Millions of hotel guests and Marriott Bonvoy members may be entitled to real money from the Marriott class action lawsuit in 2026. These cases cover a massive 2018 data breach, a separate 2020 breach, deceptive resort fee practices, and biometric privacy violations that collectively affected over 500 million people worldwide.
If you stayed at a Marriott, Sheraton, Westin, or any Starwood-branded property in the past decade, you could be a class member. This article covers every active lawsuit, who qualifies, what payouts look like, and exactly how to file a claim.
The numbers here are significant. The FTC reached a $52 million settlement with Marriott in 2024 over its data security failures. Separate class action cases are still moving through federal courts as of 2026.
Marriott Class Action Lawsuit 2026: What’s Actually Happening
The Marriott class action lawsuit in 2026 refers to multiple active legal cases against Marriott International for data security failures, hidden fees, and privacy violations. These are not one single lawsuit. They are several parallel legal actions working their way through different federal courts at the same time.
The biggest case stems from the 2018 Starwood data breach, which Marriott disclosed after acquiring Starwood Hotels. That breach exposed personal data belonging to approximately 500 million guests. A second breach in 2020 hit another 5.2 million guests.
Beyond data, Marriott also faces class actions over resort fees, where guests allege the company advertised one price and charged another. And in Illinois, a separate biometric privacy case targets Marriott’s use of fingerprint-based employee timekeeping systems.
| Lawsuit Type | Core Allegation | Approximate People Affected |
|---|---|---|
| 2018 Starwood Data Breach | Failure to protect guest data | Up to 500 million |
| 2020 Data Breach | Second security failure | 5.2 million |
| Resort Fee Class Action | Deceptive pricing practices | Millions of hotel guests |
| BIPA (Illinois) | Biometric data misuse | Illinois employees and guests |
Each case has its own eligibility rules, timeline, and potential payout range. Understanding which one applies to you is the first step.
Marriott Class Action Lawsuit Status: Where Things Stand Right Now
As of 2026, the Marriott class action lawsuits are at different stages of litigation. The data breach MDL (multidistrict litigation) case, formally known as In re Marriott International Inc. Customer Data Security Breach Litigation (MDL No. 2879), is being handled in the U.S. District Court for the District of Maryland.
Class certification has been a central legal battleground in this case. Marriott spent years fighting the plaintiffs’ attempts to certify a nationwide class. Courts have issued rulings that shaped what claims can proceed.
The resort fee cases are at an earlier stage in most jurisdictions. Some individual state cases have moved faster than the federal consolidated action.
| Case | Court | Current Status (2026) |
|---|---|---|
| MDL 2879 (Data Breach) | D. Maryland | Post-class certification litigation |
| Resort Fee Class Action | Multiple federal districts | Active discovery phase |
| BIPA Case | N.D. Illinois | Settlement negotiations reported |
| FTC Action | Administrative/Civil | $52M settlement finalized 2024 |
The litigation is active. Nothing has been fully resolved at the class action level as of early 2026. That means the claims window is still open for many affected consumers.
Key Takeaway: The Marriott data breach MDL is the largest active case, covering up to 500 million people, and is still moving through federal court in Maryland as of 2026.
Marriott Data Breach Settlement 2026: The Full Story
The Marriott data breach settlement story starts in November 2018, when Marriott revealed that hackers had accessed the Starwood guest reservation database as far back as 2014. The company had acquired Starwood in 2016 and inherited a security breach already in progress without knowing it.
The stolen data included names, addresses, phone numbers, email addresses, passport numbers, and payment card details for up to 500 million guests. That made it one of the largest data breaches in corporate history.
A second, smaller breach was disclosed in March 2020, exposing data for 5.2 million guests, including loyalty account information.
Think of it like buying a used car that already had a hidden engine problem. Marriott bought Starwood, inherited the security gap, and guests paid the price for a failure that started years before the acquisition.
| Breach | Year Disclosed | Data Compromised | People Affected |
|---|---|---|---|
| Starwood/Marriott Breach | November 2018 | Names, passports, payment data | Up to 500 million |
| 2020 Marriott Breach | March 2020 | Loyalty account info, contact data | 5.2 million |
Settlement negotiations between class counsel and Marriott have been ongoing. The FTC’s separate $52 million agreement in 2024 set a framework, but the class action settlement for private plaintiffs remains in negotiation as of 2026.
Did Marriott Settle the Data Breach Lawsuit?
Marriott reached a $52 million settlement with the FTC in October 2024, but that is a government enforcement action, not the private class action settlement. The class action lawsuit filed by affected consumers has not reached a final settlement as of early 2026.
The FTC settlement required Marriott to implement a comprehensive information security program and allow U.S. customers to request deletion of data linked to their loyalty accounts. It also required Marriott to review loyalty accounts for fraudulent activity.
That $52 million goes to states through the FTC process. Consumers in the class action case are seeking separate compensation through the MDL proceeding in Maryland federal court.
| Settlement Type | Amount | Who Benefits | Status (2026) |
|---|---|---|---|
| FTC Government Settlement | $52 million | State enforcement funds | Finalized October 2024 |
| Private Class Action (MDL 2879) | TBD | Affected consumers directly | Active litigation |
So the short answer is: yes, Marriott settled with the federal government. No, they have not yet settled with the millions of consumers who filed class action claims. That separate consumer case is still working through the courts.
Marriott Lawsuit Who Qualifies: Are You Eligible?
You likely qualify for the Marriott data breach class action if you stayed at a Marriott or Starwood-branded hotel between June 2014 and September 2018 and your personal data was exposed in the Starwood breach. The 2020 breach class covers guests whose loyalty account data was accessed in January or February 2020.
Qualifying hotel brands include Marriott, Sheraton, Westin, W Hotels, St. Regis, The Luxury Collection, Le Méridien, Four Points by Sheraton, Tribute Portfolio, and Design Hotels. If you stayed at any Starwood-affiliated property during the breach window, your data was at risk.
For the resort fee class action, eligibility is broader. You may qualify if you booked a Marriott hotel room and were charged a resort fee or destination fee that was not clearly disclosed during the booking process.
| Lawsuit | Qualifying Period | Qualifying Properties |
|---|---|---|
| 2018 Starwood Breach | June 2014 to Sept 2018 | All Starwood-affiliated brands |
| 2020 Breach | Jan to Feb 2020 | All Marriott brands globally |
| Resort Fee Case | 2015 to present | Marriott full-service hotels |
| BIPA (Illinois) | Varies by employment | Illinois Marriott locations |
Key Takeaway: If you stayed at any Starwood or Marriott property between 2014 and 2020 and received a breach notification email, you are almost certainly a potential class member.
Marriott Lawsuit Eligibility Requirements: The Exact Criteria
The eligibility requirements for each Marriott lawsuit differ by case type. For the data breach class action, courts have generally required that plaintiffs demonstrate they received a notification from Marriott about the breach, or that they can show their information was stored in the compromised Starwood database.
You do not need to prove you suffered identity theft or fraud. Courts have accepted the increased risk of future harm and the cost of credit monitoring as sufficient injury for class membership in data breach cases.
For the resort fee class action, eligibility typically requires that you:
- Booked a Marriott hotel room directly through Marriott’s website or app
- Were charged a resort fee, destination fee, or amenity fee not disclosed upfront
- Made the booking during the class period (dates vary by jurisdiction)
For the BIPA case in Illinois, eligibility is limited to Illinois residents or employees at Illinois Marriott locations whose biometric identifiers were collected without written consent.
| Requirement | Data Breach Case | Resort Fee Case | BIPA Case |
|---|---|---|---|
| Must prove actual fraud | No | No | No |
| Must have received breach notice | Helpful but not required | N/A | N/A |
| Geographic requirement | Worldwide | U.S. bookings | Illinois only |
| Time period | 2014 to 2020 | 2015 to present | Varies |
How Much Will I Get From the Marriott Lawsuit?
Most Marriott class action claimants can realistically expect between $50 and $500 depending on their specific losses and which case they are part of. Claimants who can document out-of-pocket expenses tied to the breach, like credit monitoring costs or fraudulent charges, may receive more.
The exact payout depends on the total settlement fund amount, the number of valid claims filed, and whether you are in a higher or lower damage tier. Courts typically structure these settlements with tiered payouts.
People who simply had their data exposed but suffered no documented harm usually fall into the lowest compensation tier. People with documented identity theft, fraudulent accounts, or financial losses may recover significantly more.
| Damage Category | Estimated Payout Range |
|---|---|
| Data exposed, no documented harm | $25 to $75 |
| Credit monitoring costs documented | $75 to $200 |
| Fraudulent accounts or charges documented | $200 to $500 |
| Significant identity theft losses | Up to $2,500 or more |
No final settlement fund amount has been set in the class action as of 2026. These ranges are based on comparable data breach settlements and the scale of the Marriott cases.
Key Takeaway: Claimants with documented financial harm from the Marriott breach can expect meaningfully higher payouts than those whose only injury was data exposure alone.
Marriott Settlement Payout Amount: Breaking Down the Numbers
The Marriott settlement payout amount in the class action case depends on a formula courts use in every large data breach settlement. It starts with the total settlement fund, subtracts attorneys’ fees (typically 25 to 33 percent), subtracts administrative costs, and divides what remains among valid claims.
In comparable data breach cases, this math often produces smaller individual payouts than people expect. The Equifax data breach settlement is a good reference point. That case, which affected 147 million people, offered up to $125 per person but actual payments came in much lower due to the volume of claims.
Marriott’s breach is even larger in terms of affected individuals. If tens of millions of people file valid claims, individual payouts will be compressed. If claim volume is lower, individual payouts could be higher.
| Comparable Settlement | Total Fund | People Affected | Avg. Individual Payout |
|---|---|---|---|
| Equifax (2019) | $575 million | 147 million | Under $10 for most |
| Capital One (2023) | $190 million | 100 million | $25 to $75 |
| Marriott (Class Action) | Not yet set | Up to 500 million | TBD |
The resort fee case, if settled separately, typically produces higher per-person payouts because the financial harm is more directly traceable. Guests who paid a $35 daily resort fee they were not warned about have a cleaner damages calculation.
Marriott Resort Fee Lawsuit 2026: The Hidden Charges Case
The Marriott resort fee lawsuit targets a practice that has frustrated hotel guests for years. Hotels advertise a room rate, you book it, and then at checkout you discover an additional $25 to $95 per night resort fee that was buried in fine print or disclosed only after you committed to the booking.
Plaintiffs in the resort fee class action argue this constitutes deceptive advertising under federal and state consumer protection laws. The core claim is simple: if you advertise a price, that should be the price.
The FTC has taken interest in resort fee practices across the hotel industry, not just Marriott. In 2022 and 2023, the FTC launched a broader initiative targeting what it calls “junk fees” in hospitality, travel, and other sectors.
| Fee Type | Average Amount Per Night | Disclosed Upfront? | Basis for Lawsuit |
|---|---|---|---|
| Resort fee | $35 to $95 | Rarely | Deceptive pricing |
| Destination fee | $25 to $75 | Rarely | False advertising |
| Amenity fee | $15 to $40 | Sometimes | Undisclosed charges |
Marriott is far from alone in this practice. But its size, the volume of bookings, and the systematic nature of the fee structure made it a prime target for class action plaintiffs.
Marriott Hidden Fees Class Action: What They Were Accused Of
The Marriott hidden fees class action alleges that Marriott International systematically misled consumers by advertising artificially low room rates and then adding mandatory fees at the point of sale or check-in. This practice is sometimes called “drip pricing.”
Plaintiffs argue that Marriott’s online booking platform showed one price prominently, while burying resort fees in small text or displaying them only after customers had already entered their personal and payment information. By that point, most consumers felt too committed to back out.
The lawsuit also alleges that Marriott continued this practice even after state attorneys general and the FTC issued warnings about fee transparency. That continued conduct, plaintiffs argue, shows the deception was intentional and systematic, not accidental.
- Marriott allegedly advertised rates 20 to 40 percent lower than the actual total cost
- Resort fees were sometimes disclosed only on a final confirmation screen
- Some guests report being told about fees at physical check-in, not during online booking
- Affected bookings span Marriott-branded and third-party travel platforms
Key Takeaway: The hidden fees lawsuit is about the systematic gap between the price Marriott advertised and the price guests actually paid, which is a consumer protection violation in most U.S. states.
Marriott Bonvoy Lawsuit: What Loyalty Members Need to Know
The Marriott Bonvoy lawsuit covers claims that Marriott mishandled the personal data of its loyalty program members and made misleading representations about the program’s benefits and value. Bonvoy members are in a unique position because they handed Marriott far more personal data than a typical one-time guest.
Bonvoy members store names, addresses, payment methods, travel history, dietary preferences, and sometimes passport details in their loyalty profiles. All of that data was part of what was exposed in the 2020 breach.
Separate from the breach, some Bonvoy members have filed complaints alleging that Marriott devalued points without adequate notice. Devaluing points without transparency can be a breach of contract claim, though these cases are typically harder to certify as a class.
| Claim Type | Who It Affects | Legal Theory |
|---|---|---|
| Bonvoy data exposure | All Bonvoy members active 2018 to 2020 | Negligence, data breach |
| Points devaluation | Members who held significant point balances | Breach of contract, deceptive practices |
| Unauthorized account access | Members whose accounts were accessed by fraudsters | Negligence, failure to secure |
If you are a Bonvoy member who received a notification about unauthorized account activity or suspicious login attempts between 2019 and 2023, your experience could be directly relevant to the class action case.
Marriott BIPA Lawsuit Illinois: The Biometric Privacy Case
The Marriott BIPA lawsuit in Illinois is a separate and distinct legal action from the data breach cases. BIPA stands for the Illinois Biometric Information Privacy Act, a state law that gives Illinois residents strict rights regarding how their biometric identifiers, like fingerprints and facial scans, are collected and stored.
The Illinois case alleges that Marriott collected fingerprints from employees at Illinois properties for timekeeping purposes, specifically through finger-scan time clock systems. BIPA requires companies to obtain written consent before collecting biometric data and to publish a written policy for data retention and destruction.
Plaintiffs allege Marriott failed to meet those requirements. BIPA violations carry statutory damages of $1,000 per negligent violation and $5,000 per intentional violation, making the potential exposure significant even for a smaller class of plaintiffs.
| BIPA Requirement | Alleged Violation |
|---|---|
| Written informed consent before collection | Not obtained |
| Published biometric data retention policy | Not posted |
| Prohibition on selling biometric data | Alleged improper sharing |
| Data destruction schedule | Not followed |
This case is limited to Illinois residents and employees. But the dollar amounts per person are much higher than in the data breach class action, which makes the BIPA case worth watching closely if you worked at a Marriott in Illinois.
Marriott FTC Settlement: What the Federal Government Did
The Federal Trade Commission finalized a $52 million settlement with Marriott International in October 2024. This was a government enforcement action, not a private class action. The money goes through state attorneys general, not directly to individual consumers through a claims process.
The FTC found that Marriott made “false and misleading” statements about its data security practices. The commission concluded that Marriott claimed to protect consumer data while implementing “unreasonable” security measures that failed to prevent two major breaches.
Under the settlement terms, Marriott agreed to:
- Establish a detailed information security program reviewed by independent assessors
- Allow U.S. consumers to request deletion of personal data tied to their loyalty accounts
- Review its Marriott Bonvoy accounts for fraudulent activity and notify affected members
- Refrain from misrepresenting its data security practices in the future
| FTC Settlement Requirement | Details |
|---|---|
| Total amount | $52 million |
| Who receives the money | State enforcement funds |
| Consumer data deletion right | Yes, for U.S. Bonvoy members |
| Security program requirement | Yes, independent review required |
| Misrepresentation prohibition | Permanent injunction |
The FTC settlement does not prevent individual consumers from pursuing class action claims. Both legal tracks can run simultaneously.
Key Takeaway: The FTC’s $52 million deal with Marriott is real money, but it flows through government channels, not directly to individual consumers, which is why the private class action matters separately.
Marriott Loyalty Program Lawsuit: Points, Promises, and Problems
The Marriott loyalty program lawsuit focuses on claims that Marriott made material misrepresentations to Bonvoy members about the value, earning rate, and redemption value of loyalty points. Some plaintiffs allege Marriott changed program rules retroactively without adequate notice or compensation.
When Marriott merged the old Starwood Preferred Guest (SPG) program with the Marriott Rewards program to create Bonvoy in 2019, many members reported that their existing points lost value under the new redemption structure. Points they had accumulated under one system were converted at rates that plaintiffs say were unfavorable.
This is similar to what happened when airline miles programs have devalued. If someone saved frequent flyer miles for a business class ticket and suddenly that ticket cost twice as many miles, they’d feel cheated. Bonvoy members experienced something similar.
| Allegation | Affected Members |
|---|---|
| SPG point conversion undervalued legacy points | Former SPG members |
| Retroactive category changes raised redemption costs | All Bonvoy members |
| Missing points not restored after breach | Breach-affected members |
| Unauthorized point redemptions not fully reimbursed | Fraud-targeted members |
Courts have been cautious about certifying loyalty point cases as class actions because damages can be highly individualized. But several of these claims are being pursued alongside the broader breach litigation.
How to File a Marriott Class Action Claim: Step-by-Step
Filing a Marriott class action claim in 2026 depends on which case you are joining. For the data breach MDL, the process involves submitting a claim form through the official settlement claims administrator once a settlement is finalized and the claims period opens.
Until a final settlement is approved in the MDL case, no formal consumer claims process is open for the data breach class action. However, you can and should take steps now to document your potential claim.
Steps to take right now:
- Gather any breach notification emails you received from Marriott or Starwood
- Document any out-of-pocket expenses you incurred related to the breach, like credit monitoring subscriptions
- Pull records of hotel stays at Starwood or Marriott properties between 2014 and 2020
- Save any communications from Marriott about fraudulent account activity
- Check your credit reports for accounts you did not open during or after the breach window
For the resort fee case, if you have records of being charged fees that were not disclosed during booking, save those confirmation emails, credit card statements, and hotel receipts.
| Action | When to Do It | Why It Matters |
|---|---|---|
| Save breach notification emails | Now | Proves you were affected |
| Document out-of-pocket costs | Now | Supports higher tier claim |
| Gather hotel stay records | Now | Establishes class membership |
| Monitor settlement news | Ongoing | Know when claims period opens |
| Register with claims site | When available | Starts your official claim |
There is no cost to file a class action claim. You do not pay to participate and you do not pay attorneys out of pocket.
Marriott Class Action Deadline 2026: Don’t Miss Your Window
The Marriott class action deadline in 2026 is not a single fixed date because multiple cases are at different litigation stages. Each case will have its own claims period once a settlement is reached and court-approved notice is issued.
For the data breach MDL, no final settlement has been announced as of early 2026. When a settlement is approved, the court will set a claims filing deadline. In most large class actions, that window is 60 to 180 days from the date notice is mailed or posted online.
Missing a deadline means permanently losing your right to file a claim and receive money from that settlement. Courts do not grant extensions for individual claimants who simply missed the notice.
| Case | Settlement Status | Expected Claims Deadline |
|---|---|---|
| MDL 2879 Data Breach | No final settlement yet | TBD after court approval |
| Resort Fee Class Action | No final settlement yet | TBD |
| BIPA Illinois | Negotiations reported | Possible 2026 |
| FTC Settlement | Finalized Oct 2024 | Consumer deletion rights active |
The best way to protect yourself is to stay updated on the case by following court filings or checking the official settlement administrator website when one is established. Watch for official notice in your email inbox if Marriott has your contact information on file.
Key Takeaway: No universal Marriott class action claims deadline exists yet in 2026, but when each case settles, you typically have 60 to 180 days to file and missing that window means losing your right to compensation permanently.
Frequently Asked Questions
Is the Marriott class action lawsuit still open in 2026?
Yes, the Marriott class action lawsuit is still active in 2026.
The data breach MDL (Case No. 2879) in Maryland federal court has not reached a final consumer settlement.
Claims cannot be formally filed until a settlement is approved by the court, but affected consumers should document their claims now.
How do I know if I was affected by the Marriott data breach?
Marriott sent breach notification emails to affected guests starting in late 2018 and again in 2020.
If you stayed at a Starwood-brand hotel between 2014 and 2018, your data was very likely in the compromised database.
You can also check your credit report history from that period for any suspicious activity that may indicate your data was misused.
How much money can I get from the Marriott settlement?
Most class members without documented financial harm can expect between $25 and $75 from the data breach settlement.
Claimants with documented costs like credit monitoring fees or identity theft losses may receive $200 to $500 or more.
Final payout amounts depend on the total settlement fund and the number of valid claims, neither of which is set as of early 2026.
What is the deadline to file a Marriott class action claim in 2026?
There is no single filing deadline yet because the data breach class action has not reached a final settlement as of 2026.
Once a settlement is approved, the court will issue notice and set a claims filing deadline, typically 60 to 180 days after notice is issued.
Watch your email for official notice from Marriott or a court-appointed claims administrator.
Do I need a lawyer to join the Marriott class action lawsuit?
No, you do not need a personal attorney to file a claim in the Marriott class action.
Class action settlements are designed so that affected consumers can file claims directly through an online or mail-in process at no cost.
Attorneys representing the class get paid from the settlement fund, not from your individual payout.
What to Do Right Now
The Marriott class action lawsuit is one of the largest consumer data breach cases in U.S. history. If you stayed at a Marriott or Starwood property between 2014 and 2020, your data was almost certainly compromised.
Start gathering your documentation today. Save breach notification emails, hotel receipts, credit card statements, and any records of financial harm. When the settlement claims window opens, you’ll be ready.
Check for official updates from the settlement administrator and from the U.S. District Court for the District of Maryland. The moment a settlement is announced, the clock starts on your filing deadline.
