Wyndham Hotels & Resorts, Inc. (NYSE: WH) is a Delaware-incorporated, SEC-reporting hotel franchisor headquartered in Parsippany, New Jersey, describing itself as the world's largest hotel franchisor with over 8,300 franchised hotels across 25 brands in approximately 100 countries, operating an asset-light, fee-based franchise model. Its Privacy Notice (last updated July 20, 2026) collects a broad set of categories including Sensitive Personal Information (SSN, financial account/credit card credentials, geolocation, racial or ethnic origin, message contents), uses Google Analytics and third-party advertising cookies/pixels for interest-based advertising, and explicitly states it may 'sell, share, or license' personal information to third parties including a former affiliated timeshare corporation and advertising-network partners, self-declaring a California 'sale.' Wyndham's App Store privacy label confirms Identifiers are used to track users across other companies' apps and websites. Its track record includes the landmark FTC enforcement action: a June 2012 complaint over three data breaches (2008-2010) exposing payment card data, upheld by the Third Circuit's August 2015 ruling affirming FTC authority over data security, and a December 2015 stipulated federal court order requiring annual PCI-DSS-conforming security audits, franchisee-network safeguards, and breach-assessment reporting to the FTC for 20 years.
TRACK RECORD
1 ENFORCEMENT ACTION
[2015-12-09]
The FTC announced on December 9, 2015 that Wyndham Hotels and Resorts agreed to settle FTC charges that its security practices 'unfairly exposed the payment card information of hundreds of thousands of consumers to hackers in three separate data breaches,' under a stipulated federal court order requiring annual PCI-DSS-conforming security audits, certification of franchisee-network safeguards, and mandatory reporting to the FTC of any future breach affecting more than 10,000 card numbers.
Wyndham's Privacy Notice (last updated July 20, 2026) defines a 'Sensitive Personal Information' category of data elements collected, including Social Security or other state ID numbers, financial account/debit/credit card numbers with security codes, geolocation, racial or ethnic origin, and the contents of mail, email, or text messages exchanged with the company.
Wyndham Hotels & Resorts, Inc.'s Form 10-K for fiscal year 2025 (CIK 0001722684) discloses Delaware incorporation, headquarters at 22 Sylvan Way, Parsippany, New Jersey, NYSE ticker WH, and describes the company as the world's largest hotel franchisor by number of franchised properties, with over 8,300 hotels across 25 brands in approximately 100 countries, operating an asset-light, fee-based franchise business model.
The Privacy Notice states Wyndham 'may sell, share or license' Contact Information for financial consideration to a former affiliated timeshare corporation, and separately discloses it 'may license, sell, or otherwise share your Personal Information with selected third parties for compensation for their own business purposes,' including timeshare organizations and advertising-network providers, with a published 'Do Not Sell or Share My Personal Information' opt-out request form.
The FTC announced on December 9, 2015 that Wyndham Hotels and Resorts agreed to settle FTC charges that its security practices 'unfairly exposed the payment card information of hundreds of thousands of consumers to hackers in three separate data breaches,' under a stipulated federal court order requiring annual PCI-DSS-conforming security audits, certification of franchisee-network safeguards, and mandatory reporting to the FTC of any future breach affecting more than 10,000 card numbers.
Apple's App Store product page for the Wyndham Hotels & Resorts app discloses under 'Data Used to Track You' that Identifiers may be used to track the user across apps and websites owned by other companies, and separately lists Analytics and App Functionality identifiers/device ID as data linked to the user's identity, per the developer's self-reported Apple privacy nutrition label.
The Privacy Notice discloses use of persistent and temporary cookies, Google Analytics for interest-based advertising, and third-party advertising cookies/pixels/beacons, stating Wyndham does not control third-party advertising partners' cookies but allows them to identify purchasing/interest patterns and run tailored ads.