone number by law, and logs are kept for six months.

Summary table

“No” in the log column means the policy is silent about it, not that no log exists.

Not a new story

The topic has come up before — each time as a one-off scandal with no follow-up.

• 2015 — on-board Wi-Fi forges certificates. Google engineer Adrienne Porter Felt noticed that Gogo’s in-flight internet served passengers a fake Google certificate — in other words, it put itself in the middle of an encrypted connection. Gogo said it was blocking video streaming and was not collecting user data. The takeaway for passengers is simple: an on-board network is technically able to see more than it promises. (Techdirt, The Hacker News)
• 2016 — vulnerabilities in Panasonic screens. IOActive researcher Ruben Santamarta showed that Panasonic’s in-flight entertainment system could be used to spoof what passengers see, including the flight map, and, in some configurations, to reach loyalty-programme and payment-card data. Airlines named as using such systems included United, American Airlines, Emirates, Air France, Singapore and Qatar. (IOActive, The Register)
• 2019 — a camera under the screen. A Singapore Airlines passenger, malware researcher Vitaly Kamluk, posted a photo of a lens below his seat-back screen. Singapore Airlines, Emirates and American Airlines confirmed that newer Panasonic screens have cameras and said they are disabled and have never been used. (CNN, Runway Girl Network)
• 2019 — an attempted ban. On 22 April 2019, US senators Jeff Merkley and John Kennedy introduced the Passenger Privacy Protection Act, which would have banned cameras and microphones in in-flight entertainment systems. There is no record of it becoming law. (Senator Merkley)
• 2024 — a regulator’s review. The US Department of Transportation opened a review of the ten largest airlines: how they collect, monetise and share passenger data, including targeted advertising. (Reed Smith)

Since then the cameras are, by all accounts, still off — but seat-back ads and cross-flight profiles have become routine.

System manufacturers and connectivity providers

Manufacturers almost always call themselves processors: the airline is responsible for viewing logs, and requests should go to the airline. Internet providers act as independent controllers and openly describe collecting visited domains, MAC addresses and aircraft location, and sharing data with airlines and authorities.

Panasonic Avionics is the largest maker of seat-back screens. Its general policy was updated on 5 August 2026: for passenger data the company acts on the airlines’ instructions. It lists Wi-Fi and film purchases, device identifiers and cookies, which can be combined with airline data — name, loyalty number, flight number. Viewing logs, seat numbers, cameras and microphones are not mentioned in the general policy, and retention periods are not stated. Panasonic’s on-board internet policy (version of 28.09.2020, published by Croatia Airlines) covers seat number, route, pages visited, session length and data volume; ads on the login page are chosen by airline, route and seat.

Thales is the second major manufacturer. It has no separate public policy for passengers. In 2016 the head of Thales USA said the company itself does not collect or store this data, only gives airlines the ability to do so; a demonstration showed what the passenger in each seat was doing (Aviation Week). In 2018 Thales announced InFlyt 360: preference-based recommendations, in-flight purchases and targeted advertising for airlines.

Viasat (including former Inmarsat) provides on-board internet. It collects visited domains and visit times, app data, IP and MAC addresses, flight number, loyalty number and status, card data and aircraft location. It draws inferences about passengers’ tastes for marketing — its own and the airlines’. It keeps data “as long as there is a purpose”.

Starlink provides on-board internet for a growing number of airlines. Since 15 January 2026 its policy allows customer data to be used for AI training unless you opt out. Whether this covers passengers is not specified.

Spafax handles content and advertising: a passenger-engagement analytics and audience-profiling service for airlines.

Airlines

Only Delta openly describes a viewing log: title, genre, duration and how much was watched, linked to SkyMiles via the seat number and flight data. Personalisation requires consent; retention is not stated.

Since June 2024 United has shown personalised ads on about 100,000 screens through the Kinective Media network; according to the company, advertisers see only anonymised aggregates. JetBlue and Singapore Airlines keep a profile across flights — favourites, bookmarks, recommendations based on past viewing. American Airlines names on-board Wi-Fi providers as a source of personal data and openly mentions cross-device tracking; trip data is kept for up to 7 years. Emirates and British Airways say nothing about screens or viewing logs.

On narrow-body aircraft Aeroflot streams entertainment over Wi-Fi to passengers’ own devices; in October 2022 the feature was temporarily switched off on 46 aircraft (Tourdom). There is no public information about passenger data or identification.

Coaches and trains

On coaches, entertainment runs through a Wi-Fi portal on your phone, so the trace is a connection log with a MAC address. FlixBus lists MAC and IP addresses, connection time and duration, data volume, device type, OS, browser and language; visited sites, location and seat are not mentioned, and retention periods are not stated.

In Russia, since 2014 users of public Wi-Fi must be identified (Government Decrees No. 758 and No. 801). In practice this means a phone number with an SMS code or a Gosuslugi login, and the hotspot owner keeps logs for six months (Habr). So viewing through an on-board portal in Russia is almost always tied to a phone number.

Check the portal yourself

The on-board Wi-Fi login page is an ordinary web page. You can record it like any website:

1. In flight, open the Wi-Fi portal in a browser on a laptop.
2. Open developer tools (F12), go to the Network tab and reload the page.
3. Save the recording as a HAR file.
4. Before showing it to anyone, clean it at gdpru.eu/en/har-clean/ — the portal may contain your name and seat number.
5. Upload the file at gdpru.eu/en/har-check/: you will see whom the portal sends data to — advertising, analytics, the airline. The file does not leave your browser.

If you see third-party ads or analytics before you press “accept”, that is material for an audit. Write to contact@gdpru.eu.

What almost no policy says

• whether a per-seat viewing log is kept, and for how long;
• whether it goes to the screen manufacturer, content providers, rights holders or ad networks;
• whether data stays on the screen for the next passenger;
• whether the screen has a camera or microphone, and how to check.

Not yet checked: Lufthansa, Qatar Airways, Air France-KLM, Turkish Airlines, S7, Safran Passenger Innovations, Collins Aerospace, Anuvu.

Request template

Under Art. 15 GDPR (EU and UK) or Art. 14 of Federal Law 152-FZ (Russia) — to the airline or carrier:

Please provide the personal data you hold about me in connection with flight [number, date], seat [number], including: in-flight entertainment and Wi-Fi logs for my seat and devices; the purposes of processing and legal bases; recipients, including the system manufacturer, content providers and advertising networks; retention periods; the source of the data and whether profiling takes place.

Under the GDPR the reply is due within one month, under 152-FZ within 10 working days. If the company replies, send us the answer: with your permission it will be added to this review.