A Court Just Told Hotel Guests Their Browsing Data Isn't "Intercepted." Owners Should Not Celebrate.
Sojern beat a privacy lawsuit over tracking pixels on Hilton's website, and the legal reasoning basically says your marketing vendors have your implied consent to watch everything. If you're an owner who thinks this ruling protects you, wait until you see the three new lawsuits already filed against the same brand.
Let me tell you about the most dangerous kind of victory in the hotel business: the one that makes you think you're safe.
A federal judge in California just tossed a guest's lawsuit against Sojern, the travel marketing platform that embeds tracking technology on hotel websites to watch what guests browse, what rooms they price, what dates they search, and whether they complete a reservation. The guest alleged this was wiretapping. The court said no... the data wasn't "intercepted in transit" (a very specific legal distinction that matters enormously to lawyers and almost not at all to the guest who just found out a company she'd never heard of was watching her shop for a hotel room). The court also said the hotels themselves consented to the tracking as "parties to the communication," which made it legal under federal wiretap law. Case dismissed.
And I can already hear the sigh of relief from brand legal departments. I can hear the vendor sales teams preparing their "see, it's perfectly legal" talking points. I can practically see the PowerPoint slide. Here's the part they won't put on the slide: Hilton is currently facing at least three additional class action lawsuits alleging the exact same type of tracking behavior... two involving Meta's pixel, one broadly challenging third-party trackers with no consent banner. The plaintiff in THIS case voluntarily dropped Hilton from the suit, which means the brand hasn't actually been tested yet. And the legal theory is evolving. California's privacy laws aren't getting looser. They're getting tighter. This ruling is a speed bump, not a wall. (I've read enough FDDs to know the difference between a legal victory and a strategic one. This is neither.)
Here's what nobody in brand marketing wants to talk about: the guest doesn't care about the legal distinction between "intercepted in transit" and "collected at endpoint." The guest cares that she searched for a hotel room and then saw ads for that hotel following her across the internet for three weeks. That's the EXPERIENCE of being tracked, and no court ruling changes how it feels. I grew up watching my dad deliver brand promises to guests who didn't read the fine print... they just knew whether the stay felt right or felt wrong. A loyalty member discovering that a company called Sojern (a name she's never encountered, a relationship she never agreed to) has her search history, her travel dates, and her price sensitivity data? That doesn't feel right. And "but the court said it's legal" is not a brand strategy. It's a legal defense. Those are different documents.
The real tension here is between marketing performance and brand trust, and right now the entire industry is leaning hard into performance without asking what it costs on the trust side. Sojern serves over 13,000 customers. They're reportedly being acquired for $250 million. That's a quarter-billion-dollar business built on watching travelers browse hotel websites and turning that data into targeted advertising. The value proposition to the hotel is clear: better targeting, higher conversion, more direct bookings. The value proposition to the guest is... what, exactly? More relevant ads? Nobody has ever described a retargeted ad as "relevant." They describe it as "creepy." And creepy erodes the one thing a hospitality brand cannot buy back once it's gone. You know what I'm going to say. Trust. The thing your loyalty program is supposed to build. The thing your "member-exclusive rate" is supposed to reinforce. The thing a tracking pixel quietly undermines every time a guest realizes the hotel she browsed is now following her around the internet without ever asking permission.
If you're an owner with a branded property, this ruling doesn't protect you. It protects your vendor. Your brand agreement almost certainly gives the franchisor broad rights to deploy marketing technology on the brand website, including tracking pixels from third-party partners you've never vetted and whose data practices you've never reviewed. When the next lawsuit names the hotel (and it will... the newer suits are going directly at the brands, not just the vendors), the brand will point to the franchise agreement that says you agreed to this. And you did. Page 47, section 12(c), right between the loyalty assessment schedule and the PMS mandate. You signed it. You just didn't read it. (Don't feel bad. Almost nobody reads it. That's what the filing cabinet is for.)
Here's what I need every branded operator to do this week. Pull your franchise agreement and find the section on marketing technology, data collection, and third-party vendor authorization. Read it. Understand what you've consented to on behalf of your guests. Then call your brand rep and ask one question: "What third-party tracking is currently deployed on the brand website, and what guest data is being shared with vendors I haven't approved?" Write down exactly what they say. If they can't answer clearly, that's your answer. This is what I call the Invisible P&L... the costs that never show up on your financial statements but destroy value in ways you don't see until a lawsuit hits or a loyalty member walks. Data liability is real. Reputational damage is real. And "the court said it was legal" won't mean a thing to the guest who just canceled their loyalty account because they felt surveilled instead of served.