Hilton Worldwide Holdings Inc. (NYSE: HLT; loyalty program Hilton Honors, 243 million members) is a Delaware-incorporated, SEC-reporting hospitality company headquartered in McLean, Virginia, operating 9,158 properties in 143 countries as of year-end 2025 through a management-and-franchise segment plus an ownership segment. Its Global Privacy Statement (last updated August 7, 2026) discloses broad collection including CCTV footage, promotional images, vehicle and geolocation data, and device information, engages third-party advertising partners for cross-device interest-based advertising via cookies/pixels/mobile ad IDs, self-declares that this advertising sharing 'may be considered a sale' under California law, and notes franchised and joint-venture hotels are operated by legally separate entities that may be independent data controllers for guest data. Apple's App Store privacy label for the Hilton Honors app confirms Contact Info, Identifiers, and Usage Data are used to track users across other companies' apps and websites. Hilton's track record includes a $700,000 joint New York/Vermont Attorney General settlement (October 2017) over two 2015 payment-card breaches (over 350,000 card numbers exposed) and untimely breach notification; no larger or more recent breach or regulator action was found.
TRACK RECORD
1 ENFORCEMENT ACTION
[2017-10-31]
The New York Attorney General announced on October 31, 2017 a $700,000 joint settlement with Hilton Domestic Operating Company, Inc. (with the Vermont AG) after two 2015 data security incidents exposed over 350,000 credit card numbers; the investigation found Hilton did not provide timely consumer notice (notice was not given until November 24, 2015, over nine months after the first intrusion was discovered) and did not maintain reasonable data security, and the settlement required Hilton to reform its data security practices and provide expedient breach notice going forward.
Hilton's Global Privacy Statement (last updated August 7, 2026) lists the categories of personal information collected in the past 12 months, including Hilton Honors number, WeChat ID, passport/ID information, vehicle information, CCTV footage, promotional images, geolocation information, device information, and streaming service usage, alongside standard contact and payment data.
Hilton Worldwide Holdings Inc.'s Form 10-K for fiscal year 2025 (filed with the SEC on 2026-02-11, CIK 0001585689) discloses Delaware incorporation, headquarters at 7930 Jones Branch Drive, McLean, VA, and that Hilton operated 9,158 properties comprising 1,351,351 rooms in 143 countries and territories as of December 31, 2025, with 243 million Hilton Honors members, through a management-and-franchise segment and an ownership segment.
The Global Privacy Statement's California-resident appendix discloses that sharing device identifiers/cookies, hashed contact info, usage/browsing information, location, and inference data with advertising networks, advertisers, and social media networks for targeted advertising 'may be considered a sale' under California law; the main statement separately discloses that franchised hotels are 'operated by entities that are separate from Hilton' and, along with joint-venture hotels, 'those entities may be independent data controllers for guest data.'
The New York Attorney General announced on October 31, 2017 a $700,000 joint settlement with Hilton Domestic Operating Company, Inc. (with the Vermont AG) after two 2015 data security incidents exposed over 350,000 credit card numbers; the investigation found Hilton did not provide timely consumer notice (notice was not given until November 24, 2015, over nine months after the first intrusion was discovered) and did not maintain reasonable data security, and the settlement required Hilton to reform its data security practices and provide expedient breach notice going forward.
Apple's App Store product page for the Hilton Honors app discloses under 'Data Used to Track You' that Contact Info, Identifiers, and Usage Data may be used to track the user across apps and websites owned by other companies, per the developer's self-reported Apple privacy nutrition label.
The Global Privacy Statement states that Hilton partners with third parties to provide interest-based advertising targeted based on user activity across websites, mobile apps, and devices over time, using server logs, cookies, web beacons, tags, pixels, mobile advertising IDs, and cross-device linking, and that advertising partners may combine activity on Hilton's services with activity on other websites, apps, and devices.