Travel and hospitality compliance

Travel and hospitality compliance — DOT, EU 261, ACAA, ADA, FTC junk-fees, GDPR/CCPA, PCI DSS, state emergency-pricing laws.

Travel compliance combines transportation regulators (DOT, FAA, EU/UK/CA equivalents) + consumer-protection regulators (FTC, state AGs) + accessibility law + payment + privacy + state emergency rules.

Regulatory frame

Regime	Applies when	Evaluation-evidence shape
DOT 14 CFR 399.84 (full-fare advertising)	US-touching air fare advertising	Total-price disclosure rule
DOT Tarmac Delay Rule	US tarmac delays	Care-obligation tracking
EU 261 / 2004	Flights from EU and EU-carrier flights to EU	Compensation accuracy; care
UK 261	UK flights	Same shape as EU 261
Canadian APPR	Air travel within / to / from Canada	Compensation; care
ACAA / 14 CFR Part 382	US air carriers	Accessibility for passengers with disabilities
ADA Title III	Hotels, restaurants, attractions	Accessibility of facilities and digital
FTC junk-fees rule (2024)	Hotels, vacation rentals, live-event tickets	Mandatory-fee disclosure up front
State emergency-pricing laws	Declared emergencies in CA, NY, NJ, FL, TX, etc.	Surge cap during declarations
PCI DSS	Payment card data	Tokenization; no PAN in traces
CCPA / state privacy	US consumer-data scope	DSR, retention, opt-out
GDPR / UK GDPR	EU/UK travelers	Lawful basis, DPA, transfer mechanism
OFAC / cross-border sanctions	Cross-border bookings	Sanctioned-destination screening
State unfair-claims-handling / UDAP	Loyalty disputes, refunds	Documented basis
State anti-discrimination (e.g., Unruh CA)	Hotels, attractions	Group fairness

DOT 14 CFR 399.84 (full-fare advertising)

Requires advertisements of air fares to disclose the total price paid to the carrier including all mandatory taxes and fees up front.

Stratix evaluation evidence:

• Hard rule on every booking-related output: total-price elements present
• Audit log of pricing displays

DOT Tarmac Delay Rule

Within US airports — care obligations during tarmac delays:

• Domestic flights: 3-hour limit; food/water at 2 hours
• International: 4-hour limit
• DOT may impose civil penalties up to ~$32K per passenger for violations

Stratix evaluation evidence:

• Care-obligation rule on disruption-handling AI output
• Audit log of compensation offers vs. regulatory minimums

EU 261 / UK 261 / Canadian APPR

Fixed compensation amounts for cancellation, long delay, denied boarding:

• EU 261 (and UK 261 as adopted): €/£250 / 400 / 600 by distance and delay length
• APPR (Canada): tiered based on size of carrier and length of delay

Strict liability for the carrier in many cases; compensation disputes go to state agencies + consumer associations.

Stratix evaluation evidence:

• Regulation-citation rule on every disruption output affecting EU / UK / Canadian flights
• Compensation accuracy code assertion

ACAA / 14 CFR Part 382

Air Carrier Access Act and implementing regulation. Requires:

• Accessible booking and check-in
• Service-animal handling
• Mobility-aid handling without damage
• DOT enforcement on systemic failures; consent decrees include penalty + reform

Stratix evaluation evidence:

• Accessibility-claim citation rule
• Verified-availability rule on stated accessible inventory

ADA Title III

Hotels, restaurants, attractions as places of public accommodation. Litigation has been heavy on:

• Hotel reservation-system disclosure rules (28 CFR 36.302(e))
• Web accessibility (WCAG 2.1 AA as effective standard)

Stratix evaluation evidence:

• Accessibility-claim citation rule
• Reading-level scorer on customer-facing outputs

FTC junk-fees rule (2024)

Requires up-front disclosure of total price including mandatory fees for:

• Live-event tickets
• Short-term lodging (hotels, vacation rentals)

Effective 2025; enforcement actions started shortly after.

Stratix evaluation evidence:

• Hard rule: mandatory fees present in any pricing output
• Audit log of fee disclosures

State emergency-pricing laws

When a state of emergency is declared, many states cap price increases:

• CA Penal Code § 396 — generally caps at 10% over pre-emergency price
• NY GBL § 396-r — prohibits unconscionable price increases
• NJ, FL, TX, IL, others — varying caps and triggers

Stratix evaluation evidence:

• Hard rule: emergency-state monitor; suggestions cap at applicable limit
• Audit trail of price suggestions during declared emergencies

PCI DSS

Same posture as retail compliance — Stratix is not designed to be in PCI scope; payment data should be tokenized upstream.

Privacy laws

CCPA / state privacy / GDPR — see retail compliance. For international travel:

• Cross-border transfer mechanism required
• Special-category-data handling for accessibility / dietary / health-related preferences

OFAC / sanctions

For cross-border travel:

• Sanctioned destinations (Cuba, Iran, North Korea, Syria, Russia depending on category) require general or specific licenses
• Carriers and OTAs cannot facilitate prohibited transactions

Stratix evaluation evidence:

• Hard sanctions-screening rule on cross-border bookings
• Audit log

Recommended setup

1. Pro tier minimum; Enterprise for global carriers, OTAs, hotel chains
2. SSO + RBAC for booking / disruption / loyalty / revenue-management roles
3. Hard rules: total-price disclosure, regulation citation on disruption, junk-fee guardrail, emergency-surge cap, sanctions screening
4. Group-fairness scorers on personalized pricing
5. ACAA / ADA accessibility-claim citation rules
6. Audit retention matching the longest applicable DOT / state / EU requirement (default 5+ years)
7. DPA executed; tenant data residency where contracted
8. Cross-border transfer mechanism in place for EU traveler data

See also

• Travel scenarios
• Travel eval patterns
• Concept: Multi-tenancy
• Enterprise