What Marriott International (Marriott Bonvoy) does with your data

What it collects and does with your data

• Marriott Media targets nearly 237 million Bonvoy members using 200-plus targetable attributes across Marriott digital, in-room, third-party sites, and social; pilot partners included PepsiCo, Visa, United, Uber, Starbucks.
• FTC: breaches 2014 to 2020 affected more than 344 million customers, including 339 million Starwood records and 5.25 million unencrypted passport numbers.

Sensitive data

• passport numbers (breach)
• payment cards (breach)
• stay history and travel intent

Enforcement and litigation

3 matters in the research. Where the research says alleged, pending, or settled without admitting wrongdoing, so does this page.

• FTC consent order: 20-year security program, deletion link, loyalty point restoration. Announced 2024-10-09. Status: consent order announced; final-approval date not verified in this research.
• Multistate settlement with 49 states and DC. Amount: $52 million.
• Consumer MDL (D. Md.): Fourth Circuit reversed class certification a second time on 2025-06-03, enforcing the Starwood loyalty program's class action waiver. Status: no certified class.

Who else holds your data

Organizations holding a copy of your data, as the research counts them: at least 3. Marriott, ad partners, breach actors.

Third parties: Named: Marriott Media advertisers

Data brokers linked to Marriott International (Marriott Bonvoy)

None. The research documents no flow between Marriott International (Marriott Bonvoy) and a data broker.

Data practices score

8 of 15. Five components, each 0 to 3. How the score works

Sells or shares

2

Enforcement

3

Retail media scale

1

Sensitive data

1

Opt-out friction

1

Estimated emissions for one person

Research gaps

• Marriott Media revenue.
• Final order date.