Marriott (Bonvoy)

Marriott's combined litigation — the 2018 breach, a separate 2020 breach, resort-fee deception, and biometric employee timekeeping violations — includes data breaches that the FTC says affected more than 344 million customers worldwide. The FTC's related order — which carries no monetary penalty and requires Marriott to let US customers request deletion of data tied to their Bonvoy account — is a SEPARATE settlement from the $52 million Marriott paid; that money went to a 49-state-plus-DC Attorney General coalition (District of Columbia among them) over the same breaches, not to the FTC. Both the deletion right and the $52 million exist only because of these settlements, not because Marriott offered either voluntarily. Separately, the Fourth Circuit in June 2025 decertified the consumer classes based on a class-action waiver in Starwood's loyalty-program contract, illustrating how hard it can be for guests to litigate collectively, regardless of how large the underlying breach was.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-06

Primary source. www.ftc.gov/legal-library/browse/cases-proceedings/192-3022-marriott-international-inc-starwood-hotels-resorts-worldwide-llc-matter — Verified - primary source confirmed.

Arbitration

Class-action lawyers specifically 'questioned an arbitration clause in Marriott's free internet monitoring program' offered to breach-affected customers — i.e., the very remediation program Marriott offered to breach victims may itself have contained an arbitration clause limiting those victims' ability to sue over the breach that prompted the offer in the first place. A federal appeals court (Aug 2023) specifically VACATED an earlier class-certification win and sent the case back for further consideration of a class-action waiver signed by hotel guests; after the district court reinstated the classes (Nov 2023), the Fourth Circuit on June 3, 2025 held the waiver valid and enforceable and decertified the classes — showing how a contractual class-action waiver ultimately defeated class treatment in this litigation years after the breach.

Contacts

Privacy contact. Not recorded.

Legal notice. PUBLIC COMPANY (MAR). Service route: c/o General Counsel / Corporate Secretary, Bethesda, Maryland — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.

Mailing address. Not recorded.