What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-02-10 compared with 2025-02-11 · 91 added, 88 removed, 189 unchanged (49% of the section changed)

2 unchanged sentences

The events and consequences discussed in these risk factors could, in circumstances we may or may not be able to accurately predict, recognize, or control, have a material adverse effect on our business, liquidity, financial condition, and results of operations.

In addition, these risks could cause results to differ materially from those we express in forward-looking statements contained in this report or in other Company communications.

In addition, these risks could cause

results to differ materially from those we express in forward-looking statements contained in this report or in other Company communications.

These risk factors do not identify all risks that we face, and our business could also be affected by factors, events, or uncertainties that are not presently known to us or that we currently do not consider to present significant risks to our operations.

3 unchanged sentences

Our hotel brands and other lodging offerings generally compete with regional, national, and international chains that operate lodging properties or franchise their brands, lodging properties that are not affiliated with a chain, and online platforms that allow travelers to book short-term rentals of homes and apartments.

Our ability to remain competitive and attract and retain business, group and leisure travelers depends on our success in distinguishing and driving preference for our lodging products and services, including our Loyalty Program, direct channels, consumer-facing technology platforms and services, our co-branded credit cards, and other offerings.

Our ability to remain competitive and attract and retain business, group, and leisure travelers depends on our success in distinguishing and driving preference for our lodging products and services, including our Loyalty Program, direct digital channels, consumer-facing technology platforms and services, our co-branded credit cards, and other offerings.

If we cannot compete successfully in these areas, our business, liquidity, financial condition, and results of operations could be materially adversely affected.

Further, new lodging supply in individual markets could have a negative impact on the hotel industry and hamper our ability to maintain or increase room rates or occupancy in those markets.

Economic and other global, national, and regional conditions and events have in the past impacted, and could in the future impact, our business, financial results and growth .

Because we conduct our business on a global scale, we are affected by changes in global, national, or regional economies, governmental policies (including in areas such as trade, travel, immigration, labor, healthcare, and related issues), and geopolitical, public health, social and other conditions and events.

Economic and other global, national, and regional conditions and events have in the past materially impacted, and could in the future materially impact, our business, operations, financial results, and growth .

Because we conduct our business on a global scale, we are affected by changes and uncertainties in global, national, or regional economies, governmental policies (including in areas such as trade, travel, spending, immigration, labor, healthcare, and related issues), and geopolitical, public health, social and other conditions and events.

Our business, financial results, and growth are impacted by weak or volatile economic conditions;

1 unchanged sentence

natural and man-made disasters;

changes in energy prices, interest rates and currency values;

changes in energy prices, interest rates, inflation, and currency values;

political instability, geopolitical disputes or conflict, actual or threatened war, terrorist activity, civil unrest and other acts of violence;

1 unchanged sentence

and concerns over the foregoing.

These conditions and events have in the past materially negatively impacted, and could in the future materially negatively impact, our business, operations, and financial results in many ways, including, but not limited to, as follows:

These conditions and events have in the past materially negatively impacted, and could in the future materially negatively impact, our business, operations, financial results, and growth in many ways, including, but not limited to, as follows:

• reducing revenues at hotels in our system, impacting our fees and the ability of hotels to meet expenses, including payment of amounts owed to us;

3 unchanged sentences

• making it more difficult for hotel owners to obtain financing on commercially acceptable terms, or at all;

• causing hotel construction and opening delays;

• causing hotel construction, opening, and renovation delays;

• decreasing the rate at which new projects enter our pipeline;

7 unchanged sentences

Operational Risks

Premature termination of our agreements with hotel owners could hurt our financial performance .

Our agreements with hotel owners may be subject to premature termination in certain circumstances, such as the bankruptcy of a hotel owner, the failure of a hotel owner to comply with its payment or other obligations under the agreement, a failure under some agreements to meet specified financial or performance criteria which we do not cure, or in certain limited cases, other

negotiated contractual termination rights.

Premature termination of our agreements with hotel owners could materially hurt our financial performance .

Hotel owners may assert the right to terminate our agreements even where the agreements provide otherwise, and some courts have upheld such assertions about our agreements and may do so in the future.

When terminations occur for certain of these or other reasons, we may need to enforce our right to damages for breach of contract and related claims, which may cause us to incur significant legal fees and expenses.

We may have difficulty collecting damages from the hotel owner, and any damages we ultimately collect could be less than the projected future value of the fees and other amounts we would have otherwise collected under the agreement with the hotel owner.

A significant loss of these agreements could hurt our financial performance or our ability to grow our business.

Disagreements with hotel owners and other counterparties may result in arbitration or litigation or delay implementation of product or service initiatives .

Consistent with our focus on management, franchising, and licensing, we own very few of our lodging properties.

When terminations occur for certain of these or other reasons, we may seek to enforce our right to damages for breach of

contract and related claims, which may cause us to incur significant legal fees and expenses.

We have in the past had, and could in the future have, difficulty collecting damages from the hotel owner, and any damages we ultimately collect could be less than the projected future value of the fees and other amounts we would have otherwise collected under the agreement with the hotel owner.

A significant loss of these agreements could materially hurt our financial performance or our ability to grow our business.

Disagreements with hotel owners and other counterparties could materially impact our business, operations, financial results, and growth.

Consistent with our focus on franchising, management, and licensing, we own very few of our lodging properties.

The nature of our rights and responsibilities under our agreements with hotel owners and other counterparties may be subject to interpretation.

This has from time to time given rise to disagreements with such parties, and may give rise to such disagreements in the future, including over new product, service, or systems initiatives and their associated costs, the timing and amount of capital investments, and reimbursement for operating costs, system costs, or other amounts.

From time to time this gives rise to disagreements with such parties, including over new product, service, or systems initiatives and their associated costs, the timing and amount of capital investments, and reimbursement for operating costs, system costs, or other amounts.

We have seen, and may in the future see, an increase in such disagreements during periods when hotel returns are weaker.

We seek to resolve any disagreements and to develop and maintain positive relations with our hotel owners and other counterparties, but we cannot always do so.

Failure to resolve such disagreements has resulted in arbitration or litigation, and could do so in the future.

We could suffer significant losses, reduced profits, or constraints on our operations as the result of adverse dispute resolution outcomes.

An increase in the use of Internet travel intermediaries to book hotel reservations could adversely impact our business .

Some of our hotel rooms are booked through Internet travel intermediaries such as Expedia.com, Priceline.com, Booking.com, Travelocity.com, Orbitz.com, and Trip.com.

Failure to resolve such disagreements has resulted in arbitration or litigation.

We could suffer significant losses, reduced profits, or constraints on our operations or growth as the result of adverse dispute resolution outcomes.

Changes in the way hotel rooms are booked could adversely impact our business .

Some of our hotel rooms are booked through Internet travel intermediaries.

In addition to their focus on leisure travel, these intermediaries also provide offerings for corporate travel and group meetings.

Internet search engines may also divert business away from our channels to intermediaries.

Although our Best Rate Guarantee and Member Rate programs have helped limit guest preference shift to intermediaries and greatly reduced the ability of intermediaries to undercut the published rates at hotels in our system, intermediaries continue to use a variety of aggressive online marketing methods to attract guests, including the purchase by certain companies of trademarked online keywords such as “Marriott” from Internet search engines such as Google, Bing, Yahoo, and Baidu to steer guests toward their websites.

Our business and profitability could be harmed to the extent that guest booking preference shifts from our direct digital channels to Internet travel intermediaries, diverting bookings away from our direct digital channels and increasing the overall cost of bookings for hotels in our system.

Intermediaries continue to use a variety of aggressive online marketing methods to attract guests, including the purchase by certain companies of trademarked online keywords such as “Marriott” from Internet search engines.

Internet search engines may also divert business away from our direct digital channels to intermediaries.

Many intermediaries also operate their own loyalty programs designed to foster customer loyalty to their platforms, which could erode loyalty to our brands, offerings, and direct digital channels.

Bookings through these intermediaries are more costly to hotels in our system than bookings through our direct digital channels.

To the extent that guest booking preference shifts from our direct digital channels to Internet travel intermediaries, diverting bookings away from our direct digital channels and increasing the overall cost of bookings for hotels in our system, our business and profitability could be harmed.

In addition, the introduction of AI capabilities by existing and emerging travel intermediaries may change the way guests plan, book, and pay for travel, which may disrupt how our products and services are marketed and distributed, potentially eroding brand loyalty, increasing distribution costs, and negatively affecting our Loyalty Program, which could adversely impact our financial performance and our ability to grow our business.

At the same time, if we are not able to negotiate new agreements on satisfactory terms when our existing contracts with intermediaries (which generally have two- to three-year terms) come up for renewal, our business and prospects could be negatively impacted in a number of ways, including by reducing bookings or making our brands less attractive to hotel owners.

1 unchanged sentence

Adding properties to our system entails entering into and maintaining various arrangements with hotel owners.

Our ability to attract and retain hotel owners and the terms of our agreements with hotel owners are influenced by the needs and preferences of hotel owners and the offerings otherwise available to hotel owners in the market, among other things.

Our ability to attract and retain hotel owners and the terms of our agreements with hotel owners are influenced by the value, quality, and performance of our brands, the value and benefits of our Loyalty Program and other programs and services, our willingness to provide incentives to hotel owners to secure new agreements, the overall commercial terms of our agreements, and the relative value and benefits of offerings otherwise available to hotel owners in the market, among other things.

We cannot assure you that any of our current arrangements will continue or that we will be able to renew agreements or enter into new agreements in the future on terms that are as favorable to us as those that exist today.

6 unchanged sentences

intellectual property;

cybersecurity, data privacy, data localization, data transfers, and the handling of personally identifiable information;

cybersecurity, data privacy, data localization, data transfers, the handling of personally identifiable information, and AI and other emerging technologies;

the offer and sale of franchises;

competition and pricing;

climate and the environment;

health, safety, and accessibility;

liquor sales;

the offer and sale of franchises;

food and beverage sales;

gaming and other entertainment offerings;

and credit card products.

These laws, regulations, and government policies may be complex and change frequently and could have a range of adverse effects on our business.

These laws, regulations, and government policies may be complex and change frequently and may not be reconcilable across jurisdictions, and could have a range of adverse effects on our business.

The compliance programs, internal controls, and policies we maintain and enforce need to be updated regularly to keep pace with changing laws, regulations, and government policies, may not cover all applicable risk areas, and, as we have seen in the past, may not prevent us, our associates, service providers, or agents from materially violating applicable laws, regulations, and government policies.

The requirements of applicable laws, regulations, and government policies, our failure to meet such requirements (including investigations and publicity resulting from actual or alleged failures), or actions we take to comply with such requirements or investigations could have significant adverse effects on our results of operations, reputation, or ability to grow our business.

The requirements of applicable laws, regulations, and government policies, our failure to meet such requirements

(including investigations and publicity resulting from actual or alleged failures), or actions we take to comply with such requirements or investigations could have significant adverse effects on our results of operations, reputation, or ability to grow our business.

Third-party claims that we infringe the intellectual property rights of others or our failure to defend our own intellectual property rights could materially adversely affect our business .

1 unchanged sentence

We have been and are currently party to a number of such claims and may be subject to additional claims in the future.

Such claims have in the past, and could in the future:

Such claims, including pending claims, have in the past, and could in the future:

• be expensive and time consuming to defend;

14 unchanged sentences

Many factors can affect the reputation and value of our Company or one or more of our brands, hotels in our system, or other offerings, including adherence to service and other brand standards;

matters related to, or incidents involving, food quality and safety, guest and associate safety, health and cleanliness, sustainability and climate impact, supply chain management, inclusion and belonging, human rights, and support for local communities;

matters related to, or incidents involving, food quality and safety, guest and associate safety, health and cleanliness, sustainability, supply chain management, access to opportunity, human rights, and support for local communities;

actions perceived as relating to political or social matters;

and compliance with applicable laws.

3 unchanged sentences

Any material decline in the reputation or perceived quality of our brands or corporate image could affect our market share, reputation, business, financial condition, or results of operations.

Actions by our hotel owners or others could adversely affect our image and reputation .

Our hotel owners, service providers, and other third parties are subject to similar risks, which could also impact us.

Actions by our hotel owners or others could materially adversely affect our image and reputation .

We franchise and license many of our brand names and trademarks to third parties for lodging, timeshare, and residential properties, and with respect to our credit card programs and other offerings, and enter into marketing and other strategic collaborations with other companies.

1 unchanged sentence

These third parties sometimes fail to maintain or act in accordance with applicable brand standards;

experience operational problems, including data or privacy incidents, or circumstances involving guest or associate health or safety;

or project a brand image inconsistent with ours, each of which can cause our image and reputation to suffer.

Although our agreements with these parties generally provide us with recourse and remedies in the event of a breach, including termination of the agreements under certain circumstances, it could be expensive or time-consuming for us to pursue such remedies and even if we are successful in pursuing such remedies, that may not be sufficient to mitigate reputational harm to us.

experience financial or operational problems, including data or privacy incidents, or negative incidents related to matters described in the preceding risk factor;

or project a brand image inconsistent with ours, each of which could have a material negative impact on our image and reputation.

Although our agreements with these third parties generally provide us

with recourse and remedies in the event of a breach, including termination of the agreements under certain circumstances, certain actions by these third parties may not give rise to recourse or remedies, and for those that do, it could be expensive or time-consuming for us to pursue such remedies, and even if we are successful in pursuing such remedies, that may not be sufficient to mitigate reputational harm to us.

We also cannot assure you that in every instance a court would ultimately enforce our contractual termination rights or that we could collect any awarded damages from the defaulting party.

5 unchanged sentences

Labor disputes and disruptions sometimes result in adverse publicity or regulatory investigations and adversely affect operations and revenues at impacted hotels.

In addition, labor disputes and disruptions or increased demands from labor unions can sometimes harm associate relations, result in increased regulatory requirements or inquiries and enforcement by governmental authorities, harm relationships with guests and customers, divert management attention, and reduce customer demand, all of which could have a significant adverse effect on our reputation, business, financial condition, or results of operations.

In addition, labor disputes and disruptions or increased demands from labor unions can sometimes harm associate relations, result in increased regulatory requirements or inquiries and enforcement by governmental authorities, harm relationships with guests and hotel owners, divert management attention, and reduce guest demand, all of which could have a significant adverse effect on our reputation, business, financial condition, or results of operations.

In addition, labor regulation and the negotiation of new or existing collective bargaining agreements could, as we have seen in the past, lead to higher wage and benefit costs, changes in work rules that raise operating expenses and legal costs, and limitations on our ability or the ability of our hotel owners to take cost saving measures during economic downturns.

10 unchanged sentences

We have seen a decline in travel and reduced demand for lodging as a result of natural disasters and extreme weather in some markets and in areas of the world from which we draw guests, and the prevalence and impact of these events may increase or worsen in the future.

Natural disasters, extreme weather, and other climate impacts and events (including rising sea levels, extreme hot or cold weather, flooding, water shortages, fires, and droughts) have impacted, and continue to impact, hotels in our system, including by causing physical damage that prevents or limits the operations of the property or resulting in increases in insurance, energy or other operating costs.

Significant costs could be involved in improving the efficiency and climate resiliency of hotels in our system and otherwise preparing for, responding to, and mitigating climate or sustainability related impacts, events, or concerns.

Compliance with climate-related legislation and regulation, and our efforts to achieve science-based emissions reduction targets or other sustainability initiatives, have been and are expected to continue to be complex and costly.

Climate or other sustainability-related concerns may affect customers’ travel choices, including their frequency of travel.

Natural disasters, extreme weather, and other climate impacts and events (including rising sea levels, extreme hot or cold weather, hurricanes and typhoons, flooding, water shortages, fires, and droughts) have impacted, and continue to impact, hotels in our system, including by causing physical damage that prevents or limits the operations of the property or resulting in increases in insurance, energy or other operating costs.

Compliance with climate-related legislation and regulation, and our efforts related to our climate and sustainability initiatives, have been and are expected to continue to be complex and costly.

Climate or other sustainability-related concerns may affect guests’ travel choices, including their frequency of travel.

As a result of the foregoing, as we have seen in the past to some extent, we may experience reduced demand, increased costs, operating disruptions or limitations, and physical damage to hotels in our system, and we could experience constraints on our growth, all of which could adversely affect our profits and growth.

2 unchanged sentences

Market forces beyond our control may nonetheless limit the scope of the insurance coverage we or our hotel owners can obtain, or our or their ability to obtain coverage at reasonable rates.

Certain types of losses, generally of a catastrophic nature, such as earthquakes, fires, hurricanes

and floods, terrorist acts, pandemics, or liabilities that result from incidents involving the security of information systems, may result in high deductibles, low limits, or may be uninsurable, or the cost of obtaining insurance may be unacceptably high.

Certain types of losses, generally of a catastrophic nature, such as earthquakes, fires, hurricanes and floods, terrorist acts, pandemics, or liabilities that result from incidents involving the security of information systems, may result in high deductibles, low limits, or may be uninsurable, or the cost of obtaining insurance may be unacceptably high.

As a result, we and our hotel owners may not be successful in obtaining insurance without increases in cost or decreases in coverage levels, or may not be successful in obtaining insurance at all.

4 unchanged sentences

Our Loyalty Program is an important aspect of our business.

Our Loyalty Program faces significant competition from the loyalty programs offered by other hospitality companies, as well as from loyalty programs offered by bank travel programs, airlines, and others.

Our Loyalty Program faces significant competition from the loyalty programs offered by other hospitality companies, banks, airlines, and others.

There is significant competition among loyalty programs in terms of the value and utility of program currency, rewards ranges and values, other program terms and conditions, and other program features, including co-branded credit card affiliations and offerings.

If we are not able to maintain a competitive and attractive loyalty program or if we make changes to our Loyalty Program, including as a result of legal or regulatory requirements or considerations, we could experience significant adverse effects on our reputation, business, financial condition, or results of operations, including our ability to acquire, engage, and retain members in our Loyalty Program and our ability to operate other programs (including our co-branded credit card program).

In addition, to the extent that legislative or regulatory changes negatively impact credit card issuers or networks, we could also see material adverse effects on our business, financial condition, or results of operations, including reduced revenues from our co-branded credit card agreements and a range of adverse impacts to our Loyalty Program, such as reduced program funding.

Exchange rate fluctuations could result in significant foreign currency gains and losses and affect our business results .

17 unchanged sentences

Our ability to grow our system is subject to the range of risks associated with real estate investments .

Our ability to sustain continued growth through management, franchise, or license agreements with hotel owners is affected, and may potentially be limited, by a variety of factors influencing real estate development generally.

These include site availability, financing availability, planning, zoning and other local approvals, and other limitations that may be imposed by market and submarket factors, such as projected room occupancy and rate, changes in growth in demand compared to projected supply, territorial restrictions in our agreements with hotel owners, costs of construction, demand for and availability of construction resources, and other disruptive conditions in global, regional, or local markets.

Our ability to sustain continued growth through franchise, management, or license agreements with hotel owners is affected, and may potentially be limited, by a variety of factors influencing real estate development generally.

These include site availability, financing availability, planning, zoning and other local approvals, and other limitations that may be imposed by market and submarket factors, such as projected room occupancy and rate, changes in growth in demand compared to projected supply, territorial restrictions in our agreements with hotel owners, costs of construction, demand for and availability of construction labor, materials, and resources, and other disruptive conditions in global, regional, or local markets.

Our owned properties and other real estate investments subject us to numerous risks .

3 unchanged sentences

Moreover, the investment returns available from equity investments in real estate depend in large part on the amount of income earned and capital appreciation generated, if any, by the particular properties, and the expenses incurred.

A variety of other factors also affect income from properties and real estate values, including local market conditions and new supply of hotels and other lodging products, availability and costs of staffing, governmental regulations, insurance, zoning, tax and eminent domain laws,

interest rate levels, and the availability of financing.

A variety of other factors also affect income from properties and real estate values, including local market conditions and new supply of hotels and other lodging products, operating costs, governmental regulations, insurance, zoning, tax and eminent domain laws, interest rate levels, and the availability of financing.

Our real estate investments have been, and could in the future be, impacted by any of these factors, resulting in a material adverse impact on our results of operations or financial condition.

8 unchanged sentences

The eventual opening of such pipeline hotels and, in particular, the approved hotels that are not yet under contract, is subject to numerous risks, including the other risks described in this section.

We have seen construction timelines for pipeline hotels lengthen due to various factors, including challenges related to financing, and these circumstances could continue or worsen in the future.

We have seen construction timelines for pipeline hotels lengthen due to various factors, including challenges related to financing and the other risks described in this section, and these circumstances could continue or worsen in the future.

Accordingly, we cannot assure you that all of our development pipeline will result in additional hotels entering our system, or that those hotels will open when we anticipate.

2 unchanged sentences

We have suffered losses, and could suffer losses in the future, when hotel owners default on loans that we provide or when we are required to fund under guarantees and do not receive reimbursement from the hotel owner.

If hotel owners cannot repay or refinance mortgage loans secured by their properties, our revenues and profits could decrease and our business could be harmed .

If hotel owners cannot repay or refinance mortgage loans secured by their properties, default under property leases, or experience other financial difficulties, our revenues and profits could materially decrease and our business could be significantly harmed .

Many hotel owners have pledged their hotels as collateral for mortgage loans that they entered into when those properties were purchased or refinanced.

If those hotel owners cannot meet required debt service payments or repay or refinance maturing indebtedness on favorable terms or at all, the lenders could declare a default, accelerate the related debt, and foreclose on the property, or the hotel owners could declare bankruptcy, as we have seen in the past and could see in the future.

In some cases, such foreclosures or bankruptcies have in the past resulted, and could in the future result, in the termination of our management, franchise, or license agreements, eliminating our anticipated income and cash flows, which could have a significant negative effect on our results of operations.

In addition, some hotel owners have leased their property from a third-party landlord.

If hotel owners cannot make required lease payments or otherwise comply with lease terms, the landlord could declare a default and terminate the lease, as we have seen in the past and could see in the future.

In some cases, such foreclosures, bankruptcies, lease terminations, or other financial difficulties have in the past resulted, and could in the future result, in the termination of our franchise, management, or license agreements, eliminating our anticipated income and cash flows, which could have a significant negative effect on our results of operations or reputation.

Technology, Information Protection, and Privacy Risks

4 unchanged sentences

Disruptions in or changes to these systems, including during upgrades or replacements, could result in a disruption to our business and the loss of important data.

We are incorporating artificial intelligence (“AI”) technologies into certain of our processes, offerings, and services, and these technologies may become increasingly important in our operations over time.

The introduction of these technologies, particularly generative AI, into our processes, offerings, and services may also result in new or expanded risks and liabilities, including due to increased governmental or regulatory scrutiny, legal claims and assertions, compliance and ethical considerations, data security and privacy risks, and other factors that could adversely affect our business, reputation, financial condition, or results of operations.

We are incorporating AI and other emerging technologies into certain of our processes, offerings, and services, and these technologies may become increasingly important in our operations over time.

The introduction of these technologies, particularly generative AI, into our processes, offerings, and services may also result in new or expanded risks and liabilities, including due to increased government attention and rapidly-evolving regulatory frameworks governing such technologies, legal claims and assertions, compliance and ethical considerations, data security and privacy risks, and other factors that could adversely affect our business, reputation, financial condition, or results of operations.

In addition, it is possible that AI could be improperly utilized by associates while carrying out their responsibilities or lead to unintended consequences, including generating content that is factually inaccurate, misleading or otherwise flawed, or biased, or that results in other unintended harmful impacts, which could harm our reputation and business and expose us to risks related to inaccuracies or errors in the output of such technologies.

A failure to keep pace with developments in technology could impair our operations or competitive position .

The lodging industry continues to demand the use of sophisticated technology and systems, including those used for our reservation, customer relationship management, analytics, revenue management, property management, human resources and payroll systems, our Loyalty Program, and technologies we make available to our guests and for associates, and these and other technologies and systems must be refined, updated, and/or replaced with more advanced systems on a regular basis.

The lodging industry continues to demand the use of sophisticated technology and systems, including those used for our reservation, customer relationship management, finance, analytics, revenue management, property management, human resources and payroll systems, our Loyalty Program, and technologies we make available to our guests and for associates, and these and other technologies and systems must be refined, updated, and/or replaced with more advanced systems on a regular basis.

Our business could suffer if we cannot refine, update, and/or replace technologies and systems as quickly or effectively as our competitors, sufficiently in advance of obsolescence or performance failure or degradation, or within budgeted costs and time frames.

1 unchanged sentence

We are undertaking a multi-year transformation of our reservations, property management, and loyalty systems.

The development and deployment of our new systems could involve delays, system interruptions, compromises of data security, or other operational impacts, including impacts on our internal control environment.

Our business could also suffer if the use of technologies that provide alternatives to in-person meetings and events results in a decrease in demand for our lodging properties.

Additionally, if we fail to keep pace with rapidly-evolving technological developments in AI and other emerging technologies, our competitive position and business may suffer.

We are exposed to risks and costs associated with protecting the integrity and security of data .

In the operation of our business, we collect, store, use, and transmit large volumes of personal data regarding associates, guests, customers, hotel owners, service providers, other third parties, and our own business operations, including credit card numbers, reservation and loyalty data, and other personal data, in various information systems that we maintain and in systems maintained by third parties, including those of our hotel owners, service providers, and other third parties.

The integrity and protection of this personal data is critical to our business.

Our guests and associates also have a high expectation that we, as well as our hotel owners, service providers, and other third parties, will adequately protect and appropriately use their personal data.

The information, security, and privacy requirements imposed by global laws and governmental regulation, our contractual obligations, and the requirements of the payment card industry continue to become increasingly stringent in many jurisdictions in which we operate.

Our information systems and the information systems maintained or used by our hotel owners, service providers, and other third parties may not be able to satisfy these changing legal and regulatory requirements and associate and guest expectations;

The integrity and protection of this personal data are critical to our business.

Our guests and associates also have a high expectation that we, as well as our hotel owners, service providers, and other third parties with whom we or they do business, will adequately protect and appropriately use their personal data.

The information, security, and privacy requirements imposed by global laws and regulations, our contractual obligations, and the requirements of the payment card industry continue to become increasingly stringent in many jurisdictions in which we operate.

Our information systems and the information systems maintained or used by our hotel owners, service providers, and other third parties with whom we or they do business may not be able to satisfy these changing legal and regulatory requirements and associate and guest expectations;

we and/or these third parties may require significant additional investments or time to do so;

3 unchanged sentences

As a result of the data security incident involving unauthorized access to the Starwood Hotels & Resorts Worldwide, LLC, formerly known as Starwood Hotels & Resorts Worldwide, Inc.

(“Starwood”), reservations database that we disclosed in November 2018 (the “Data Security Incident”), numerous lawsuits were filed against us, as described further in Note 7, and we may be named as a party in additional lawsuits or receive other claims related to the Data Security Incident.

A number of federal, state, and foreign governmental authorities made inquiries, opened investigations, or requested information and/or documents related to the Data Security Incident, including under various data protection and privacy regulations.

Responding to and resolving these lawsuits, claims, and/or investigations has resulted in payments and other expenses, such as the payment to the AG Offices (as described below), and could result in material additional payments or remedial or other expenses.

In the 2024 fourth quarter, we reached final resolutions with the U.S.

(“Starwood”), reservations database that we disclosed in November 2018 (the “Data Security Incident”), numerous lawsuits and investigations were filed or initiated against us, as described further in Note 7, and we may become subject to additional actions related to the Data Security Incident.

Responding to and resolving these lawsuits, claims, and/or investigations has resulted in payments and other expenses, and could result in material additional payments or remedial or other expenses.

In 2024, we reached final resolutions with the U.S.

Federal Trade Commission (“FTC”) and the Attorney General offices from 49 U.S.

states and the District of Columbia (the “AG Offices”) in relation to the Data Security Incident.

Among other terms, the resolution with the AG Offices included a $52 million monetary payment.

The resolutions with the FTC and the AG Offices include various ongoing requirements relating to our data privacy and information security programs.

In the event of alleged or actual noncompliance with the resolutions with the FTC and AG Offices, we could face enforcement actions or contempt proceedings that could potentially result in fines, penalties, requirements to make additional changes to our data privacy and information security programs or business practices, or other adverse outcomes, which could have a material adverse effect on our financial condition and damage our reputation and brand.

Other governmental authorities investigating or seeking information about the Data Security Incident have imposed and may further impose undertakings, injunctive relief, consent decrees, or other penalties, which could, among other things, materially increase our costs or otherwise require us to alter how we operate our business and could damage our reputation and brand.

Significant management time and Company resources have been, and will continue to be, devoted to matters related to the Data Security Incident.

Insurance coverage designed to limit our exposure to losses such as those related to the Data Security Incident is costly and may not be sufficient or available to cover all of our expenses or other losses (including payments imposed by the AG Offices or other regulators and other payments, fines, or penalties) related to the Data Security Incident, and certain expenses by their nature (such as, for example, expenses related to enhancing our data privacy and information security programs) are not covered by our insurance program.

states and the District of Columbia (the “AG Offices”) in relation to the Data Security Incident, which include, among other terms, various long-term requirements relating to our data privacy and information security programs.

In the event of alleged or actual noncompliance with these resolutions, we could face enforcement actions or contempt proceedings that could potentially result in fines, penalties, requirements to make additional changes to our data privacy and information security programs or business practices, or other adverse outcomes, which could have a material adverse effect on our financial condition and damage our reputation and brand.

resulting from legal proceedings or investigations) related to the Data Security Incident, and certain expenses by their nature (such as, for example, expenses related to enhancing our data privacy and information security programs) are not covered by our insurance program.

Additional cybersecurity incidents could have adverse effects on our business.

We have enhanced our security measures to safeguard our information systems and data, and we intend to continue implementing additional measures in the future, but, as we have seen in the past, our measures may not be sufficient to maintain the confidentiality, security, or availability of the data we collect, store, and use to operate our business.

Security measures implemented by our hotel owners, service providers, and other third parties or their service providers also may not be sufficient, as we have seen in the past.

Efforts to hack or circumvent security measures, efforts to gain unauthorized access to, exploit or disrupt the operation or integrity of our data or information systems, failures of information systems or software to operate as designed or intended, viruses, “ransomware” or other malware, “supply chain” attacks, “phishing” or other types of business communications compromises, operator error, or inadvertent releases of data have impacted, and may in the future impact, our information systems and records or those of our hotel owners, service providers, or other third parties.

Security measures implemented by our hotel owners, service providers, and other third parties with whom we or they do business also may not be sufficient, as we have seen in the past.

Security measures, no matter how well designed or implemented, may only mitigate and not fully eliminate risks, and security events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

Our reliance on computer, Internet-based, and mobile systems and communications, and the frequency and sophistication of efforts by third parties to gain unauthorized access or prevent authorized access to such systems, have greatly increased in recent years.

Our increased reliance on cloud-based services and on remote access to information systems and our use of AI technologies increases the Company’s exposure to potential cybersecurity incidents.

We and our hotel owners, service providers, and other third parties have experienced cyberattacks, attempts to disrupt access to systems and data, and attempts to affect the operation or integrity of data or systems, and the frequency and sophistication of such efforts could continue to increase.

Our increased reliance on cloud-based services and on remote access to information systems and our use of AI and other emerging technologies increases the Company’s exposure to potential cybersecurity incidents.

We and our hotel owners, service providers, and other third parties with whom we or they do business have experienced cyberattacks, attempts to disrupt access to systems and data, and attempts to affect the operation or integrity of data or systems, and the frequency and sophistication of such efforts could continue to increase.

Any additional significant theft of, unauthorized access to, compromise or loss of, loss of access to, or fraudulent use of guest, associate, hotel owner, service provider, Company, or other data as a result of a cybersecurity incident could adversely impact our reputation and could result in legal, regulatory, and other consequences, including remedial and other expenses, fines, or litigation.

Depending on the nature and scope of the event, future compromises in the security of our information systems or those of our hotel owners, service providers, or other third parties, or other future disruptions or compromises of data or information systems, could lead to future interruptions in, or other adverse effects on, the operation of our systems or those of our hotel owners, service providers, or other third parties.

Depending on the nature and scope of the event, future compromises in the security of our information systems or those of our hotel owners, service providers, or other third parties with whom we or they do business, or other future disruptions or compromises of data or information systems, could lead to future interruptions in, or other adverse effects on, the operation of our systems or those of our hotel owners, service providers, or other third parties with whom we or they do business.

This could result in operational interruptions and/or outages and a loss of profits, as well as negative publicity and other adverse effects on our business, including lost sales, loss of consumer confidence, boycotts, reduced enrollment and/or participation in our Loyalty Program, litigation, regulatory investigations or actions, diminished associate satisfaction, and/or retention and recruiting difficulties, all of which could materially affect our market share, reputation, business, financial condition, or results of operations.

Because we have experienced cybersecurity incidents in the past, additional cybersecurity incidents or the failure to detect and appropriately respond to additional cybersecurity incidents could magnify the severity of the adverse effects on our business.

The techniques used to obtain unauthorized access, disable or degrade service, or sabotage information systems change frequently (including the integration of new technology such as AI), can be difficult to detect for long periods of time, and can involve difficult or prolonged assessment or remediation periods even once detected, which could also magnify the severity of these adverse effects.

The techniques used to obtain unauthorized access, disable or degrade service, or sabotage information systems change frequently (including the integration of AI and other emerging technologies), can be difficult to detect for long periods of time, and can involve difficult or prolonged assessment or remediation periods even once detected, which could also magnify the severity of these adverse effects.

We cannot assure you that all potential causes of past significant cybersecurity incidents have been identified and remediated;

5 unchanged sentences

We are subject to numerous, complex, and frequently changing laws, regulations, and contractual obligations designed to protect personal information.

federal and state laws, data privacy, security, and localization laws outside of the U.S., payment card industry security standards, and other information privacy and security standards are all applicable to us.

federal and state laws, non-U.S.

laws, payment card industry security standards, and other information privacy and security standards are all applicable to us.

Significant legislative, judicial, or regulatory changes have been and could be issued in the future.

Compliance with changes in applicable data security and privacy laws and regulations and contractual obligations (including our resolutions with the FTC and AG Offices), including the need to respond to investigations into our compliance, has increased and is expected to in the future increase our costs, and may restrict our business operations, increase our exposure to payment obligations and litigation in the event of alleged noncompliance, and adversely affect our reputation.

Changes in laws could adversely affect our ability to market our products effectively .

We rely on a variety of direct marketing techniques, including email marketing, online advertising (including through social media), and postal mailings.

Any further legal restrictions under various U.S.

federal, state, or international laws, or new international, federal, or state laws on marketing and solicitation or international privacy, e-privacy, and anti-spam laws that govern these activities could adversely affect the continuing effectiveness of email, online advertising (including through social media), and postal mailing techniques and could require changes in our marketing strategy.

If this occurs, we may not be able to develop adequate alternative marketing strategies, which could impact the amount and timing of our sales of certain products.

We also obtain access to

potential guests and customers from travel service providers or other companies with whom we have substantial relationships, and we market to some individuals on these lists directly or by including our marketing message in the other companies’ marketing materials.

If access to these lists were to be prohibited or otherwise restricted, our ability to develop new guests and customers and introduce them to our products could be impaired.

Compliance with changes in applicable data security and privacy laws and regulations and contractual obligations (including resolutions with regulators), including the need to respond to investigations into our compliance, has increased and is expected to in the future increase our costs, and may restrict our business operations, increase our exposure to payment obligations and litigation in the event of alleged noncompliance, and adversely affect our reputation.

Compliance with evolving regulatory frameworks governing AI and other emerging technologies may affect our use of such technologies and our ability to incorporate such technologies into our processes, offerings, and services, and may result in increased costs and exposure to legal proceedings or investigations in the event of

alleged noncompliance.

In addition, uncertainty around cross-border data transfers, including from the U.S., may require us to restrict certain data transfers, cease doing business with certain third parties, or change how data flows throughout our business, any of which could materially impact our operations.

General Risk Factors

Delaware law and our governing corporate documents contain, and our Board of Directors could implement, anti-takeover provisions that could deter takeover attempts.

Under the Delaware business combination statute, a stockholder holding 15 percent or more of our outstanding voting stock could not acquire us without Board of Directors’ consent for at least three years after the date the stockholder first held 15 percent or more of the voting stock.

Under the Delaware business combination statute, a stockholder holding 15 percent or more of our outstanding voting stock could not acquire us without our Board of Directors’ consent for at least three years after the date the stockholder first held 15 percent or more of the voting stock.

Our governing corporate documents also, among other things, require supermajority votes for mergers and similar transactions.

5 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors