Hyatt Hotels Corporation (NYSE: H; World of Hyatt loyalty program) is a Delaware-incorporated, SEC-reporting hospitality company headquartered in Chicago, Illinois, majority-controlled by Pritzker family business interests per its own 10-K. Its Global Privacy Policy discloses broad collection (CCTV footage, precise geolocation, biometric/health/sensitive personal information, demographic data) and explicitly states it 'may sell' several categories of personal information, including geolocation data and inferences, to third parties including advertising networks and social media companies for advertising purposes. Hyatt disclosed two payment-card security incidents in its own communications: a 2015 malware attack (announced January 2016, restaurants/spas/front desks at multiple properties) and a separate front-desk breach between March and July 2017 (filed as a notice with the California Attorney General); no AG settlement, fine, or larger/more recent incident involving Hyatt was found in this research.
TRACK RECORD
1 ENFORCEMENT ACTION
A separate consumer notice letter Hyatt filed with the California Attorney General's data breach registry disclosed a second incident: self-discovered unauthorized access to payment card information from cards manually entered or swiped at the front desk of certain Hyatt-managed locations between March 18, 2017 and July 2, 2017, with cardholder name, card number, expiration date, and internal verification code involved; the letter states no indication of information beyond payment card data was affected.
Hyatt's Global Privacy Policy for Guests lists categories of Personal Information it may collect, including precise geolocation information, demographic information (gender, nationality, age, date/place of birth), and Biometric, Health-related or other Sensitive Personal Information, as well as Closed Circuit Television (CCTV) footage captured within and around Hyatt properties.
Hyatt Hotels Corporation's Form 10-K for fiscal year 2025 (filed with the SEC on 2026-02-13, CIK 0001468174) discloses Delaware incorporation and Chicago, IL headquarters on its cover page, and states that as of January 31, 2026, Pritzker family business interests own, directly or indirectly, 54.7% of total outstanding common stock and control approximately 89.0% of total voting power under the Amended and Restated Global Hyatt Agreement.
The policy's California-resident CCPA disclosure states Hyatt 'may sell' Identifiers, California customer records, demographic information, commercial information, Internet or other electronic network activity, geolocation data, and inferences, to the categories of parties described elsewhere in the policy (including advertising networks, social media companies, and business/marketing partners) for advertising and promotional purposes.
A separate consumer notice letter Hyatt filed with the California Attorney General's data breach registry disclosed a second incident: self-discovered unauthorized access to payment card information from cards manually entered or swiped at the front desk of certain Hyatt-managed locations between March 18, 2017 and July 2, 2017, with cardholder name, card number, expiration date, and internal verification code involved; the letter states no indication of information beyond payment card data was affected.
Hyatt's own press release, issued January 14, 2016, disclosed completion of an investigation into a 2015 payment-card malware incident that identified unauthorized access to payment card data from cards used onsite at certain Hyatt-managed locations, primarily restaurants and also spas, golf shops, parking, and a limited number of front desks, between approximately July/August 2015 and December 8, 2015.
The same Global Privacy Policy discloses that Hyatt uses cookies and related technologies on its Websites, Applications, and marketing emails, and that these technologies 'allow us, advertising networks, social media companies, and other providers, to place and serve advertisements and customized content,' with an opt-out available via a Cookie Center link and www.aboutads.info/choices.