Hotels are not allowed to give out your personal information to anyone who asks. Front desk staff are trained to refuse to confirm even whether you’re a guest, and your room gets the same constitutional privacy protection as your home. The exceptions are narrow: a proper legal demand from law enforcement, a genuine emergency, and the business uses you agreed to when you booked or joined a loyalty program.
What a Hotel Actually Has on You
From check-in forward, the hotel builds a file. Your full name, home address, phone number, email, credit card, room number, and dates of stay all sit in the system. Many properties also scan a government-issued photo ID. If you’re in the loyalty program, the chain also has your booking history, room preferences, and spending patterns across every property you’ve stayed at.
Most major chains publish a privacy policy explaining what they collect and how they use it. That policy is a contract of sorts. If a hotel promises to safeguard your data and then hands it out or fails to protect it, the promise itself becomes the basis for legal liability.
Someone Asking at the Desk or Calling Your Room
If a stranger walks up to the front desk and asks whether you’re staying there, a well-trained clerk will neither confirm nor deny it. Staff have no way to know who’s really asking or why. The person could be a friend, a process server, an abusive ex, or a stalker, and the hotel’s duty runs to you rather than to the person at the counter.
The same goes for phone calls. Staff will not give out your room number or your in-room extension. They’ll take a message or connect the call directly to your room without revealing the number. If you want a specific person to be able to find you, tell them your room number yourself, or leave written instructions at the desk authorizing the hotel to share it with that person.
When Police Ask for Your Information
Your hotel room gets Fourth Amendment protection. In Stoner v. California, the Supreme Court held that the guest’s constitutional right against unreasonable search belongs to the guest, not the hotel. A night clerk letting officers into your room does not count as valid consent. Only you can waive that right, or someone you’ve actually authorized to act for you.1Library of Congress. Stoner v. California, 376 U.S. 483 (1964)
Guest records get similar protection. In City of Los Angeles v. Patel, the Supreme Court struck down a Los Angeles ordinance that let officers demand to inspect hotel guest registries on the spot with no judicial oversight. The Court held that a hotel must have the chance to challenge the demand in front of a neutral decision-maker before being forced to hand records over. Police can still get access when the hotel voluntarily consents, when they have a proper warrant, or when another recognized warrant exception applies.2Justia Law. Los Angeles v. Patel, 576 U.S. 409 (2015)
In practice, officers who want your records use one of two tools. A subpoena orders the hotel to produce documents such as registration records or billing information, usually with enough lead time for the hotel to consult a lawyer. A search warrant, signed by a judge on probable cause, authorizes an immediate search or seizure. Staff are trained to check that any demand is legitimate and properly issued before turning anything over. Handing information to police based on an informal request, with no warrant or subpoena, can itself expose the hotel to civil liability for violating your privacy.
Emergencies Where Police Don’t Need a Warrant
There’s one significant exception that matters in hotel settings. Under what courts call “exigent circumstances,” officers can act without a warrant in genuinely urgent situations. The Supreme Court has recognized several: rendering emergency aid to someone in danger, pursuing a fleeing suspect, and preventing the imminent destruction of evidence.3Constitution Annotated. Exigent Circumstances and Warrants
There’s no checklist that automatically applies. Courts look at the totality of the circumstances. An officer who enters your room without a warrant to help someone inside must have had an objectively reasonable basis for believing that help was needed right then. The Patel opinion itself acknowledged that hotel situations involving human trafficking or child exploitation can be as exigent as almost anything courts see.2Justia Law. Los Angeles v. Patel, 576 U.S. 409 (2015)
National Security Letters
In rare terrorism or counterintelligence investigations, the FBI can issue a National Security Letter compelling a communications service provider to hand over subscriber and transactional records. These letters come with a built-in gag order barring the recipient from disclosing that the FBI asked. The statute is aimed at wire and electronic communication service providers rather than hotels directly, but a hotel that runs its own communication systems could fall within reach.
Sharing You Actually Agreed To
Most of the information-sharing that happens in the background is sharing you consented to, usually without reading the fine print. Loyalty programs are the clearest example. When you sign up, you agree to let the chain track stays, preferences, and spending across all its properties and use that data to personalize service and target offers.
Hotels may also share your data with third-party marketing partners, but only if you opted in. If you didn’t check that box, the hotel shouldn’t be selling your information to outside companies. When your employer books and pays for the room, the hotel may share limited details such as confirmation of the stay and a copy of the bill for reimbursement. That doesn’t give your employer access to your personal profile or to charges outside the bill they’re paying.
State law adds another layer. California’s Consumer Privacy Act gives residents the right to know what personal data a hotel has, request access to it, demand its deletion, and opt out of having it sold. Hotels doing significant business in California must comply regardless of where they’re based, and several other states have passed similar laws.
How Your Credit Card Data Is Supposed to Be Handled
Credit card information has its own rulebook: the Payment Card Industry Data Security Standard, or PCI DSS. Hotels are prohibited from storing sensitive authentication data after a transaction is authorized. Full magnetic stripe data, the three- or four-digit security code, and your PIN can never be kept on file.4PCI Security Standards Council. PCI Data Storage Do’s and Don’ts
Hotels can retain your card number, expiration date, and cardholder name, but the card number has to be rendered unreadable wherever it’s stored, whether on a server, in backups, or in transaction logs. Acceptable methods include encryption, truncation to the last four digits, or one-way hashing. On screen, no more than the first six and last four digits should be visible. These requirements tightened under PCI DSS version 4.0, which became fully mandatory in March 2025.4PCI Security Standards Council. PCI Data Storage Do’s and Don’ts
If a Hotel Shares Something It Shouldn’t
When a hotel improperly discloses your information, you have options. The most common civil claim is invasion of privacy, covering intrusions into private affairs that a reasonable person would find highly offensive. Breach of contract is a related claim, based on the hotel violating its own published privacy policy or the implied agreement to keep guest information confidential. Negligence is available when the hotel failed to take reasonable steps to protect your data and that failure caused you harm.
The Federal Trade Commission also enforces against hotels that promise to protect data and don’t. The FTC brought a case along those lines against Marriott and its Starwood subsidiary after breaches exposed the personal information of hundreds of millions of guests, resulting in an order that required Marriott to build a full information security program, use multi-factor authentication, run annual risk assessments, and submit to independent security audits for the next 20 years. The order also required Marriott to give U.S. consumers a way to request deletion of their personal information.5Federal Trade Commission. Marriott International Inc. and Starwood Hotels – Final Decision and Order
Every state, plus the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands, requires notification when a breach exposes personal data. There’s no single federal breach-notification law, so how quickly you must be told and what the notice must contain depend on where you live. If you get one of those notices, treat it seriously: freeze your credit, monitor your accounts, and change any passwords you may have reused with the hotel’s loyalty program.
If you believe a hotel disclosed your information improperly, document it specifically: what was shared, with whom, when, and what harm followed. That record is what you’ll need whether you file a complaint with your state attorney general, report the incident to the FTC, or take the matter to an attorney.