Cruise Mobile Apps
2026 Annual Report
An independent analysis of 21 ocean cruise guest-facing apps — the largest cohort in this report's history. Eight new lines join the analysis as the industry's framework debates settle and the harder questions of execution, security, and AI integration move to the foreground.
Guest-experience software since 2010.
OnDeck by Sourcetoad has specialized in innovative guest-facing software for the cruise and ferry industry for 15+ years. Our mission is to increase the value of both the guest's and the crew's time by building automation, communication, and self-service systems.
We offer a number of custom and out-of-the-box solutions for cruise lines to increase operational efficiencies, improve guest experiences, and shorten technology ROI cycles. As the publisher of this report, we note that four apps in the 2026 cohort run on our Cruise Director Platform. We have analyzed them using the same methodology applied to all other apps.
Learn moreProducts & Services
- Cruise Director PlatformShipboard and shoreside middleware, ship-to-shore sync, IoT, analytics.
- Mobile App-in-a-BoxWhite-label guest app: digital check-in, boarding passes, dining, folio management.
- OnDeck iTVIn-cabin interactive TV with live TV, on-demand, and room-service booking.
- OnDeck Smart SignageFleet-wide digital signage, dynamically triggered by GPS, weather, or port.
- ECSSilent, workflow-based passenger notification system.
- Digital SurveyPre-, during-, and post-cruise guest feedback.
- Push NotificationsFull push module for mobile and iTV, including local push.
The experimental phase is over.
The structural story of the 2026 report is consolidation. The cross-platform framework debates that defined the last several years are settling. React Native is maturing rather than expanding. Flutter has made its case and won it in at least one major rebuild. Capacitor has effectively replaced Cordova across a major brand family. The experimental phase of cruise app development, at least at the framework level, is largely over.
What replaces it is harder and more interesting: whether these teams can execute well at scale, ship features that actually work onboard, and close the security and accessibility gaps that have followed this industry for years. Eight new lines join the analysis this year, bringing the cohort to 21 apps — the largest in the report's history.
The AI story is where things get genuinely exciting. Two years ago we predicted that AI-assisted chat would move from experiment to early production. It has — and faster than expected. One operator has reported handling over 13,000 service requests through a virtual concierge across a portion of their fleet in a six-month period. That is not a pilot number. That is operational scale.
Security, however, has not improved as fast as it should. We found a cluster of findings this cycle ranging from poor development hygiene to genuinely serious vulnerabilities. We also encountered something harder to fix with a CI/CD pipeline: an organizational culture that prefers not to know. We have named it plainly in the Security section.
21 apps. Eight new additions.
This year's cohort is the largest in the report's history, adding eight lines that had not previously appeared in the analysis — from ultra-luxury yacht experiences to expedition and regional operators.
A widening gap between leaders and laggards.
Several leading apps pushed updates at a sustained cadence throughout 2025, tied to meaningful feature expansion and platform evolution. At the same time, a number of apps updated infrequently, with at least one showing no updates at all. The defining difference is intent.
Three tiers, from universal to unique.
Features are grouped into Common (present in nearly every app), Less Common (present in at least three but no more than half), and Stand-Out (unique to one or two applications).
Shared by a majority of the apps analyzed.
A universal feature across onboard apps, with most allowing guests to view and book excursions while onboard. Some offer pre-registration before the cruise.
Chat has become a common feature of onboard apps. Most support one-to-one messaging; some offer group chat in addition.
Ship maps and directories are ubiquitous. The most robust implementations are interactive and searchable, making it easier for guests to navigate the ship.
A majority of apps include dining information — menus, hours, location, dress code — with many offering reservations, some opening bookings prior to departure.
Most apps now include port and destination content — photos, activity suggestions, cultural and historic information — to help guests learn about ports of call.
Nearly all onboard apps have a folio feature: a detailed billing record that refreshes in real time as new charges are applied to the guest's account.
The guest's personalized schedule, populated with favorites and confirmed bookings. One app allows itinerary sharing with travel companions for easy coordination.
Push notifications have become standard. Guests receive alerts about scheduled activities, folio updates, and new chat messages, though user reviews reflect mixed success.
The daily schedule is the hub for organizing daily activities. In most apps, events can be added, reserved, or highlighted before being copied to the guest's personal itinerary.
Most apps include spa service information and allow guests to book appointments. Some have expanded this to work shoreside, enabling pre-cruise reservations.
Found in at least three, but no more than half, of the apps analyzed.
Targeted deals, discounts, or package offers delivered through the app based on user behavior or profile data.
This year, more apps have added the option to book or pre-register for shore excursions, spa treatments, and restaurant reservations before the cruise.
A few apps offer instant approval for a cruise-line branded credit card, added to the guest's digital wallet immediately for spending and loyalty points.
Some apps offer guests the option to review, purchase, and share photos from their cruise.
Several apps allow guests to order food, beverages, or services delivered to their stateroom. Two apps offer location-based delivery anywhere onboard.
Live ship tracking allows guests to see the ship's location in real time. One app also offers a live onboard video feed.
Weather features allow guests to view the forecast for each day of their cruise, helping them plan for shoreside excursions and expeditions.
Unique to one or two apps — unusual enough to merit individual attention.
A few apps support Face ID or fingerprint recognition, allowing guests to securely log in without entering credentials — particularly valuable for apps guests download weeks before a voyage.
One app includes an augmented reality experience that uses the phone's camera and onboard sensors to create an interactive, ship-wide activity.
A small number of apps extend beyond the cruise itself to support the full travel journey, including flights, accommodations, and transportation.
A few apps offer direct chat with guest services. Two include a chatbot virtual assistant capable of answering questions, providing ship information, or escalating to a live agent.
Two apps include virtual art guides, each implemented differently. Guests can listen to audio clips about the works of art onboard. Interesting and unusual — and a natural fit for premium lines.
One app lets guests view the real-time location of other members of their travel party along with wayfinding, making it easier to meet up across the ship.
Consolidation at the framework layer.
The 2026 cohort tells a story of frameworks maturing, migrations completing, and long-overdue modernization reaching previously resistant codebases. The experimental phase — in which teams debated which cross-platform approach to bet on — is largely over.
React Native remains the most widely deployed framework in the fleet. In 2026, the story is less about new adoption and more about maturation: the New Architecture is rolling out, major dependencies are updating, and long-overdue upgrades are completing.
One major contemporary line completed a full native-to-Flutter rewrite — the biggest Flutter story in 2026. The framework is also maturing in two other apps. That team's choice of Flutter over React Native is a meaningful data point in an ongoing industry debate.
Google's declarative UI framework for Android appears in two major brands' 2026 builds, reflecting a native Android modernization trend happening quietly alongside the more dramatic cross-platform migrations.
Two sibling lines within a major brand family completed full Cordova-to-Capacitor migrations in this cycle, executed in parallel — likely by the same team. Capacitor has reached a maturity level where even large, feature-rich cruise apps are confident completing the migration.
The New Architecture replaces the old asynchronous bridge with a JavaScript Interface (JSI) for direct synchronous calls between JS and native code. Its telltale signatures are landing across multiple cruise apps in 2026. Apps that have not yet made this transition are increasingly in the minority.
MQTT's role as the messaging backbone for onboard notifications appears to be ending. A persistent WebSocket-based foreground notification service now appears across four apps from different operators — the most significant shift in onboard notification infrastructure in years.
The most interesting story is consolidation.
Two years is a long time in mobile development. Brand families are making coordinated platform decisions, and teams are completing migrations that have been in progress for years. What follows is our attempt to document that transition as it is actually happening.
New to 2026First-time arrivals in this year's analysis. Some represent coordinated platform bets by brand families; others appear independently across unrelated apps.
A security layer that detects and blocks automated or malicious traffic. Its native library appearing across several apps suggests device-level bot detection logic — an unusual and sophisticated approach to mobile security.
Appearing in several apps at once — rarely a coincidence. Acts as a unified analytics, audience segmentation, and campaign targeting layer for guest behavior across shoreside and onboard touchpoints.
Appearing in nearly every app analyzed in 2026 — largely a platform-level change pulled in by updated analytics SDKs complying with new Android requirements, not necessarily a deliberate advertising choice.
An in-app feedback and ratings tool from Alchemer, allowing contextually-timed review prompts and satisfaction surveys. Its appearance in multiple apps suggests cruise lines are getting more deliberate about collecting onboard guest feedback.
Visa's 3D Secure 2.0 authentication solution. Its presence confirms that at least one app is now handling authenticated card transactions directly within the app rather than deferring to tokenization.
A Consent Management Platform for GDPR and similar regulations. One brand's 2026 build significantly expanded Didomi's string resources by nearly 190 keys, suggesting a more thorough and legally complete consent implementation than was previously present.
An application performance monitoring platform appearing as the application wrapper across three apps from different brands — suggesting a shared technology management layer. Provides AI-assisted root cause analysis and real user monitoring.
An open-source library for triggering local push notifications from Flutter apps entirely offline — well-suited for time-sensitive onboard messaging like activity reminders or dining alerts when ship WiFi is unavailable.
Indoor positioning using magnetic field mapping rather than GPS or Bluetooth. Its appearance in one large fleet operator's app is one of the more ambitious finds in this year's report — indoor positioning on a steel-hulled ship at sea is a genuinely hard problem.
A fast, embedded NoSQL database for Flutter apps. Its addition to one luxury line's app suggests a move toward more offline-first data storage — considerably faster than SQLite at scale, which matters for apps that store large voyage datasets locally.
Google's modern declarative UI framework for native Android. Appearing in two major brands' 2026 builds — one a large contemporary line undergoing a significant Compose refactor, the other completing a full React Native to native rebuild.
A self-hosted, enterprise-grade open-source identity and access management system from Red Hat. Its presence in one European line's app suggests that line is running Keycloak on their own servers for a unified login experience operating both onboard and shoreside. See also: Security findings.
An embedded document-oriented database with built-in sync to a central Couchbase server when connectivity is available, then full offline operation when it is not. A compelling architecture for cruise apps handling bookings, dining menus, and folio data.
One of the most practically significant patterns in the 2026 analysis: a persistent onboard WebSocket foreground service enabling push notifications through a local websocket connection while the user is on the ship. Seen across four apps — the most significant shift in onboard notification infrastructure since original local push implementations.
An open-source fork of Mapbox's original GL Native library, created after Mapbox relicensed away from open source in 2021. One operator's switch from Mapbox to MapLibre is the first seen in the cruise fleet — a signal of growing preference for the license-free alternative.
A React Native library from Invertase for managing advanced local notifications with fine-grained control over notification channels and behaviors that standard React Native APIs do not expose. Included in one major line's fully rebuilt React Native app.
A passwordless authentication platform using device biometrics. Appeared independently in two apps sharing a platform lineage that completed cross-platform migrations in the same cycle — a strong signal this was a deliberate platform-level choice, not coincidence.
An alternative push notification service operating outside Google's Firebase Cloud Messaging ecosystem. One app's use of Pushy alongside a local notifications library suggests a belt-and-suspenders approach to notification delivery for edge cases where standard GCM delivery is unreliable.
Replaces the old asynchronous bridge with a JavaScript Interface (JSI) for direct synchronous calls between JS and native code. Its telltale signatures land across multiple cruise apps in 2026. Apps that have not yet made this transition are increasingly in the minority.
Forensic document reading including biometric chip reading from ePassports. Appearing alongside Microblink in one large operator's app — two document scanning SDKs in a single app is unusual and points to a comprehensive identity verification strategy.
A real-time interactive animation platform that creates animations driven by app state rather than pre-rendered clips. Its presence in one brand known for high design standards hints at UI elements that react dynamically to user input. Rive files are also significantly smaller than equivalent video assets.
A commercial document and barcode scanning library with strong offline performance. Appearing in one major line's rebuilt Flutter app alongside ML Kit — two scanning libraries in a single app points to a check-in workflow receiving a significant upgrade.
A computer vision library for ID document recognition, appearing in one major contemporary line's 2026 app as an updated version of a library present in their 2023 build. Most likely being used for passport or ID capture during pre-cruise check-in.
A messaging platform with support for text, media, and group channels. One family-oriented line's 2026 app includes both Twilio Conversations and Twilio Voice — together suggesting a deliberate decision to consolidate real-time communication under a single platform.
Internet-based in-app voice calling. One piece of what appears to be a significant communications infrastructure build — allowing guests to connect with onboard services or family ashore when ship WiFi is available.
A Swiss mobile payment scheme comparable to Apple Pay but specific to the Swiss domestic market. Its presence in one premium line's app is a good example of a cruise line tailoring its payment stack to the actual demographics of its guests.
A cloud-based contact center platform acquired by Google Cloud, supporting both chat and voice interactions. Its concentrated presence across three apps from the same major brand family — with 62+ string key additions and full voice/chat service integration — is the most coordinated vendor adoption observed this cycle.
A React Native library for high-performance camera access with direct access to raw camera frames — commonly paired with computer vision workloads. Its inclusion in one expedition-style operator's app fits their broader investment in local map rendering and New Architecture performance improvements.
Tools that appeared in the 2024 report and have meaningfully evolved — through expanded adoption, significant version upgrades, or a notable shift in how they are being used.
One app now shows AdvancedCheckoutService and SessionCheckoutService, reflecting Adyen's newer API models for more complex checkout flows — expanding well beyond simple card capture into multi-step transactional lifecycle management.
Braze's footprint continues to grow. Primarily used for pre-cruise engagement: welcome messages, upsell campaigns, loyalty communications, and re-engagement targeting. Its increasing presence alongside Adobe Experience Platform suggests more sophisticated marketing data pipelines.
In 2026, Capacitor has become the dominant migration story: two sibling lines completed full Cordova-to-Capacitor migrations in this cycle. The shared codebase signatures strongly suggest these were executed in parallel, possibly by the same team or vendor.
ContentSquare continues to expand across the fleet. One major line's fully rebuilt app prioritized analytics instrumentation as a first-class concern rather than bolting it on afterward. Provides session replay, heatmaps, and funnel analytics for complex booking and check-in flows.
OnDeck's suite of onboard and shoreside software tools. Four apps in this year's report share it as a common infrastructure layer — lines from different ownership structures, market positions, and geographic focuses. OnDeck is the publisher of this report; we have analyzed these apps with the same methodology applied to all others.
Remains the most ubiquitous backend platform in the fleet. One notable signal: a European-market line's build sets firebase_analytics_collection_enabled to false — likely consent-gating for GDPR compliance rather than a reduction in analytics investment.
One major contemporary line's complete native-to-Flutter rewrite is the biggest Flutter story in 2026. That team's choice of Flutter over React Native — for its compiled rendering pipeline and stronger opinionation about UI — is a meaningful data point in an ongoing industry debate.
MLKit barcode scanning has expanded significantly across several more apps. Fast, offline-capable, and maintained by Google, it has effectively become the default barcode scanning choice in the fleet, replacing older solutions like ZXing.
The appearance of libhermestooling.so as a separate library across multiple apps signals adoption of React Native 0.74+, which ships Hermes with enhanced debugging and profiling tooling. Newer Hermes versions also handle New Architecture stack traces significantly better.
Remains the dominant mapping solution in the fleet, though 2026 introduces a more complicated picture: one large operator significantly expanded its native Mapbox integration in a build that grew by nearly 100 megabytes, while another replaced Mapbox with the open-source MapLibre fork.
The fleet's primary solution for camera-based document and card capture. In 2026, footprint expanded in two notable directions: one large operator added face biometric capabilities, and another adopted BlinkCard as part of a full React Native rebuild.
Remains the most widely deployed framework in the cruise app fleet. In 2026, the story is less about new adoption and more about maturation. One operator actually moved away from React Native back to native Android entirely. The interesting questions are no longer who is using it but how well.
Remains the most commonly identified crash reporting and error monitoring tool in the fleet. One large operator's build shows a significant version jump bringing improved performance tracing and session replay. Note: Sentry is most commonly associated with sourcemap inclusion — teams should ensure their configuration scopes uploads to the Sentry service only.
The industry is consolidating around a smaller number of modern, maintainable foundations and shedding the legacy scaffolding that accumulated over the past decade.
Completely removed in one line's 2026 rebuild, along with its entire legacy stack. The rebuilt app appears to have moved away from in-app VoIP entirely, reflecting a broader shift from SIP-based telephony toward WebRTC or platform-managed voice solutions.
Appeared as a new entrant in the 2024 report and has already been removed from one European line's 2026 build, replaced by Adobe Experience Platform Mobile SDK — a deliberate consolidation of marketing data collection under a single vendor.
Cordova's decline continues. Two sibling lines within a major brand family completed full Cordova-to-Capacitor migrations in this cycle, leaving one smaller luxury operator as one of the last remaining holdouts. Cordova's tenure as a cross-platform foundation has been remarkably long, but momentum has clearly shifted.
MQTT's role as the messaging backbone for onboard notifications appears to be ending. Its removal from one major contemporary line's app, combined with the proliferation of WebSocket-based foreground services across multiple brands, suggests the industry is converging on a different approach.
Declining since the 2024 report. The most dramatic departure in 2026 was one large contemporary line whose complete rebuild moved away from both Unity and its previous cross-platform architecture entirely. The maintenance complexity of combining a game engine with a consumer-facing mobile app has proved more challenging than initially promised.
Continues its decline as Google MLKit barcode scanning gains wider adoption. Teams are upgrading to ML Kit, which handles barcode scanning more efficiently and without the sample payload bloat noted in the 2024 report. ZXing is not disappearing overnight, but it is increasingly being treated as legacy infrastructure.
Worth documenting, but carrying less certainty — corroborated by only a single artifact, or well-established tools that did not change enough this cycle to warrant a full write-up.
Continues as a contextual signal in several apps, most clearly in one large contemporary line. Likely an enterprise identity layer for staff or partner logins. Guest-facing identity is moving toward biometrics via OwnID while enterprise stacks like Azure B2C hold steady.
Appeared in one rebuilt app as a social authentication option, primarily for guests who prefer not to create a separate account. Whether this is a new feature or carried over from the previous build is hard to confirm given the full package rewrite.
An identical cluster of seven call notification string keys appeared in three separate apps' 2026 builds belonging to the same major brand family. No corresponding voice SDK native library was identified — this may be a feature in late development. Noted here as a signal worth watching.
Remains a presence in several apps for GDPR and CCPA consent management. While Didomi is the choice for one family of European-market apps, OneTrust holds its ground elsewhere. The industry has not yet converged on a single consent management platform.
Had a mixed 2026: one large contemporary line removed it, while another major line added it back as part of a full React Native rebuild. Used situationally for specific document types such as shore excursion tickets or onboard forms in offline environments.
A lightweight, embeddable JavaScript engine by Fabrice Bellard. Its appearance as libquickjs.so in one European expedition line's build alongside the React Native runtime is an unexpected find — sometimes bundled by third-party libraries as a sandboxed script execution environment.
A full-featured audio playback library for React Native. Its presence in one expedition-style line's manifest via a registered MusicService foreground service indicates background audio playback — a natural fit for expedition voyages where audio guides for ports and destinations are a compelling feature.
The message has not yet been fully received.
If the 2024 report served as a wake-up call for the cruise industry on mobile app security, this year's findings suggest that message has not yet been fully received. These apps handle passport data, payment credentials, and personally identifiable information for hundreds of thousands of passengers — in many cases maintaining persistent connections to shipboard networks that are themselves connected to navigation and operational systems. The stakes are not abstract.
While some progress is evident, our analysis of the 2025 app cohort uncovered findings ranging from poor development hygiene to genuinely serious vulnerabilities — the kind that security teams at other software companies would treat as incidents requiring immediate remediation.
One app ships its JavaScript bundle with a plain-HTTP development API endpoint embedded in the production build. HTTP endpoints — as opposed to HTTPS — are trivially interceptable and represent a meaningful man-in-the-middle risk if that endpoint is reachable at runtime. Beyond the immediate risk, the presence of a dev endpoint in a prod bundle is a reliable signal that build pipelines are not stripping environment-specific configuration before release.
A second app was found to include hardcoded references to non-production environments in its shipped strings, including clearly labeled development and non-production hostnames. While these strings may not be reachable at runtime under normal conditions, they expose the internal environment topology of the cruise line's infrastructure. In combination with other attack vectors — such as runtime feature flags or misconfigured staging systems that remain internet-accessible — leaked environment maps can meaningfully assist a targeted attacker.
One app's verified App Links configuration includes references to staging and test Keycloak authentication realm URLs. App Links are used to associate a mobile app with specific web domains for deep linking and authentication flows. Including staging realm URLs in a production app's verification manifest creates risk if those realms remain accessible and are not hardened to the same standard as production — which, in most organizations, they are not. A staging authentication realm that accepts real credentials, or that can be manipulated to issue tokens accepted by production systems, becomes a meaningful attack surface.
Another finding worth close attention is the addition of a WebView socket bridge in one app, introduced alongside a new Capacitor WebView overlay plugin. WebView-to-native bridges are a well-understood attack surface in mobile security: if the navigation allowlist is too permissive, if origin checks are absent or bypassable, or if the bridge exposes sensitive native APIs to untrusted web content, the result can be JavaScript injection into the native layer. We are not asserting exploitation here — the finding requires deeper dynamic analysis — but the pattern warrants a careful security review before the next release.
One app appears to have removed its reference to an Android Network Security Configuration file from the application manifest, while the configuration file itself remains present in the APK. If that file contained certificate pinning rules or restrictions on cleartext traffic, removing it from the manifest means those rules are no longer applied at runtime — even though they appear to still exist. This kind of configuration drift, where a security control is silently deactivated without being explicitly removed, is particularly dangerous because it may not be caught in functional testing. The app behaves identically; the protection is simply gone.
The technical findings in this section are concerning enough on their own. But there is a more fundamental issue underneath them that is harder to fix with a CI/CD pipeline. In preparing this report, we spoke with a number of people across the industry about security practices. One exchange stood out. A senior technology executive at a large cruise company, when presented with specific vulnerabilities in their app, told us directly that they were not interested in hearing about them. Not because they disputed the findings, but because knowledge creates responsibility. If they do not formally know about a problem, they cannot be held accountable for failing to fix it. They were, in their own words, aware that things were wrong. They simply preferred not to have it confirmed. We are not going to pretend this attitude is unique to the cruise industry. But it explains something that pure technical analysis cannot: why the same categories of findings keep appearing year after year in apps maintained by organizations with the resources to fix them. The barrier is not capability. It is will.
The constructive path forward
Bundled credentials, dev endpoints in production builds, staging configuration in verified manifests — these are not sophisticated vulnerabilities. They are the kinds of issues that a well-configured CI/CD pipeline with basic secret scanning and environment validation would catch automatically, before code ever reaches the Play Store. Automated secret detection tools — several of which are free and integrate directly into common CI systems — would catch a bundled credential file or a hardcoded dev endpoint before a build is promoted to production. The investment required is primarily one of organizational will.
Scoring 2024. Looking ahead to 2027.
A great deal has changed since our last full analysis of onboard ocean apps in 2024. Some trends materialize quickly, others take longer to develop, and a few fail to gain traction altogether. Here is how our 2024 predictions fared.
Enhanced Personalization
Personalization has advanced at the infrastructure level — Adobe Experience Platform, Braze, ContentSquare — but the onboard guest-facing experience remains relatively static, with limited real-time context-aware personalization influencing itineraries or recommendations.
Augmented Reality & Spatial Computing
While there are isolated technical signals — advanced camera frameworks and indoor positioning technologies — there is little evidence of widespread or production-level adoption. AR remains confined to niche or experiential features rather than becoming a core part of the onboard experience.
Preparing for Chatbots
This prediction has largely materialized and, in some cases, moved beyond preparation into early execution. The 2026 data shows coordinated platform investments in AI-assisted guest services, including chatbot integrations and contact center platforms. Adoption is not yet universal, keeping this just short of full realization.
Improved Connectivity & Communication Tools
One of the most fully realized predictions. Multiple apps now use persistent WebSocket-based notification systems. Platform-level investments in chat, voice, and contact center integrations signal a move toward comprehensive communication ecosystems. The groundwork for reliable, real-time onboard communication is now firmly in place.
Sustainability Tracking Features
We found no meaningful evidence of sustainability tracking features being implemented in the current cohort. Despite broader industry conversations around environmental impact and carbon reporting, these concerns have not translated into guest-facing functionality within mobile apps. An area of unrealized potential.
Health & Safety Enhancements
Health and safety features, which saw rapid development during the pandemic years, have not continued to evolve in this cycle. The 2026 data shows no new or expanded functionality in this area. Development focus has shifted elsewhere; what remains appears to be baseline capability rather than active innovation.
Advanced Analytics for Personalized Marketing
The analytics ecosystem has matured significantly. The coordinated adoption of modern analytics and engagement platforms, combined with deeper instrumentation in newly rebuilt apps, demonstrates clear investment in understanding and influencing guest behavior across the full lifecycle. The underlying capability is firmly established.
Enhanced Integration with Onshore Services
This prediction has fully materialized. The expansion of pre-cruise functionality — including booking, identity verification, and shoreside engagement — reflects a clear shift toward treating the mobile app as a continuous travel companion rather than an onboard-only tool. The technical foundations required are now in place across multiple operators.
If 2026 is consolidation, the next two years are execution.
The foundations have been laid: frameworks modernized, notification infrastructure rebuilt, identity stacks upgraded. What follows is our best read on where the industry goes next.
Offline-First Booking Will Arrive, Unevenly
One of the more technically ambitious shifts on the horizon: guests making onboard bookings from their mobile device while off the ship. Dining reservations, shore excursions, spa appointments. The demand is obvious. The architecture is non-trivial — it requires reliable shoreside infrastructure, careful conflict-state handling when connectivity drops mid-transaction, and enough confidence in the data sync model to commit against a live inventory system the app cannot directly reach. Expect the first implementations to be imperfect and limited to lower-stakes bookings before expanding. At least two operators have confirmed a pre-cruise secondary booking feature in active development.
Pre-Cruise Experiences Will Continue to Deepen
The pre-cruise portion of the app experience has been growing steadily for several years, and the 2026 data suggests that trajectory is accelerating. Digital check-in has become table stakes. The next wave appears to be a more complete pre-voyage concierge experience: activity booking, dining reservations, itinerary planning, and personalized recommendations all available weeks before the guest sets foot on the ship. The identity verification infrastructure being built right now directly enables this. Passwordless login, ePassport reading, and face-matching are not just faster check-in tools — they are the foundation for a continuous authenticated relationship between the guest and the cruise line from booking through post-voyage follow-up.
Biometric Check-In Will Become Expected
The combination of passwordless login, face biometric capabilities, ePassport chip reading, and expanded document scanning all expanding in the same cycle is not a coincidence. The industry is visibly assembling the components of a check-in experience that is faster, more secure, and less dependent on physical documents than what exists today. The individual pieces are present across multiple apps right now. The prediction is that they start getting connected into coherent end-to-end flows, and that by the next report cycle at least two or three brands will have a demonstrably faster embarkation process to point to as a real competitive differentiator.
AI-Assisted Guest Services Will Move From Experiment to Expectation
The 2026 data suggests this transition is accelerating. We are aware of at least one operator that has reported handling over 13,000 service requests through a virtual concierge in a six-month period across a portion of their fleet. That is not a pilot number. That is operational scale. A significant share of this demand appears to be for basic service requests — extra pillows, housekeeping timing, towel delivery — exactly the kind of low-stakes, high-frequency interactions that a well-integrated AI assistant handles well. The first brands to connect this properly to their housekeeping and service management systems will have a genuine operational advantage.
In-App Voice Is Being Wired In
Several signals in the 2026 data point toward in-app voice calling becoming a first-class feature. A major brand family has made a coordinated platform commitment to a cloud contact center service that includes both chat and voice. A second operator has integrated both a chat and a voice SDK from the same provider. A third cluster of apps shows identical call notification string patterns without yet shipping a corresponding native library — a pattern previously seen with features in late development. At least one brand offering functional in-app voice calling as a supported feature seems likely in the next cycle.
Compliance Tooling Will Consolidate Around a Small Number of Serious Contenders
The consent management picture in 2026 is not one of convergence on a single platform, but it is beginning to look like a two-horse race. OneTrust and Didomi are both present in the fleet, serving different brand families, and both are expanding their implementations. Apps that handle consent through simpler mechanisms — basic permission dialogs and home-built solutions — will eventually migrate to one of these platforms as regulatory scrutiny increases. As GDPR enforcement matures and similar frameworks spread to other markets, the cost of a home-built or minimal consent solution will go up.
Security Hygiene Will Improve, Slowly
The optimistic reading of the 2026 data is that the industry is aware of the gap and beginning to close it: bot management tooling is being embedded at the native level, rooted device detection is present in several apps, and certificate management is receiving more attention. The less optimistic reading is that the most serious findings — bundled credentials, development configuration in production builds, staging endpoints in verified manifests — represent gaps that automated tooling would catch before a build ever reached the Play Store. Until those build pipeline controls are standard practice across the fleet, these findings will recur. We predict at least one or two brands make meaningful improvements following publication of this report.
Accessibility Will Receive More Attention, But Progress Will Remain Uneven
The accessibility picture in cruise apps has been improving, but from a low baseline. Screen reader support, high-contrast modes, and media accessibility features are appearing in a handful of apps. What is less encouraging is that these improvements are concentrated in a small number of apps while the majority of the fleet has no visible accessibility strategy. The forces pushing this forward are real: ADA litigation risk is rising, WCAG compliance is increasingly expected, and the cruise industry's passenger demographics skew older — a population with higher rates of visual, auditory, and mobility challenges. Expect the gap between leaders and laggards to become more visible and more legally consequential over the next two years.