2026 Hotel Privacy Readiness Report

I conducted an independent public-facing review of privacy for 50 California hotels. What I discovered is that hotel privacy readiness is uneven and that having a privacy policy and having a clear process for handling privacy are two different things. Most hotels look good on the surface. They have a privacy notice and, many times, California rights language; however, how they handle privacy requests is unclear. Here is a summary of the results:

• 37 of 50 hotels (74%) had no public Global Privacy Control (GPC) disclosure located—the language explaining browser-based privacy preferences.
• 24 of 50 hotel entries (48%) had no public sale/sharing opt-out route was located in the reviewed sources; 5 additional entries (10%) were partial or unclear.
• 7 of 50 hotels (14%) had no clear public route for access, correction, or deletion requests; 6 additional hotels (12%) were partial or unclear.

Methodology: I reviewed privacy notices, cookie disclosures, and consumer rights for 50 California hotels. Each item was scored as present, partial, unclear, or not located. This review is based on what's available to the public and is not a legal opinion, penetration test, or assessment of the hotel's internal standard operating practice. The review was conducted on September 22, 2026, using a selected, nonrandom sample of 50 California hotel and resort entries. The findings describe this sample and should not be interpreted as representative of all California hotels.

Depending on the situation, a guest, employee, applicant, or website visitor may need a clear way to request access, or to correct personal information, or to opt out of a certain sale or data sharing. They may need to understand what vendors process or sell their information, and how it is handled.

Of course, I don't have insight into standard operating procedures at these hotels, nor am I making any legal conclusions. I have worked in hotels for 25 years and suspect most don't have SOPs on how to handle these requests. If I ask who is responsible for privacy administration, I typically get a boilerplate answer that it falls within the Finance department. To go deeper, I would need to test hotels and ask the front desk to see what answers I get.

Many independent hotels or smaller management companies do not have a dedicated privacy function, or the bandwidth to create one. The question is whether those public policies and privacy notices you see on independent or smaller management company hotel websites are supported by a documented process. A request to know, delete, correct, or opt out should include the front desk, marketing, finance, IT, HR, management company, and several vendors. In most hotels, it isn’t that the people at the hotel do not care. The reality is that the SOP for this process may have been assigned to a particular department in the hotel, but the procedure itself has not been documented, assigned across functions, and tested.

In my experience, what ends up happening is that Finance (individual hotel Director of Finance or corporate office) takes the lead in terms of organizing the data. They start the process of trying to map out how the data flows through different vendors. Depending on the hotel and the management company, the number of vendors can vary from a handful to an exhaustive list that can be a maze to figure out. Some vendors are owned by the corporate office and some by the individual hotels. Responsibility depends on the contracts, the parties’ roles, and how the information is collected and used. Oftentimes, PMS data is housed on one central server to keep the data uniform and managed by the corporate office.

A workable hotel privacy program needs four things: a privacy owner, an intake and escalation process; a map of systems, vendors, and data ownership; and a documented procedure for handling guest, employee, applicant, and browser-based requests. A second phase of this research could test intake readiness by asking how hotels route a privacy request at the property level.

The privacy notice opens the door. The real test is whether the hotel knows what to do after someone walks through it.

About the author

Chris Suarez is a hotel general manager with 25 years of hospitality experience and the founder of HotelComply, a platform that helps hotels organize privacy documentation and request workflows.