United's AI Booking Ban Is Gatekeeping With a Safety Badge
The airline says it is protecting passengers. The rule mostly decides who gets to act on a customer's behalf.
United Airlines has updated its contract of carriage to bar personal AI assistants from making, modifying or servicing a ticket, or purchasing any product through its system. The airline's stated reasons are passenger data, unintended purchases and possible conflicts with federal aviation and transportation rules. Those are real concerns. I also think they are the least interesting part of the policy.
What the rule actually does is draw a line around who may act for a customer. A passenger can still log in, click through the fare calendar and rebook a flight by hand. What they cannot do is hand that errand to an assistant they chose, running on software they picked, to do it for them. The distinction matters. The contract does not say that bookings must be secure. It says that the airline decides which agents are permitted to touch a booking at all.
I am not dismissing the security argument. Account takeovers and sloppy automation are genuine problems, and anyone who has watched a poorly configured tool fire off duplicate purchases knows how quickly a mistake compounds. But the remedy United chose is a prohibition rather than a verification standard. A consent-based, authenticated agent could be audited, rate-limited and revoked. A blanket ban is simpler for the airline and leaves the customer with fewer options and no say in the matter. When a company has a choice between regulating a practice and forbidding it outright, the outright ban usually serves the company's convenience first.
The airline also invokes regulation, pointing to the check-in requirement that passengers confirm their bags hold nothing prohibited. That is a fair illustration of why certain acknowledgments must be made by a human. It does not follow that every booking step needs a human hand on the keyboard. The argument proves too much, and a careful reader should notice that the statement is written to make a commercial restriction sound like a compliance obligation.
The corporate language is worth a closer look too. The statement encourages other banks and retailers to adopt similar measures, which reads less like a passenger protection notice and more like an invitation to coordinate. Industries that agree on who may intermediate their customers tend to find that customers have fewer ways to shop around. The Fast Company piece notes that Delta and American have not followed, and that Southwest recently partnered with ChatGPT to offer a more direct booking path. Those are different bets on the same question: whether the airline or the customer's chosen tool sits between the traveler and the ticket.
None of this proves bad faith. It may well be that United's security team found real incidents and the legal department wrote a sober response. But a policy's justification is not the same as its effect. This one protects the airline's control over the front door of its own sales system, and it describes that control in the vocabulary of care. Passengers deserve to be protected. They also deserve to be asked before someone decides, on their behalf, which assistants are allowed to help them.