Marriott International, Inc. (NASDAQ: MAR) is a Delaware-incorporated, SEC-reporting hotel company operating a franchise-heavy model — at year-end 2025 it had 7,644 franchised/licensed properties versus 2,017 company-operated properties, spanning Bonvoy loyalty brands. Its Global Privacy Statement (last updated January 1, 2026) discloses broad first- and third-party data collection including biometric data, images/video/audio, and consent-based precise geolocation, and permits sharing with independently-operated Franchisees and named Advertising Partners (Epsilon, Meta, Google, Adara, Pinterest, Snap) for cross-device ad tracking. Apple's App Store privacy label confirms the Bonvoy app uses Search History and Identifiers to track users across other companies' apps and websites. The company's track record includes the 2018-disclosed Starwood breach (~339-344 million guest records, undetected since 2014), a UK ICO fine of £18.4 million (2020), and a 2024 FTC administrative order requiring a comprehensive information security program and a customer-facing data-deletion mechanism.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2024-10-09]
The FTC announced on 9 October 2024 a proposed order requiring Marriott International, Inc. and its subsidiary Starwood Hotels & Resorts Worldwide LLC to implement a comprehensive information security program to settle charges that the companies' failure to implement reasonable data security led to three large data breaches from 2014 to 2020 impacting more than 344 million customers worldwide; the settlement also requires Marriott to provide U.S. customers a way to request deletion of personal information tied to their email address or loyalty account number, and Marriott separately agreed to pay $52 million to 49 states and the District of Columbia over the same conduct.
The UK Information Commissioner's Office announced on 30 October 2020 that it fined Marriott International Inc £18.4 million for failing to keep customers' personal data secure, in connection with a 2014 cyber-attack on Starwood Hotels and Resorts Worldwide's systems (undetected until September 2018, after Marriott's acquisition of Starwood) that Marriott estimated affected approximately 339 million guest records worldwide.
Marriott's Global Privacy Statement (last updated January 1, 2026) states that, in more limited circumstances, Marriott may also collect data about family members and companions (including names and ages of children), biometric data, and images/video/audio data including voice recordings of customer service calls and footage from security cameras in public areas; it separately states Marriott may collect a device's precise geolocation via satellite, cell-tower, or Wi-Fi signals with the user's consent/opt-in.
Marriott International, Inc.'s Form 10-K for fiscal year 2025 (State of incorporation: Delaware; filed with the SEC on 2026-02-10, CIK 0001048286) discloses that at year-end 2025 the company had 7,644 franchised, licensed, and other properties (1,183,513 rooms and timeshare units) versus 2,017 company-operated properties (580,170 rooms), evidencing a predominantly franchise-based business structure headquartered in Bethesda, Maryland.
The Global Privacy Statement discloses that Marriott shares Personal Data and Other Data with named Advertising Partners including Epsilon, Meta, Google, Adara, Pinterest, and Snap for marketing, advertisements, and promotions, and separately discloses Personal Data to Franchisees of Marriott-branded properties (independently owned and operated businesses), who 'have a limited right to use certain Personal Data for their own purposes'; U.S. state-law residents are offered an opt-out of the sale/sharing of Personal Data and of targeted advertising via a 'Your Privacy Choices' page.
The UK Information Commissioner's Office announced on 30 October 2020 that it fined Marriott International Inc £18.4 million for failing to keep customers' personal data secure, in connection with a 2014 cyber-attack on Starwood Hotels and Resorts Worldwide's systems (undetected until September 2018, after Marriott's acquisition of Starwood) that Marriott estimated affected approximately 339 million guest records worldwide.
The FTC announced on 9 October 2024 a proposed order requiring Marriott International, Inc. and its subsidiary Starwood Hotels & Resorts Worldwide LLC to implement a comprehensive information security program to settle charges that the companies' failure to implement reasonable data security led to three large data breaches from 2014 to 2020 impacting more than 344 million customers worldwide; the settlement also requires Marriott to provide U.S. customers a way to request deletion of personal information tied to their email address or loyalty account number, and Marriott separately agreed to pay $52 million to 49 states and the District of Columbia over the same conduct.
Apple's App Store product page for the Marriott Bonvoy app discloses under 'Data Used to Track You' that Search History and Identifiers data may be used to track the user across apps and websites owned by other companies, per the developer's self-reported Apple privacy nutrition label.
The Global Privacy Statement states that advertising companies serving ads on Marriott's Websites and Apps place or recognize a unique cookie on the user's browser (including via pixel tags) and use these technologies, together with information about the user's online activity, to recognize the user across the devices they use, such as a mobile phone and a laptop, in order to serve targeted advertising.