Skip to main content
Dark green background, "Weak Application Security Can Cost You Millions," 3 slanted images of fingers pointing to digital locks, and a "Learn the Basics" button
Build an Airline Web Record DOT Will AcceptLaws & Regulations
4 min readFor Compliance Officers

Build an Airline Web Record DOT Will Accept

The Problem: Ensuring Accurate Historical Records

Airline advertising often hinges on one question: what did this page show customers on a specific date? If you can't answer from your records, you're at risk.

Consider British Airways. In 2015, a traveler found a discrepancy in taxes and fees on its U.S. site. The airline couldn't pinpoint when the error began, only estimating it might date back to December 2013. This led to a $40,000 civil penalty (Order 2016-3-9). The airline's lack of precise records became the public account of the error's duration.

The stakes are high. The Department of Transportation (DOT) has five years to bring a penalty case (28 U.S.C. § 2462), with fines up to $75,000 per violation (14 CFR 383.2). Each day of a continuing violation can count separately. The 2026 rule changes add pressure: 14 CFR 399.85 reverted to pre-2024 fee disclosure requirements, and a July 2026 proposal could alter 14 CFR 399.84. Older ads are judged by the rule in force when they ran (Order 2012-10-1), so every capture needs a verifiable date.

This guide helps you build a compliant record.

Preparation: What You Need

  • A page inventory owner in compliance to coordinate with web and e-commerce teams.
  • Test credentials for member-level and logged-in accounts. Errors may only appear to certain users.
  • A capture tool that records the full HTTP exchange and replays it. Ensure it writes WARC (ISO 28500).
  • WORM storage with a defined retention period.
  • A Records Control Schedule entry for advertising captures, with a minimum five-year retention.
  • A change log source to link corrections to capture dates.

Step-by-Step Implementation

1. Map Every Page with Pricing.
Create an inventory spreadsheet with URL patterns, page types, authentication states, and owners. Include fare search results, booking paths, fee pages, award pages, member-only pages, and promotional landing pages. Tour packages with airfare also fall under 14 CFR 399.84.

2. Capture the Entire Booking Journey.
Errors may not appear on landing pages. Use a browser automation tool like Playwright to script the journey from selection to payment. Capture each step for various routes: domestic, international, award, multi-city, and different passenger counts.

3. Set Capture Frequency by Change Rate.
Daily captures are necessary for fare displays and promotions. Static fee schedules can be captured less often, but trigger extra captures with each release. Assign capture frequency per page type in your inventory.

4. Store Captures to Prove Dates.
Save each capture as a WARC file with a timestamp and SHA-256 hash on WORM storage. Record the hash in an independent system to avoid shared failure points. Screenshots alone don't prove date integrity.

5. Log Corrections.
Capture pages immediately before and after fixing a pricing error. Record timestamps in a correction register with the ticket number and approver. Under OACP's January 2026 guidance proposal, fixing a problem before OACP finds it may result in a warning letter instead of enforcement.

6. Apply Retention and Legal Hold Rules.
Retain captures for at least five years. If a complaint arises, issue a Legal Hold for the affected date range and suspend disposition. Document the Records Disposition Authority for any later destruction.

7. Build Export Capability from Day One.
DOT's Gate 1 consent order (Order 2009-7-5) required submission of all ads, including website versions, for a year. Ensure you can export any date range in one operation, with hashes and timestamps.

Validation: How to Verify It Works

Run these tests quarterly and after any platform change:

  • Replay Test: Replay a booking journey from six months ago. Do dropdowns, fare filters, and totals match what customers saw?
  • Fixity Test: Recompute SHA-256 on stored files and compare to recorded hashes. Any mismatch is an incident.
  • Coverage Test: Confirm live price-bearing URLs have captures within their frequency window.
  • Authenticated-State Test: Ensure member-only pages are archived. If not, update your capture credentials.
  • Timeline Test: Verify you can show the first appearance and fix of a past correction from captures alone.
  • Export Drill: Simulate a DOT response by exporting a one-month range. Check for completeness.

Maintenance and Ongoing Tasks

  • Track Rule Changes. Monitor 14 CFR 399.84 rulemaking. Tag captures with the rule baseline in force.
  • Refresh Inventory with new fare products, microsites, or app flows. Add compliance checkpoints to your release process.
  • Rotate and Test Credentials for logged-in captures.
  • Review the Records Control Schedule annually and after any consent order.
  • Watch Personalized Pricing. DOT advises against pricing based on individual-specific data. Dated captures of public fare pages provide a baseline for claims of different fares.
  • Migrate Storage Formats and Media on a schedule, verifying Fixity after each migration.

The goal is a precise, defensible answer when asked what your page showed on a specific day.

promotional banner for evidence for every CC6 control checklist

You Might Also Like