On June 3, 2025, the U.S. Court of Appeals for the Fourth Circuit issued a pivotal ruling in longstanding litigation against Marriott International, Inc., arising out of a 2018 data breach involving its Starwood Preferred Guest Program. In reversing the lower court’s grant of class certification, the Fourth Circuit determined that the customers’ contractual agreements with Marriott included enforceable class action waivers and that those waivers applied to bar all asserted claims. This decision represents the second time that the Court of Appeals has vacated the Maryland district court’s class certification order.
The lower court had re-certified a putative class of more than 100 million individuals, concluding that “by agreeing to multidistrict litigation in Maryland, Marriott engaged in conduct inconsistent with the class-action bar and thus implicitly waived reliance on that provision.” The Fourth Circuit disagreed, holding that “Marriott’s participation in consolidated pretrial proceedings is fully consistent with” the broad class action waiver in its consumer agreements. As the Court put it: “We can find no other court holding that a defendant’s participation in an MDL deprives it of the right to rely on a contractual class-waiver defense, and we will not be the first.”
Because the district court found that Marriott had lost its ability to enforce the broad class action waiver, the district court “hinted, almost as an aside, that the class-action waiver is invalid as unconscionable.” The Fourth Circuit soundly rejected that “hint”, stating unequivocally that “[i]f that is what the [district] court intended, it is mistaken.”
The Fourth Circuit then turned to the question of whether the waiver covered the putative class’s claims. The Court noted that although it would typically send that issue back to the district court to determine, “as we did in our first opinion, . . . on this second pass, we think it is appropriate to resolve the issue now” without bothering to remand. The Fourth Circuit ultimately held that the enforceable class-action waiver applied to all claims asserted by the putative class, including the extra-contractual tort and consumer protection statutory claims.
Tuesday’s decertification ruling underscores the utility of class action waiver provisions in consumer contracts. The inclusion of such a waiver can be an effective tool for companies looking to avoid class-wide litigation. As data breach litigation continues to proliferate, the Marriott II decision will likely have broader implications for how companies structure their consumer agreements and the enforceability of similar clauses in future data breach cases.
