As hospitality businesses increasingly rely on digital tools, automation, biometrics, and AI‑enabled services, their collection and use of personal data has expanded significantly. With that expansion comes a corresponding rise in legal and regulatory obligations – and risks.

Below are key takeaways from a webinar I presented today with Carolyn D. Richmond on how privacy and AI requirements apply in the hospitality environment, and where organizations should focus their compliance efforts.

Personal Data Is Broader Than You Think

“Personal data” now encompasses far more than traditional personnel or guest records. It includes:

• Digital productivity and workplace surveillance data
• Biometric identifiers used for access control, timekeeping, drive‑through, or kiosks
• Information collected through websites, mobile apps, and chatbots

Understanding what data you collect, how, and why is the foundation of compliance across all modern privacy frameworks.

Multiple Laws May Apply – Often Simultaneously

Comprehensive state privacy laws now exist in 21 states, with Oklahoma becoming the 21st after enacting SB 546, effective January 1, 2027.
In addition:

• All 50 states enforce consumer protection statutes (and the Federal Trade Commission (FTC) actively enforces at the federal level).
• Emerging AI laws impose requirements on data sourcing, disclosures, assessments, and automated decision‑making.

Data processed by hospitality organizations could be implicated by by all of these frameworks.

You May Be Responsible for Vendor and Franchisor Practices

Hospitality operations frequently rely on franchisor‑provided systems or third‑party vendors for POS, reservation platforms, loyalty solutions, HR tools, and marketing technology.
However, the data controller remains responsible for legal compliance – including when vendors or franchisors dictate the technology used.

Organizations should ensure their compliance rather than relying on that of their vendors, while, at the same time, maintaining robust vendor management processes, contract review, and oversight.

If You Don’t Need It, Don’t Collect or Keep It

Data minimization and retention limitation requirements appear in state privacy laws, and the FTC has consistently enforced them under its unfair and deceptive practices authority. These failures are frequently uncovered during data breach investigations, but may also surface through complaints or routine reviews.

A defensible retention schedule and actual enforcement of that schedule – is critical.

Websites and Mobile Apps Remain High‑Risk Areas

Regulators and plaintiffs’ attorneys are paying closer attention to:

• Tracking technologies
• Pixel and cookie‑based data transfers
• Session replay tools
• Information captured through web forms

Claims increasingly include wiretapping laws such as California Invasion of Privacy Act (Cal. Penal Code § 630 et seq.) (“CIPA”) and Electronic Communications Privacy Act of 1986 (“ECPA”), particularly where third‑party technology providers receive consumer interaction data.

Chatbots Can Create Liability

Chatbots may create compliance exposure when they:

• Capture and transmit data in ways that qualify as “wiretapping”
• Fail to disclose that the user is interacting with an automated system
• Provide inaccurate, misleading, or incomplete information, creating potential unfair or deceptive acts and practices risks

Deploying chatbots requires clear disclosures, monitoring, and often a risk assessment.

Biometrics Require Special Handling

Biometric data is widely used in hospitality, including for:

• Employee time clocks
• Drive‑through or kiosk voice recognition
• Facial recognition for loyalty or VIP programs

Many state privacy laws treat biometrics as sensitive data, requiring explicit consent, risk assessments, and heightened security. Some states also have standalone biometric statutes that require disclosure, a retention schedule and a written authorization.

Privacy Notices Must Reflect Reality

Regulators in the U.S. and EU are increasingly focusing on accuracy and completeness in privacy notices. Your notice should:

• Accurately describe actual practices
• Be written in a way that is understandable to your typical guest or customer
• Cover both guest‑facing and employee‑facing data practices

Vague, or incomplete notices or ones that do not accurately reflect the practice are recurring enforcement themes.

AI Can Create Independent Compliance Obligations

AI‑related laws may regulate:

• The data used to train or operate the system
• Disclosures regarding AI use
• Risk assessments for certain types of processing
• Rights related to automated decision‑making

Before labeling a process as “AI,” organizations should confirm whether their use actually meets the statutory definition: and then apply all associated obligations.

Children’s Data Protection Is Expanding

Protection of minors’ data now extends well beyond COPPA’s “under 13” threshold. State privacy laws increasingly regulate data of teens up to 18, and “app store” statutes impose obligations on mobile app providers that may reach hospitality‑related applications.

Data Incidents Are a “When,” Not an “If”

Given the reliance on cloud platforms, interconnected Points of Sale (POS) systems, mobile keys, franchise technology, and third‑party providers, data incidents in hospitality can be especially disruptive. A realistic and practiced incident response plan significantly reduces exposure, legal risk, and operational downtime.