> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance-12.md).

# Travel and hospitality compliance

Travel and hospitality compliance — DOT, EU 261, ACAA, ADA, FTC junk-fees, GDPR/CCPA, PCI DSS, state emergency-pricing laws.

Travel compliance combines **transportation regulators (DOT, FAA, EU/UK/CA equivalents) + consumer-protection regulators (FTC, state AGs) + accessibility law + payment + privacy + state emergency rules**.

## Regulatory frame

| Regime                                         | Applies when                                     | Evaluation-evidence shape                      |
| ---------------------------------------------- | ------------------------------------------------ | ---------------------------------------------- |
| **DOT 14 CFR 399.84 (full-fare advertising)**  | US-touching air fare advertising                 | Total-price disclosure rule                    |
| **DOT Tarmac Delay Rule**                      | US tarmac delays                                 | Care-obligation tracking                       |
| **EU 261 / 2004**                              | Flights from EU and EU-carrier flights to EU     | Compensation accuracy; care                    |
| **UK 261**                                     | UK flights                                       | Same shape as EU 261                           |
| **Canadian APPR**                              | Air travel within / to / from Canada             | Compensation; care                             |
| **ACAA / 14 CFR Part 382**                     | US air carriers                                  | Accessibility for passengers with disabilities |
| **ADA Title III**                              | Hotels, restaurants, attractions                 | Accessibility of facilities and digital        |
| **FTC junk-fees rule (2024)**                  | Hotels, vacation rentals, live-event tickets     | Mandatory-fee disclosure up front              |
| **State emergency-pricing laws**               | Declared emergencies in CA, NY, NJ, FL, TX, etc. | Surge cap during declarations                  |
| **PCI DSS**                                    | Payment card data                                | Tokenization; no PAN in traces                 |
| **CCPA / state privacy**                       | US consumer-data scope                           | DSR, retention, opt-out                        |
| **GDPR / UK GDPR**                             | EU/UK travelers                                  | Lawful basis, DPA, transfer mechanism          |
| **OFAC / cross-border sanctions**              | Cross-border bookings                            | Sanctioned-destination screening               |
| **State unfair-claims-handling / UDAP**        | Loyalty disputes, refunds                        | Documented basis                               |
| **State anti-discrimination (e.g., Unruh CA)** | Hotels, attractions                              | Group fairness                                 |

## DOT 14 CFR 399.84 (full-fare advertising)

Requires advertisements of air fares to disclose the total price paid to the carrier including all mandatory taxes and fees up front.

**Stratix evaluation evidence:**

* Hard rule on every booking-related output: total-price elements present
* Audit log of pricing displays

## DOT Tarmac Delay Rule

Within US airports — care obligations during tarmac delays:

* Domestic flights: 3-hour limit; food/water at 2 hours
* International: 4-hour limit
* DOT may impose civil penalties up to \~$32K per passenger for violations

**Stratix evaluation evidence:**

* Care-obligation rule on disruption-handling AI output
* Audit log of compensation offers vs. regulatory minimums

## EU 261 / UK 261 / Canadian APPR

Fixed compensation amounts for cancellation, long delay, denied boarding:

* EU 261 (and UK 261 as adopted): €/£250 / 400 / 600 by distance and delay length
* APPR (Canada): tiered based on size of carrier and length of delay

Strict liability for the carrier in many cases; compensation disputes go to state agencies + consumer associations.

**Stratix evaluation evidence:**

* Regulation-citation rule on every disruption output affecting EU / UK / Canadian flights
* Compensation accuracy code assertion

## ACAA / 14 CFR Part 382

Air Carrier Access Act and implementing regulation. Requires:

* Accessible booking and check-in
* Service-animal handling
* Mobility-aid handling without damage
* DOT enforcement on systemic failures; consent decrees include penalty + reform

**Stratix evaluation evidence:**

* Accessibility-claim citation rule
* Verified-availability rule on stated accessible inventory

## ADA Title III

Hotels, restaurants, attractions as places of public accommodation. Litigation has been heavy on:

* Hotel reservation-system disclosure rules (28 CFR 36.302(e))
* Web accessibility (WCAG 2.1 AA as effective standard)

**Stratix evaluation evidence:**

* Accessibility-claim citation rule
* Reading-level scorer on customer-facing outputs

## FTC junk-fees rule (2024)

Requires up-front disclosure of total price including mandatory fees for:

* Live-event tickets
* Short-term lodging (hotels, vacation rentals)

Effective 2025; enforcement actions started shortly after.

**Stratix evaluation evidence:**

* Hard rule: mandatory fees present in any pricing output
* Audit log of fee disclosures

## State emergency-pricing laws

When a state of emergency is declared, many states cap price increases:

* **CA Penal Code § 396** — generally caps at 10% over pre-emergency price
* **NY GBL § 396-r** — prohibits unconscionable price increases
* **NJ, FL, TX, IL, others** — varying caps and triggers

**Stratix evaluation evidence:**

* Hard rule: emergency-state monitor; suggestions cap at applicable limit
* Audit trail of price suggestions during declared emergencies

## PCI DSS

Same posture as [retail compliance](/more-in-this-section-2/compliance-10.md) — Stratix is not designed to be in PCI scope; payment data should be tokenized upstream.

## Privacy laws

CCPA / state privacy / GDPR — see [retail compliance](/more-in-this-section-2/compliance-10.md). For international travel:

* Cross-border transfer mechanism required
* Special-category-data handling for accessibility / dietary / health-related preferences

## OFAC / sanctions

For cross-border travel:

* Sanctioned destinations (Cuba, Iran, North Korea, Syria, Russia depending on category) require general or specific licenses
* Carriers and OTAs cannot facilitate prohibited transactions

**Stratix evaluation evidence:**

* Hard sanctions-screening rule on cross-border bookings
* Audit log

## Recommended setup

1. Pro tier minimum; Enterprise for global carriers, OTAs, hotel chains
2. SSO + RBAC for booking / disruption / loyalty / revenue-management roles
3. Hard rules: total-price disclosure, regulation citation on disruption, junk-fee guardrail, emergency-surge cap, sanctions screening
4. Group-fairness scorers on personalized pricing
5. ACAA / ADA accessibility-claim citation rules
6. Audit retention matching the longest applicable DOT / state / EU requirement (default 5+ years)
7. DPA executed; tenant data residency where contracted
8. Cross-border transfer mechanism in place for EU traveler data

## See also

* [Travel scenarios](/more-in-this-section-2/scenarios-12.md)
* [Travel eval patterns](/more-in-this-section-2/eval-patterns-12.md)
* [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md)
* [Enterprise](/4.2-industry-use-cases/travel-hospitality.md)