Hospitality operators hold guest, payment, and travel data across franchised systems where responsibility for a breach is rarely clear in advance. This hub covers those issues.
Data Security Rules
October 19, 2026
On December 20, 2024 the FTC issued its final complaint and decision and order against Marriott and Starwood, Docket No. C-4807, alleging deceptive and unfair data security behind three breaches between 2014 and 2020. The order mandates a specified security program, biennial outside assessments, deletion requests and loyalty point restoration for 20 years.
Read more →
Privacy Litigation
October 19, 2026
In 2015 the Supreme Court held 5 to 4 that the Los Angeles ordinance letting any police officer inspect a hotel's guest registry on demand was facially invalid under the Fourth Amendment, because operators had no opportunity for precompliance review. The city amended the provision in 2017 so that officers request the operator's consent.
Read more →
State AG Enforcement
October 19, 2026
On October 9, 2024 the attorneys general of 49 states and the District of Columbia settled with Marriott over the Starwood reservation database breach and a later intrusion using franchise employee credentials. Marriott agreed to pay $52 million divided among the states and to a detailed, court-ordered security program, without admitting liability.
Read more →