Marriott and Starwood: years of guest data increased the stakes

What was reported

The FTC finalized an order resolving allegations of inadequate security at Marriott and Starwood linked to three breaches. The affected information included passport, payment-card and loyalty details. Alongside security improvements, the order required a retention policy and a way for U.S. customers to request deletion of certain personal information.

Read the report from Federal Trade Commission

Read the FTC’s account of the three incident timelines

Our perspective

Our reading: Retention is an access decision stretched over time. In AI memory, keeping useful context should involve an explicit reason and expiry decision, rather than saving everything by default.

Limits of this connection

These were multiple incidents, not one continuous breach. The settlement does not show that memory controls replace hotel infrastructure security or erase copies already stolen.