Marriott International has been sued and investigated on multiple fronts over the past decade, with the largest matters involving a series of data breaches that exposed more than 344 million customer records, deceptive “resort fee” pricing challenged by state attorneys general, and a copyright dispute with Sony Music Entertainment. The company has also faced employment discrimination claims, accessibility enforcement, and a wage-disclosure class action. This is a rundown of the major Marriott lawsuits, what they alleged, and how they were resolved.
The $52 Million Data Breach Settlement
On October 9, 2024, the Federal Trade Commission and attorneys general from 49 states and the District of Columbia announced parallel settlements with Marriott over three data breaches. California did not join the multistate agreement.
Marriott agreed to pay $52 million to the participating states. The FTC settlement carried no monetary penalty because the agency lacks authority to impose civil fines in this kind of case; instead, it focused on security reforms. The FTC finalized its consent order on December 20, 2024.
The order runs for 20 years and requires Marriott to build a comprehensive information security program, undergo a third-party security assessment every two years, and have its CEO certify compliance annually. It also limits how long the company can store customer data, gives U.S. customers the right to request deletion of personal information tied to their email address or Bonvoy account, requires Marriott to restore loyalty points stolen by unauthorized third parties on request, and forces the company to run security reviews of any future acquisition target. Franchisees and critical IT vendors must be brought under security safeguards backed by audits.
Regulators outside the U.S. also acted. The UK Information Commissioner’s Office fined Marriott £18.4 million in October 2020 for GDPR violations tied to the same breach period, a figure reduced from an initial £99 million notice after the ICO credited the company’s cooperation and pandemic-related economic effects.
What Happened in the Breaches
The exposures trace back to Starwood Hotels and Resorts, which Marriott acquired in 2016. A first intrusion began in June 2014, stealing payment card information from more than 40,000 customers and going undetected for roughly 14 months.
The far larger breach started around July 2014, when an attacker planted malware on a Starwood web server and used stolen administrator credentials to reach guest reservation databases. The access continued for more than four years, straight through the Marriott acquisition, until a security alert flagged it in September 2018. Marriott disclosed the breach on November 30, 2018. About 339 million guest records were exposed, including names, addresses, email addresses, passport numbers, and payment card data. Some 5.25 million passport numbers were stored unencrypted.
A third breach ran from September 2018 to February 2020 and exposed another 5.2 million records, including 1.8 million belonging to U.S. consumers. Regulators found Marriott had failed to implement adequate password controls, multi-factor authentication, network monitoring, and software patching.
Where the Consumer Class Action Stands
Consumers filed their own class action lawsuits, consolidated as multidistrict litigation in the U.S. District Court for the District of Maryland. The district court initially certified eight classes covering an estimated 47.7 million exposed records across six states.
That changed on June 3, 2025. In Maldini v. Marriott International, Inc., the Fourth Circuit Court of Appeals ruled that a class-action waiver in the Starwood Preferred Guest program’s terms and conditions was valid and enforceable, reversing the certification. The panel found that Marriott had not forfeited the waiver by participating in years of MDL pretrial proceedings, because consolidated MDL cases retain their individual identities.
The waiver’s language, covering disputes “arising out of or related to” the loyalty program, reached beyond contract claims to include the plaintiffs’ negligence and consumer protection theories. Citing American Express Co. v. Italian Colors Restaurant, the court held that Rule 23 does not create a non-waivable right to class proceedings and that the waiver was not unconscionable under New York law. Issue classes certified against Marriott’s IT services provider, Accenture, also fell, because the district court had justified them only on the efficiency of trying them alongside the Marriott classes.
Named plaintiffs’ individual claims remain, but the ruling effectively forecloses class-wide recovery for SPG members who agreed to the program’s terms.
Resort Fee Lawsuits and the New Pricing Rule
On July 9, 2019, the District of Columbia Attorney General sued Marriott under the District’s Consumer Protection Procedures Act, alleging the company advertised deceptively low room rates and then added mandatory “resort fees,” “amenity fees,” or “destination fees” of $9 to $95 per night. The complaint said at least 189 Marriott properties charged such fees and that the charges were disclosed only after booking began or lumped under a “Taxes and Fees” line item that suggested they were government-imposed. The suit followed a broader hotel pricing investigation by attorneys general in all 50 states and DC.
In November 2021, the Pennsylvania Attorney General secured an Assurance of Voluntary Compliance from Marriott, giving the company nine months to display total prices, inclusive of mandatory fees, as the most prominent figure on its U.S. booking websites. Marriott did not admit wrongdoing and then missed the deadline. After multiple extensions, the Pennsylvania AG fined Marriott $225,000 for noncompliance and obtained a new court order enforcing the original terms. As of May 2023, Marriott committed to showing prices inclusive of resort and destination fees as the first and most prominent figure across Marriott.com, its mobile app, and phone reservations for all properties that charge such fees worldwide.
The federal government has since caught up. The FTC’s Trade Regulation Rule on Unfair or Deceptive Fees, finalized in December 2024 and effective May 12, 2025, requires short-term lodging providers to include all mandatory fees in the upfront advertised price and to make the total the most prominent figure shown. The rule does not ban resort fees; it prohibits hiding them from the initial price display.
The Sony Music Copyright Settlement
In May 2024, Sony Music Entertainment sued Marriott in the U.S. District Court for the District of Delaware, alleging “rampant” and “willful” copyright infringement through the use of copyrighted recordings, including music by Beyoncé and Michael Jackson, in promotional videos on Marriott’s social media accounts and in content produced by paid influencers. Sony said it had notified Marriott of the infringements repeatedly over four years. It sought statutory damages of up to $150,000 per infringed work, with potential exposure above $100 million.
The case was voluntarily dismissed with prejudice in October 2024 after an undisclosed settlement. Media reports estimated the figure in the tens of millions. Marriott then told hotel owners and franchisees it intended to recoup the settlement by assessing charges to managed and franchised properties, citing indemnification clauses in its management and franchise agreements. Some owners objected, arguing the liability stemmed from Marriott’s own corporate social media conduct, not from any individual hotel’s operations. Legal commentators noted that Sony’s “willful” infringement allegations could give owners grounds to resist, since willful conduct is often excluded from standard indemnification provisions.
Employment, Discrimination, and Accessibility Cases
EEOC Religious Accommodation Settlement
On December 11, 2025, the Equal Employment Opportunity Commission announced that Marriott Vacations Worldwide Corporation and Marriott Ownership Resorts had agreed to pay $175,000 to settle a religious discrimination lawsuit. The EEOC alleged the companies revoked a previously granted accommodation for a Seventh-Day Adventist sales executive at a Sheraton Vacation Club property in Florida who had been allowed to avoid Saturday shifts to observe the Sabbath. After a management change, she was scheduled for Saturdays, which hurt her commissions and led to her resignation in June 2023. A three-year consent decree requires updated religious accommodation policies at Florida Sheraton Vacation Club properties, Title VII training for managers and HR staff, a workplace rights notice, and periodic EEOC reporting. The companies did not admit liability.
Illinois Discrimination and Retaliation Suit
In March 2026, former assistant rooms operation manager Roaldo Sulejmani filed suit in the U.S. District Court for the Northern District of Illinois, alleging he was fired from the Marriott Downtown Magnificent Mile in October 2025 because of his race and gender and in retaliation for reporting internal discrimination. The complaint says a hotel manager warned him to “think twice before you put ink on paper” when he tried to file a complaint. Marriott cited an incident involving alleged profanity toward a guest and his carrying pepper spray as grounds for suspension and termination. Sulejmani says the person involved was a trespasser who had threatened him and that the pepper spray policy was enforced unevenly. The case remains in its early stages.
ADA Accessible Room Enforcement
In June 2024, Marriott settled with the U.S. Attorney’s Office for the District of Colorado over allegations that guests with disabilities had difficulty reserving accessible rooms at Marriott-branded hotels. The company agreed to list accessible rooms in a single, clear location on each hotel’s website, make them available through major third-party booking sites and the Bonvoy system, train call-center staff on accessible-room requests, and implement complaint tracking. Marriott paid a $50,000 civil penalty.
A separate property-specific settlement announced in January 2025 covers the Stamford Marriott Hotel and Spa in Connecticut. That hotel agreed to make physical improvements over 30 months to meet 2010 ADA accessibility standards, including modifying a suite for guests with mobility disabilities, upgrading 14 rooms for guests with hearing disabilities, and improving parking, lobby dining areas, and restrooms.
Washington Wage-Disclosure Class Action
Marriott and several affiliates, including Courtyard Management, W Operating Company, Starwood Hotels, and Sheraton Operating, settled a Washington State class action alleging they failed to include wage scales, salary ranges, and benefit descriptions in job postings as state law requires. In Moliga v. Marriott International, Inc., the parties established a $3.762 million fund with an estimated minimum payout of roughly $1,388 per valid claimant. The claim deadline was December 14, 2024, with a final approval hearing in January 2025.