Amtrak

"We may share your personal data with advertisers or other business partners with whom we have relationships to provide you with information about various products and services that we believe would be of interest to you. Further, we may share personal data with social media companies to help us with our online marketing and advertising activities and with third-party analytics services to help us understand and improve the usage of our Online Services."

Amtrak shares personal data broadly with advertisers, business partners, social media companies, and analytics providers, going well beyond what's needed for rail service.

"When you use our mobile apps, we also may receive with your permission your device's geolocation or other information related to your precise location through GPS, Bluetooth, WiFi signals and other technologies."

Amtrak collects precise location data through multiple technologies including GPS, Bluetooth, and WiFi signals, and also shares geolocation information with third parties including advertising networks.

"Our mobile app may access your calendar, contacts and call information on your device with your permission. This access is to allow you to interact with your information from within the Amtrak application."

Amtrak's mobile app requests access to contacts, calendar, and call logs — data that goes beyond what a train booking service needs for core functionality.

"Through these ad services, we can target our messaging to users considering demographic data, users' inferred interests and browsing context. These services track your online activities over time and across third-party websites and apps by collecting information through automated means, including through the use of cookies, web server logs, web beacons, pixels and other similar technologies."

Amtrak uses third-party ad services that track users across websites and apps over time, building interest profiles based on cross-site browsing behavior and using device identifiers for targeting.

"We may update this Policy from time to time in order to reflect certain changes in our practices or legal requirements. We will indicate at the top of the Policy when it was most recently updated. You should periodically check this Policy for updates. In case of substantial changes to this Policy, we will inform you by posting a notice on our website or as otherwise required by applicable law."

Amtrak can change the privacy policy unilaterally, with users expected to periodically check for updates. Even 'substantial' changes only require a website notice, not affirmative consent.

"To the extent required or permitted, we retain the personal data we obtain for the duration of our relationship, plus a reasonable period thereafter required to comply with legal requirements regarding financial statements, legal claims or archiving purposes and applicable statute of limitations, unless a shorter retention period is required by applicable law."

Amtrak retains data for the entire customer relationship plus an undefined 'reasonable period' after, with no concrete deletion timeline. The retention period is open-ended and tied to vague legal and archiving justifications.

"You may terminate your membership in the Amtrak Guest Rewards program at any time by contacting the Amtrak Guest Rewards Program Service Center at 1-800-307-5000."

Amtrak Guest Rewards members must call a phone number to terminate their membership — there is no self-service online deletion option, creating friction for account closure.