To help identify trends in privacy representations, BCLP surveyed the websites and privacy notices of the hotel and lodging industry. The survey included hotel operators that are part of the Fortune 500, or that are the top 10 providers of hotel rooms in the United States.
The data shows that there is no one strategy for disclosing privacy practices to consumers, or for complying with federal and state laws – including the CCPA – that govern data privacy. The following summarizes current industry trends.
- Privacy notices are, on average, a little older than a month old.
- Privacy notices of hotels are, on average, longer than privacy notices of Fortune 500 companies.
- While most hotels are disclosing their collection of personal information by “enumerated category,” only half are disclosing their sharing of information with service providers by enumerated category. A minority are disclosing their selling practices by enumerated category.
- Unlike most Fortune 500 companies, hotels prefer to disclose their enumerated categories in lists as opposed to charts or tables.
- Hotels are, as an industry, more likely to "sell" personal information than companies in most other industries.
- 18.75% of hotels are silent or unclear about their selling practices.
- Hotel websites are almost evenly split on whether they include a “Do Not Sell My Personal Information” link.
- Hotel websites deployed, on average, the second greatest number of behavioral advertising cookies of any industry. The average hotel homepage sets 21 advertising cookies.
- Although a majority of hotels are not displaying a cookie notice in the United States, hotels are more likely than the rest of the Fortune 500 to deploy cookie notices.
- Approximately 20% of hotels are attempting to deploy a cookie notice that seeks opt-in consent from website visitors before the deployment of advertising cookies.
[View source.]
