Order: Requirement for Airlines and Operators to Collect Contact Information for All Passengers Arriving into the United States

Introduction

The Centers for Disease Control and Prevention (CDC) within the Department of Health and Human Services (HHS) issued an Order on October 25, 2021 requiring airlines and other aircraft operators to collect contact information for passengers before their arrival into the United States from a foreign country, retain the information for 30 days, and transmit the information to CDC upon request. The purpose of collecting this information is to identify and locate passengers who may have been exposed to a person with a communicable disease for public health follow-up.

This Order became effective on November 8, 2021.

View the Order. This Order is published in the Federal Register.A

FAQs: Overview

Who is affected by this Order?

This Order applies to:

• All airlines and operators conducting any passenger-carrying operations into the United States from a foreign last point of departure
• All passengers and crewmembers flying into, or transiting through, the United States from a foreign last point of departure

What does the Order require from passengers?

Within 72 hours before their flight to the United States departs, passengers are required to provide the following information, to the extent it exists: full name (as it appears on their passport), address while in the United States, primary contact phone number, secondary or emergency contact phone number, and email address.

Passengers also have to:

• Acknowledge that the obligation to provide complete and accurate information is a U.S. Government requirement and that failure to provide complete and accurate information may result in criminal penalties, and
• Confirm the information they provided is complete and accurate.

What does the Order require from airlines and other aircraft operators?

Airlines and passenger-carrying operators are required to collect each passenger's full name, address while in the United States, primary contact phone number, secondary or emergency contact phone number, and email address, to the extent this information exists, within 72 hours before the flight's departure. Airlines and operators must maintain these data elements for crew members. Airlines and operators must also maintain, to the extent the data are already available and maintained by the airline, the following information for each passenger and crewmember:

• date of birth
• airline name
• flight number
• city of departure to the United States
• departure date and time
• city of arrival in the United States
• arrival data and time
• seat number

The airline or operator needs to retain this information for 30 days after the flight's departure unless the airline or operator has chosen to transmit the information securely to the U.S. Department of Homeland Security (DHS) via their established data systems. Data that has not already been transmitted to DHS must be transmitted to CDC within 24 hours upon request.

Airlines and operators must also notify passengers of the intent and purpose of the information collection and obtain from each passenger an acknowledgement that the obligation to provide complete and accurate information is a U.S. Government requirement, that failure to provide complete and accurate information may result in criminal penalties, and confirmation that the information provided is complete and accurate.

What is CDC's authority to require this information?

This Order follows the February 2020 Interim Final Rule that authorized CDC to require airlines and other aircraft operators to collect certain contact information from passengers before they board a flight to the United States, and to provide the information to CDC within 24 hours of an Order from CDC.

FAQs: For Passengers

What information am I required to provide to airlines and operators?

Air passengers are required to provide the following information, to the extent that it exists, within 72 hours before their flight's departure:

• full name
• address while in the United States
• primary contact phone number
• secondary or emergency contact phone number
• and email address

Full name should be the name that appears on a passenger's passport. Address while in the United States should be a complete address including street address, city, state or territory, and zip code. A U.S.-based phone number is preferred for primary contact phone number. The email address provided should be one that will be routinely checked while in the United States.

Passengers must also:

• Acknowledge that the obligation to provide complete and accurate information is a U.S. Government requirement and that failure to provide complete and accurate information may result in criminal penalties, and
• Confirm the information they provided is complete and accurate.

When and how will this information be collected and shared with CDC?

Airlines and operators must collect the information from passengers within 72 hours of their flight's departure. Airlines and operators may choose the format or means for collecting the contact information from passengers. Many passengers that use online booking systems or mobile phone applications (apps) will receive a prompt from their airline to provide or confirm their contact information via email or an app. For example, when checking in for a flight through a mobile phone app, passengers may have to check boxes confirming their contact information and completing the acknowledgement.

Once an airline or operator collects the information, it will either be shared directly with CDC upon request or it will be shared with the Department of Homeland Security (DHS) through their established data systems. Information transmitted to DHS will be transmitted to CDC upon request. All data transfers will be secure to protect passengers' information.

How does CDC use this data?

As may be necessary for public health follow-up, CDC may share the information securely with relevant state, local, and territorial public health authorities at a passenger's destination. The data collected will enable CDC and the relevant health departments to contact those who may have been exposed to COVID-19 or other communicable diseases. Follow-up can include:

• Monitoring travelers for signs and symptoms of COVID-19 and other communicable diseases
• Offering preventive care when available and indicated
• Quickly identifying anyone with symptoms and their contacts
• Asking symptomatic persons to isolate and their contacts to self-quarantine
• Ensuring any travelers who develop symptoms receive appropriate medical evaluation and care
• Educating travelers about how to take steps to care for themselves and help protect others in their home and community

How does CDC protect data they collect about passengers?

Personally identifiable information (e.g., names, addresses) provided to CDC is stored on secure CDC servers and shared securely with health departments at passengers' destinations. The personally identifiable information is accessible only to CDC staff and other public health officials who need the information for official public health purposes. CDC will retain, use, delete, or otherwise destroy the designated information in accordance with the Federal Records Act, the applicable Privacy Act System of Records Notices, and other applicable law.

For data transmitted by airlines and operators via an established DHS data system, DHS may use the data for any use permitted by the applicable Systems of Records Notice. DHS may share passenger data with other law enforcement and national security partners pursuant to agreements with those partners.

If I am visiting the U.S. and will not have access to an operable phone or email, what information should I provide?

Passengers without access to a phone or email while in the U.S. should list the email and phone number of the accommodation where they will be staying at their destination. This can be the phone number and/or email of a friend or relative with whom passengers will stay with during their visit, or a hotel, as long as the passengers themselves can be reached at that phone number and/or email.

If I am visiting multiple locations while in the U.S., which address should I provide?

Passengers should indicate the address of the first location where they will be staying (e.g., hotel, hostel, friend or relative home, etc.) while in the United States, unless passengers intend to stay at subsequent locations for longer periods of time.

I am traveling with a group or members of my family. Are we all required to provide this data?

Yes, all passengers are required to provide this data, to the extent it exists, to their airline or operator. Parents or guardians of minor children may provide the required data on behalf of their minor children. An authorized individual may provide the required data for another passenger, if that passenger is unable to provide the information on their own behalf (e.g., because of age or physical or mental impairment).

Is my primary phone number required to be a U.S.-based phone number?

Passengers should provide a primary phone number at which they can be contacted while in the United States and a U.S.-based phone number is preferred. Passengers who will use an international phone as their primary phone should ensure they will have service while in the United States. Passengers who will use an international phone as their primary or secondary phone must include the country code and any additional codes needed to reach the phone while the person is in the U.S. (e.g., country code and area code or carrier code).

If I am transiting through a U.S. airport and my final destination is a foreign country, what information am I required to provide?

Passengers, including those only transiting through a U.S. airport to a foreign country destination, must provide, to the extent the information exists: their full name, address while in the United States, primary contact phone number, secondary or emergency contact phone number, and email address.

In-transit passengers are unlikely to have an address while in the United States, and should select the applicable "in-transit" option if provided by their airline. Passengers should contact their airline for additional guidance on how to provide the required data.

FAQs: For Airlines and Operators

For which types of flights does this Order apply?

This Order applies to all passenger-carrying operations conducted on airplanes arriving into the United States from a foreign last point of departure (including flights with intermediate stops in the United States between the flight’s foreign point of origin and the final destination).

When do airlines and operators need to comply with the Order?

The Order becomes effective on November 8, 2021. CDC encourages airlines and operators to begin collection and retention or transmission of the required information on the effective date. CDC will exercise its enforcement discretion for airlines or operators that need additional time to comply with the requirements of the Order.

What information do airlines and operators need to collect?

Airlines and operators must collect the following information, to the extent it exists, from each passenger:

• full name
• address while in the United States
• primary contact phone number
• secondary or emergency contact phone number
• email address

Airlines and operators must maintain the information above for crewmembers.

For each passenger and crewmember, the airline or operator must additionally maintain, to the extent that such data are available, the following information:

• date of birth
• airline name
• flight number
• city of depature to the United States
• depature date and time
• city of arrival in the United States
• arrival date and time
• seat number

Airlines and operators must obtain the following from each passenger ("acknowledgment"):

• Acknowledgement that the obligation to provide complete and accurate information is a U.S. Government requirement and that failure to provide complete and accurate information may result in criminal penalties, and
• Confirmation the information they provided is complete and accurate.

What are airlines and operators required to tell passengers about this data collection?

Airlines and operators must notify passengers ("acknowledgement"):

• of the purpose and intent of the information collection,
• that the obligation to provide complete and accurate information is a United States Government requirement, and
• that failure to provide complete and accurate information may result in criminal penalties.

A template with language that airlines and operators must include when collecting the required information is available here.

When must airlines and operators collect the information from passengers in relation to a flight?

Airlines and operators must collect the contact information and acknowledgement from passengers no more than 72 hours before their flight’s departure.

Do airlines and operators need to collect this information for crewmembers as well?

Airlines and operators are required to maintain contact information for crewmembers and provide it to CDC upon request. Airlines and operators do not need to collect contact information from crewmembers before every flight, but should have available the relevant information for each crewmember on any given flight.

How should airlines and operators collect the data elements and "acknowledgment" for passengers?

Airlines may use whatever means or format they choose to collect the data elements from passengers and obtain the acknowledgement. This may include a check box for the acknowledgement.

A template with language that airlines and operators must include when collecting the required information is available here.

How should airlines and operators collect the data elements for passengers that are transiting through the United States to a final destination in a foreign country?

CDC understands passengers transiting through the U.S. to a foreign destination will not have an address in the U.S. CDC requests that airlines and operators provide a way for passengers to indicate that they are only transiting through the U.S. (e.g., drop-down or “radio button” option for “in transit” for the address) in order to receive acknowledgment from passengers that they have provided as much information as possible.

For how long are airlines and operators required to retain the information required by the Order?

Airlines and operators are required to retain the information required by the Order for a minimum of 30 days after the flight unless all of the required information has already been transmitted to the U.S. Government.

What are the approved secure, electronic means to transmit the formatted, retained information?

See the Technical Instructions for CDC's Contact Information Collection Order for information about transmitting data to CDC. Airlines may alternatively transmit data through established DHS data systems.

Do I need to wait for an information request from CDC to establish an account with the CDC Secure Access Management Services (SAMS)?

No, airlines and operators are encouraged to establish a SAMS account early to avoid any delays in transmitting data upon request by CDC. See the Technical Instructions for CDC's Contact Information Collection for information on setting up a SAMS account.

Do airlines and operators have to notify CDC if a passenger does not have one or more data elements?

The Order requires airlines and operators to collect the data elements to the extent it exists. CDC understands that some passengers may not have a secondary phone number or an email address. A complete physical address, including the street address, city, state, and ZIP code should reasonably exist for any passenger with a destination in the U.S. CDC requests that airlines and operators provide a way for passengers to indicate that they do not have the contact information (e.g. option for “N/A” for secondary phone) in order to receive acknowledgment from passengers that they have provided as much information as possible.

What are airlines and operators required to do to verify the information provided by a passenger is current and accurate?

Airlines and operators may, at their discretion, use reasonable efforts to verify the information provided by passengers. For example, airlines and operators could compare the data provided by the passenger to the data that the passenger provided to receive trip updates and boarding passes for that trip. This is not a requirement of the Order.

Does the Order require airlines and operators to obtain an acknowledgement from passengers?

Airlines and operators are required to obtain from passengers: acknowledgment of the purpose and intent of this collection; acknowledgement that the obligation to provide complete and accurate information is a U.S. Government requirement; that failure to provide complete and accurate information may result in criminal penalties; and confirmation that the information provided is complete and accurate.

Airlines and operators may obtain this acknowledgement in any of the following formats:

• Verbally – airlines and operators may have an employee obtain verbal confirmation from passengers that they understand the purpose and intent of the Order and that they have provided complete and accurate information. Airline or operator employees must read the italicized script under the verbal instructions provided in the template when obtaining verbal confirmation.
• Digitally – airlines and operators that digitize the acknowledgement must include the statements provided in the template and may use check boxes, for example, at the time a passenger provides their contact information. The Privacy Act statement, Office of Management and Budget (OMB) Control Number, OMB expiration date, and the Burden Statement provided in the footer of the template must be included when digitally collecting the required data elements (full name, address while in the U.S., primary phone number, secondary or emergency phone number, and email address) and the
• Paper Copy – airlines and operators may combine the acknowledgement with the attestation in a paper copy format or they may obtain written acknowledgement from passengers separate from the attestation. Acknowledgements in this format must include the Privacy Act statement, OMB Control Number, OMB expiration date, and the Burden Statement provided in the template.

Which airlines or operators are exempt from this Order?

Any airline or operator that enters into a contract with the U.S. Military service to provide transportation to persons designated by the U.S. Military service is exempt from this Order for flights covered under the contract. The U.S. Military service typically collects and retains the designated information and conducts any necessary public health follow-up for passengers on the aircraft that operate in accordance with the U.S. Military service contract with the airline or operator.

Any airline or operator that enters into a contract with another U.S. Government agency may be eligible for an exemption on a case-by-case basis with approval from the CDC Director. Any request for this exemption must be made to CDC via email at dgmqpolicyoffice@cdc.gov and is subject to any requirement or limitation established by the CDC Director, including that the U.S. Government agency that is a party to such a contract shall conduct any necessary public health follow-up for passengers and crew.

Any airline or operator designated as state aircraft under international law (1) by an appropriate United States federal government department or agency, or (2) by a foreign government and granted diplomatic clearance to enter U.S. airspace.

Who can airlines contact at CDC with questions about the Order?

For technical questions about transmitting information securely to CDC, contact eocgmtftasksuprt@cdc.gov.