The Marriott Multistate Settlement: $52 Million and a Court-Ordered Security Program From the State Attorneys General

The Starwood Breach

The states' account of the breach is shorter than the federal one and concentrates on U.S. records. The Massachusetts Attorney General's release says Marriott acquired Starwood in 2016 and took control of its network, and that from July 2014 through September 2018 intruders in the Starwood system "remained undetected, and ultimately accessed 131.5 million guest records pertaining to customers in the United States." Those records included contact information, gender, dates of birth, legacy Starwood Preferred Guest information, reservation information and stay preferences, along with "a limited number of unencrypted passport numbers and unexpired payment card information." Shortly after the breach was announced, the release says, a coalition of 50 attorneys general opened a multistate investigation.

The settlement reaches beyond Starwood. New York's Final Judgment on Stipulation and Order defines two sets of covered events. The "Starwood Data Breach" is the incident Marriott announced on November 30, 2018, involving about 131,500,000 guest records pertaining to customers associated with the United States. The "Unauthorized Account Access Incidents" are incidents Marriott announced on March 31, 2020 and in June 2020, in which someone used the login credentials of certain franchise property employees to reach about 5,500,000 guest records. The New Jersey complaint and the FTC describe the second episode as reaching more than 5.2 million records, 1.8 million of them relating to U.S. consumers; the figures are reported here as each document states them.

The states' legal theories differ from the federal ones in one visible respect. Alongside consumer protection and data security claims, several releases describe breach notification claims "where applicable." New Jersey's complaint, filed October 9, 2024 in the Chancery Division in Mercer County under the Consumer Fraud Act and the Identity Theft Prevention Act, makes this concrete: its second count alleges that after the Starwood breach was detected on September 7, 2018, and again after the 2020 incidents, Marriott did not notify New Jersey customers "in the most expedient time possible and without unreasonable delay." The complaint's list of security failures also includes one not in the FTC's: failing to eradicate threats after incidents and to implement lessons learned. The New Jersey release puts the number of affected New Jerseyans at more than 4.3 million.

Which States Joined and What Each Received

A footnote in New York's judgment lists every state entering a similar agreement: Alabama, Alaska, Arizona, Arkansas, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin and Wyoming, plus the District of Columbia. That is 49 states and the District; California does not appear. State releases describe "a coalition of 50 attorneys general," and the FTC's release describes the payment as going to "49 states and the District of Columbia."

According to the Massachusetts release, Massachusetts co-led the investigation with Connecticut, the District of Columbia, Illinois, Louisiana, Maryland, North Carolina, Oregon and Texas, assisted by an executive committee of Alabama, Arizona, Arkansas, Florida, Nebraska, New Jersey, New York, Ohio, Pennsylvania and Vermont. The judgment itself gives Connecticut's Privacy Section and Maryland's Consumer Protection Division a continuing role as the "Designated State Attorneys General" who receive implementation certifications, quarterly reports and assessment reports.

Paragraph 97 of New York's judgment requires Marriott to pay $52,000,000 within 30 days after the November 8, 2024 effective date, "to be divided by and among the participating states," with each state paid directly. New York's share is $2,291,100, usable at the Attorney General's discretion for future consumer protection enforcement, education or litigation, compensatory or remedial purposes, or other purposes state law permits. The judgment states that Marriott's compliance spending is separate from the payment. Shares stated in the documents read for this post:

Each state filed or entered its own instrument. New York's is a stipulated final judgment in the Supreme Court for New York County. New Jersey filed a complaint and a final consent judgment in Superior Court. The Texas release refers to an "Agreed Final Judgment," and the Massachusetts release describes its settlement as "subject to court approval." The terms described below come from New York's version, which Marriott and its counsel signed on October 9, 2024; this post did not compare it line by line with the other states' instruments.

Injunctive Terms

The judgment builds the information security program around governance before technology. Marriott must keep a board committee overseeing the program that meets at least four times a year; a footnote notes that Marriott added such a committee, the Technology and Information Security Oversight Committee, to its charter on March 15, 2021. A chief information security officer must report to that committee and to the board, and must report to the chief executive within 48 hours of determining that a security event involves personal information of 1,000 or more consumers on Marriott systems and that the information has reasonably likely been accessed or acquired without authorization. Every reportable incident goes to the committee at its next regular meeting.

The program runs for 20 years, but eight paragraphs expire 10 years after full implementation: payment card industry validation, zero trust, specific access controls, encryption, segmentation, non-production environments, digital certificates and data loss prevention. The program must use a risk assessment method from a nationally recognized security body that includes "harm to others" as a factor, and any compensating control must be documented and accepted by the chief information security officer. The judgment names Marriott's central reservation and loyalty databases, MARSHA and the Loyalty/Universal Guest Identification systems, as "Covered Databases" that the controls must reach.

Among the specific requirements:

• Zero trust principles, including continuous verification and minimizing the impact of any breach, "should be considered and, where reasonably feasible, utilized" in the program's design
• Personal information is to be collected, used, shared and retained to the minimum extent necessary for legitimate business needs or legal requirements, with retention limited to what is reasonably necessary, subject to documented accounting, tax or legal obligations and to business needs "except for marketing"
• Multifactor or equivalent authentication for remote access, removal of a departing employee's access within two business days, least privilege and periodic access reviews
• Encryption of personal information in storage and external transmission, or documented compensating controls
• Logs collected in near real time and reviewed within 24 hours, with alerts within 24 hours of unauthorized changes to critical system files at the corporate level
• Segmentation, and a prohibition on personal information in non-production environments unless de-identified
• Replacement of end-of-life software, or compensating controls before the end-of-support date
• Franchised hotels must notify Marriott within 24 hours of a compromise affecting Marriott systems and within five business days after terminating anyone with access, backed by an audit program

Specified provisions had to be implemented within a year of the effective date and certified to Connecticut and Maryland, with quarterly progress reports in the meantime. For 20 years, any acquisition of a company handling personal information triggers a post-acquisition assessment and a remediation plan with an initial timeline of no more than 18 months, and acquired assets may be connected to Marriott's production environment once they comply. An independent assessor must review the program every two years for 10 years after full implementation, five assessments in all. After that, Marriott must send Connecticut and Maryland copies of the assessments it files under the FTC order until that order expires. The state releases summarize this as an assessment every two years for 20 years.

Consumer relief comes last. Marriott must offer a deletion option through its Privacy Center. Consumers in a U.S. jurisdiction with a deletion right are handled under that law; for consumers in a jurisdiction without one, Marriott must process a verified request tied to an email address or loyalty number within 60 days, subject to exceptions for legal obligations, investigations and other legitimate business needs, and must relay requests to franchised hotels. The judgment also requires review of suspected unauthorized loyalty account activity with restoration of points, a multifactor authentication option for any Marriott account, privacy policy disclosures, email notice of material policy changes, and a point of contact for complaints referred by consumer protection agencies.

How the AG Terms Sit Beside the FTC Order

The state and federal cases were run in parallel; the FTC's October 2024 release says the agencies "worked in parallel on the investigation" and that the FTC "does not have legal authority to obtain civil penalties in this case." The money therefore sits entirely on the state side. The final federal terms, issued in December 2024, are described in the FTC's Marriott and Starwood order.

Several provisions are drafted in nearly the same words in both documents: the bar on misrepresenting how personal information is handled and protected, the loyalty account review and point restoration terms, the retention standard with its exception that excludes marketing, the post-acquisition assessment, and the vulnerability scanning and penetration testing cadence. The judgment also ties itself to the federal order directly. It defines "FTC ORDER" by reference to File No. 1923022, treats an assessor the FTC approves as meeting its own qualifications, bars Marriott from using an assessor the FTC rejects, and lets Marriott align the first assessment period with the federal one.

The state judgment goes further in places the federal order does not reach. It carries the board committee meeting schedule and the 48-hour notice to the chief executive, the zero trust and data loss prevention provisions, the named reservation and loyalty databases, the 24-hour notice duty for franchised hotels and the 18-month integration timeline. The deletion terms are framed differently. The FTC order requires a deletion request link for all U.S. consumers, while the judgment routes requests by whether the consumer's own state grants a deletion right, and applies its 60-day process to consumers in states that do not.

What the Settlement Did Not Resolve

Marriott stipulated to the judgment without admitting any violation or liability. The judgment says it creates no standard of care, gives no consumer third-party beneficiary rights, and may not be used in any proceeding as evidence that Marriott broke the law. Its release takes effect after full payment and covers only civil claims New York could have brought under its consumer protection, breach notification and personal information protection laws arising from the covered conduct.

The release carves out criminal liability and civil or administrative claims for antitrust, securities and tax violations. It does not settle or limit any private claim by a non-party, and it does not bar enforcement for conduct after the settlement or outside the covered conduct. Before going back to court over non-compliance, New York must give Marriott notice and 30 days to respond, unless the failure threatens health or safety or creates an emergency. Assessment and quarterly reports are to be treated as confidential to the extent state public records law allows.

This post's account of the terms is limited to New York's judgment. The New Jersey consent judgment is posted as a scanned image and its text was not read, and shares for the states not listed above were not compiled. Whether California pursued Marriott separately is not addressed, because no California document was read for this post.

Frequently Asked Questions