Subject Access Request to Airbnb

Airbnb does not name a UK company as the controller of your account data. Schedule 1 of its privacy policy sets the controller by where you live and what you did: for a user in the United Kingdom it is Airbnb Ireland UC in Dublin for "All other activities", and Airbnb Payments UK Ltd, 280 Bishopsgate, London EC2M 4AG for "Payments Services for all activities". Airbnb, Inc. in San Francisco is the controller only for users who live in the United States. You do not have to work out which one to write to — there is one route for all of it. There is no UK version of Airbnb's privacy policy. The section headed "EU and UK Residents" sends you to the Outside the United States Privacy Supplement, a single document shared with the EEA and the rest of the world, which never mentions the ICO and names the Irish Data Protection Commission as Airbnb's lead supervisory authority. You can still complain to the ICO; the supplement calls it "your local supervisory authority" without naming it. The download in your account is not the same thing as a formal request, but it is unusually complete and for most people it is the right place to start. Go to Account, then Privacy and sharing — you have to be signed in — and choose Request your personal data, in HTML, Excel or JSON. Airbnb says the file covers Messages, "A list of all the messages you've sent and received on the Airbnb platform, including messages you sent to Hosts or guests or to Airbnb support"; Reviews, both those you wrote and those you received; Activity log; Enforcement history, "including suspensions or deactivations"; Report history; Resolution centre claims; and ID verification, "A summary of Government IDs you uploaded to the Airbnb platform for verification of your identity". Copies of your government ID and any selfies come back as image files inside the zip. Like Uber, Airbnb splits a self-service download from a formal request, but Airbnb's download is much the fuller of the two. If a reply arrives and you cannot tell whether it is complete, our free response checker will show you what is missing. What the download leaves out is the reason to make a formal request. Airbnb says "In certain jurisdictions, you may be able to request additional information that is not included in your access packet by default, this includes call recording data. To request additional information please submit a request or contact us." If you want call recordings, ask for them by name. To make the formal request, email dpo@airbnb.com. Airbnb lists that address under "Contact us to exercise your privacy rights" on its privacy preferences guide, and asks you to give your country of residence, the subject line "Privacy Data Subject Right Request" and your Airbnb ID if you have one. Someone can do this for you: Airbnb says "You may also designate an authorized agent to make a request on your behalf", and may ask for a power of attorney or proof you gave the agent signed permission. Airbnb publishes no response time for a data request anywhere. The one month you are entitled to comes from the law, not from a commitment Airbnb has made. The thirty days mentioned in its privacy policy is the notice it gives before changing the policy, not a deadline for answering you. If you have no Airbnb account, or you can no longer sign in, email rather than follow the links. Airbnb's own guide says people without an account "can still make requests to us regarding your personal information by contacting us", but the contact link it offers lands on a page reading "Log in to contact us", and the request tool in account settings redirects to the login screen as well. The email address works without an account. A request cannot remove a review. Airbnb says reviews are taken down only under its Reviews Policy, and that "Personal information you have shared with others, such as Reviews and forum postings, may continue to be publicly visible on Airbnb, even after your Airbnb account is cancelled". Nor can a request reverse a suspension, settle a booking dispute or tell you who reported you — a message thread or a review involves another person, and Airbnb can hold their identity back. Suspensions and content removals have their own appeal route, which must be used within 6 months of the decision. A request will get you the records and cannot award you anything — the same is true of a request to British Airways, where a delayed flight is a claim rather than a request. Hosts offering some services in the UK are background-checked. Airbnb says it may "receive background checks from third-party vendors on users who apply to offer select types of services in Canada, Mexico, and the United Kingdom", that it does "not run background checks on all users", and that where someone is removed over a conviction it will "generally tell them why they were suspended or removed, what information was used to make the decision, and where the information came from". Close your account and most of it goes. Airbnb says "we'll erase your account and personal information, except for a few items we need to keep for safety or legal reasons", naming payment transaction records, fraud detection and safety — and it warns that if it suspended an account for fraud it may keep the data "to prevent that Member from opening a new Airbnb account in the future". Ask before you delete, not after. Airbnb publishes no bereavement or estate route in any of its data protection pages. Rights of access end at death, so a request about someone who has died is not a subject access request. The ICO register lists dpo@airbnb.com as the data protection officer contact on Airbnb Payments UK Limited's registration, ZB044813. Airbnb UK Limited is registered separately as Z3594929 and is named as a controller nowhere in Airbnb's privacy documents. Both registrations give a London law firm's address rather than an Airbnb office. Airbnb also publishes a second address for Airbnb Ireland UC — 8 Hanover Quay, Dublin 2, D02 W5P2 — on its company details page; the address above is the one its privacy policy gives as the contact address for UK users. Airbnb's own instruction to post a request points at a section of the privacy policy that publishes no address outside the United States, so use the email unless you specifically want to write.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.