MAR, §1A diff (2021 → 2022)

Risks Relating to COVID-19

COVID-19 has had a material detrimental impact on our business and financial results, and such impact could continue and may worsen for an unknown period of time.

COVID-19 has been and continues to be a complex and evolving situation, with governments, public institutions and other organizations imposing or recommending, and businesses and individuals implementing, at various times and to varying degrees, restrictions on various activities or other actions to combat its spread, such as warnings, restrictions and bans on travel, transportation or in-person gatherings; closures of, or occupancy or other operating limitations on, work facilities, lodging facilities, food and beverage establishments, schools, public buildings and businesses; cancellation of events, including sporting events, conferences and meetings; and quarantines and lock-downs. COVID-19 has dramatically reduced travel and demand for hotel rooms, and has negatively impacted, in some cases is continuing to negatively impact and may in the future negatively impact, our business, operations, and financial results, including, but not limited to, as follows:

•reducing revenues at our managed and franchised hotels, owned and leased hotels, and properties in which we have an investment;

•impacting the ability of our managed and franchised hotels, owned and leased hotels, and properties in which we have an investment to meet expenses, including payment of amounts owed to us;

•causing a significant number of hotels to exit our system;

•adversely affecting our ability to attract and retain associates.

The extent to which COVID-19 impacts our business, operations, and financial results will depend on the factors described above and numerous other evolving factors that we may not be able to accurately predict or assess, including the continued duration and scope of COVID-19; the availability, effectiveness and acceptance of vaccines and treatments; COVID-19’s impact on global and regional economies and economic activity, unemployment rates and consumer discretionary spending; COVID-19’s short and longer-term impact on the demand for travel, including business transient and group business, and levels of consumer confidence; and the extent to which the recovery of travel and lodging demand is disrupted by new COVID-19 variants or other dislocations in pandemic recovery. COVID-19, and the volatile regional and global economic conditions stemming from COVID-19, as well as additional or unforeseen effects from the COVID-19 pandemic or future pandemics, could also give rise to, aggravate, and impact our ability to allocate resources to mitigate the other risks that we identify below, which in turn could materially adversely affect our business, liquidity, financial condition, and results of operations. Further, COVID-19 may also affect our operating and financial results in a manner that is not presently known to us or that we currently do not consider to present significant risks to our operations.

Our industry is highly competitive, which may impact our ability to compete successfully for guests. We operate in markets that contain many competitors. Each of our hotel brands and our home rental offering competes with major hotel chains, regional hotel chains, independent hotels, and home sharing and rental services across national and international venues. Our ability to remain competitive and attract and retain business and leisure travelers depends on our success in distinguishing the quality and value of, and driving preference for, our lodging products and services, including our Loyalty Program, direct booking channels, consumer-facing technology platforms and services, and other offerings (including our co-branded credit cards), from those offered by others. If we cannot compete successfully in these areas, our operating margins could contract, our market share could decrease, and our earnings could decline. Further, new lodging supply in individual markets could have a negative impact on the hotel industry and hamper our ability to maintain or increase room rates or occupancy in those markets.

Economic downturns and other global, national, and regional conditions could further impact our financial results and growth. Because we conduct our business on a global platform, changes in global, national, or regional economies, governmental policies (including in areas such as trade, travel, immigration, healthcare, and related issues), and geopolitical and social conditions impact our activities. Our business is impacted by decreases in travel resulting from weak economic conditions, changes in energy prices and currency values, technologies that provide alternatives to in-person meetings and events, political instability, geopolitical conflict, heightened travel security measures, travel advisories, disruptions in air travel, and concerns over disease, violence, war, or terrorism.

As discussed in “Risks Relating to COVID-19,” our performance has been materially affected by some of these conditions and could be further materially affected if these conditions worsen, arise in the future, or extend longer than anticipated, or in other circumstances that we are not able to predict or mitigate. Even after COVID-19 subsides, our business, markets, growth prospects, and business model could continue to be materially impacted or altered.

Premature termination of our management or franchise agreements could hurt our financial performance. Our hotel management and franchise agreements may be subject to premature termination in certain circumstances, such as the bankruptcy of a hotel owner or franchisee, the failure of the hotel owner or franchisee to comply with its payment or other obligations under the agreement, a failure under some agreements to meet specified financial or performance criteria which we do not cure, or in certain limited cases, other negotiated contractual termination rights. Some courts have also applied agency law principles and related fiduciary standards to managers of third-party hotel properties, including us (or have interpreted hotel management agreements to be “personal services contracts”). Property owners may assert the right to terminate management agreements even where the agreements provide otherwise, and some courts have upheld such assertions about our management agreements and may do so in the future. When terminations occur for certain of these or other reasons, we may need to enforce our right to damages for breach of contract and related claims, which may cause us to incur significant legal fees and expenses. We may have difficulty collecting damages from the hotel owner or franchisee, and any damages we ultimately collect could be less than the projected future value of the fees and other amounts we would have otherwise collected under the management or franchise agreement. A significant loss of these agreements could hurt our financial performance or our ability to grow our business.

Disagreements with owners of hotels that we manage or franchise may result in arbitration or litigation or delay implementation of product or service initiatives. Consistent with our focus on management and franchising, we own very few of our lodging properties. The nature of our responsibilities under our management agreements to manage each hotel and enforce the standards required for our brands under both management and franchise agreements may be subject to interpretation and will, from time to time, give rise to disagreements, which may include disagreements over the need for or payment for new product, service or systems initiatives, the timing and amount of capital investments, and reimbursement for operating costs, system costs, or other amounts. In the months following the onset of the COVID-19 pandemic, we saw an increase in such disagreements, and an increase in disagreements may become more likely again in the future during other periods when hotel returns are weaker. We seek to resolve any disagreements and to develop and maintain positive relations with current and potential hotel owners, franchisees, and real estate investment partners, but we cannot always do so. Failure to resolve such disagreements has resulted in arbitration or litigation, and could do so in the future. If any such dispute resolution process results in an adverse outcome, we could suffer significant losses, our profits could be reduced, or our future ability to operate our business could be constrained.

An increase in the use of third-party Internet services to book online hotel reservations could adversely impact our business. Some of our hotel rooms are booked through Internet travel intermediaries such as Expedia.com, Priceline.com,

Booking.com, Travelocity.com, and Orbitz.com, as well as lesser-known online travel service providers. These intermediaries initially focused on leisure travel, but now also provide offerings for corporate travel and group meetings. Although our Best Rate Guarantee and Member Rate programs have helped limit guest preference shift to intermediaries and greatly reduced the ability of intermediaries to undercut the published rates at our hotels, intermediaries continue to use a variety of aggressive online marketing methods to attract guests, including the purchase by certain companies of trademarked online keywords such as “Marriott” from Internet search engines such as Google, Bing, Yahoo, and Baidu to steer guests toward their websites. Our business and profitability could be harmed to the extent that online intermediaries succeed in significantly shifting loyalties from our lodging brands to their travel services, diverting bookings away from our direct online channels, or through their fees, increasing the overall cost of Internet bookings for our hotels. In addition, if we are not able to negotiate new agreements on satisfactory terms when our existing contracts with intermediaries (which generally have 2- to 3- year terms) come up for renewal, our business and prospects could be negatively impacted in a number of ways. For example, if newly negotiated agreements are on terms less favorable to our hotels than the expiring agreements, or if we are not able to negotiate new agreements and our hotels no longer appear on intermediary websites, our bookings could decline, our profits (and the operating profits of hotels in our system) could decline, and customers and owners may be less attracted to our brands. We may not be able to recapture or offset any such loss of business through actions we take to enhance our direct marketing and reservation channels or to rely on other channels or other intermediary websites.

Our growth strategy depends upon attracting third-party owners and franchisees to our platform, and future arrangements with these third parties may be less favorable to us, depending on the terms offered by our competitors. Our growth strategy for adding lodging facilities entails entering into and maintaining various arrangements with property owners. The terms of our management agreements and franchise agreements for each of our lodging facilities are influenced by contract terms offered by our competitors, among other things. We cannot assure you that any of our current arrangements will continue or that we will be able to renew agreements or enter into new agreements in the future on terms that are as favorable to us as those that exist today.

Our failure to comply with applicable laws and regulations may increase our costs, reduce our profits, or limit our growth. We and the hotels that we franchise or manage are subject to a variety of laws and regulations around the globe, including, among others, laws related to employment practices; marketing and advertising efforts; trade and economic sanctions; anti-bribery and anti-corruption; cybersecurity, data privacy, data localization and the handling of personally identifiable information; competition; the environment; health and safety; liquor sales; and the offer and sale of franchises. The compliance programs, internal controls, and policies we maintain and enforce to promote compliance with laws and regulations may not prevent our associates, contractors, or agents from materially violating these laws and regulations. The failure to meet the requirements of applicable laws or regulations, or publicity resulting from actual or alleged failures, could have a significant adverse effect on our results of operations or reputation.

The significance of our operations outside of the U.S. makes us susceptible to the risks of doing business internationally, which could lower our revenues, increase our costs, reduce our profits, disrupt our business, or damage our reputation. A significant number of rooms in our system are located outside of the U.S. and its territories, which exposes us to certain challenges and risks, many of which are outside of our control, and which could materially reduce our revenues or profits, materially increase our costs, result in significant liabilities or sanctions, significantly disrupt our business, or significantly damage our reputation. These challenges and risks include: (1) compliance with complex and changing laws, regulations, and government policies, including sanctions, that could have a material negative impact on our operations or our ability to pursue development opportunities, cause reputational damage, or otherwise affect us; (2) the difficulties involved in managing an organization doing business in many different countries; (3) uncertainties regarding the interpretation of local laws and the enforceability of contract and intellectual property rights under local laws; and (4) rapid changes in government policy, political or civil unrest, acts of terrorism, war, pandemics or other health emergencies, border control measures or other travel restrictions, or the threat of international boycotts or U.S. anti-boycott legislation.

Exchange rate fluctuations and foreign exchange hedging arrangements could result in significant foreign currency gains and losses and affect our business results. We earn revenues and incur expenses in foreign currencies as part of our operations outside of the U.S. Accordingly, fluctuations in currency exchange rates may significantly increase the amount of U.S. dollars required for foreign currency expenses or significantly decrease the U.S. dollars we receive from foreign currency revenues. We are also exposed to currency translation risk because the results of our non-U.S. business are generally reported in local currency, which we then translate to U.S. dollars for inclusion in our Financial Statements. As a result, exchange rate changes between foreign currencies and the U.S. dollar affect the amounts we record for our foreign assets, liabilities, revenues and expenses, and could have a negative effect on our financial results. To the extent that our international operations continue to grow, our exposure to foreign currency exchange rate fluctuations will grow. We enter into foreign exchange hedging agreements with financial institutions to mitigate exposure to some of the foreign currency fluctuations, but these efforts may not be successful. These hedging agreements also do not cover all currencies in which we do business, do not eliminate foreign

13

currency risk entirely for the currencies that they do cover, and involve costs and risks of their own in the form of transaction costs, credit requirements, and counterparty risk.

Our business depends on the quality and reputation of our Company and our brands, and any deterioration could adversely impact our market share, reputation, business, financial condition, or results of operations. Many factors can affect the reputation and value of our Company or one or more of our properties or brands, including our ability to protect and use our brands and trademarks; our hotels’ adherence to service and other brand standards; our approach to, or incidents involving, matters related to food quality and safety, guest and associate safety, health and cleanliness, managing and reducing our carbon footprint and our use of scarce natural resources, supply chain management, and diversity, human rights, and support for local communities; and our compliance with applicable laws. Reputational value is also based on perceptions, and broad access to social media makes it easy for anyone to provide public feedback that can influence perceptions of us, our brands, and our hotels, and it may be difficult to control or effectively manage negative publicity, regardless of whether it is accurate. While reputations may take decades to build, negative incidents can quickly erode trust and confidence, particularly if they result in adverse mainstream and social media publicity, governmental investigations, proceedings or penalties, or litigation. Negative incidents could lead to tangible adverse effects on our business, including lost sales, boycotts, reduced enrollment and/or participation in our Loyalty Program, loss of development opportunities, adverse government attention, or associate retention and recruiting difficulties. Any material decline in the reputation or perceived quality of our brands or corporate image could affect our market share, reputation, business, financial condition, or results of operations.

Actions by our franchisees and licensees or others could adversely affect our image and reputation. We franchise and license many of our brand names and trademarks to third parties for lodging, timeshare, and residential properties, and with respect to our credit card programs. Under the terms of their agreements with us, these third parties interact directly with guests and others under our brand and trade names. If these third parties fail to maintain or act in accordance with applicable brand standards; experience operational problems, including any data or privacy incident, or a circumstance involving guest or associate health or safety; or project a brand image inconsistent with ours, then our image and reputation could suffer. Although our agreements with these parties provide us with recourse and remedies in the event of a breach, including termination of the agreements under certain circumstances, it could be expensive or time-consuming for us to pursue such remedies and even if we are successful in pursuing such remedies, that may not be sufficient to mitigate reputational harm to us. We also cannot assure you that in every instance a court would ultimately enforce our contractual termination rights or that we could collect any awarded damages from the defaulting party.

Collective bargaining activity and strikes could disrupt our operations, increase our labor costs, and interfere with the ability of our management to focus on executing our business strategies. A significant number of associates at our managed, leased, and owned hotels are covered by collective bargaining agreements. If relationships with our organized associates or the unions that represent them become adverse, then the properties we operate could experience labor disruptions such as strikes, lockouts, boycotts, and public demonstrations. Numerous collective bargaining agreements are typically subject to negotiation each year, and our ability in the past to resolve such negotiations does not mean that we will be able to resolve future negotiations without strikes, disruptions, or on terms that we consider reasonable. Labor disputes and disruptions have in the past, and could in the future, result in adverse publicity or regulatory investigations and adversely affect operations and revenues at affected hotels. In addition, labor disputes and disruptions or increased demands from labor unions could harm our relationship with our associates, result in increased regulatory requirements or inquiries and enforcement by governmental authorities, harm our relationships with our guests and customers, divert management attention, and reduce customer demand for our services, all of which could have an adverse effect on our reputation, business, financial condition, or results of operations.

Our business could suffer if we cannot attract and retain associates or as the result of the loss of the services of our senior executives. We compete with other companies both within and outside of our industry for personnel. We have experienced challenges hiring for certain positions due to various factors, such as increasing wage expectations and competition for labor from other industries, and these circumstances could continue or worsen in the future to an extent and for durations that we are not able to predict. If we cannot recruit, train, develop, and retain sufficient numbers of associates, we could experience significant negative impacts on our operations, associate morale and turnover, guest satisfaction, or our internal control environment. Insufficient numbers of associates could also limit our ability to grow and expand our businesses. Labor

14

shortages have resulted and could continue to result in higher wages and initial hiring costs, increasing our labor costs and labor costs at our hotels, which could reduce our revenues and profits. In addition, the efforts and abilities of our senior executives are important elements of maintaining our competitive position and driving future growth, and the loss of the services of one or more of our senior executives could result in challenges executing our business strategies or other adverse effects on our business. The impact of COVID-19 on the hospitality industry, and actions that we and others in the hospitality industry have taken and may take in the future with respect to our associates and executives in response to COVID-19, have adversely affected and may in the future continue to adversely affect our ability to attract and retain associates and executives.

Risks relating to natural or man-made disasters, contagious diseases, violence, or war have reduced the demand for lodging, which has adversely affected our revenues. We have seen a decline in travel and reduced demand for lodging due to so-called “Acts of God,” such as severe storms, hurricanes, earthquakes, tsunamis, floods, volcanic activity, wildfires, and other natural disasters, as well as man-made disasters and the spread of contagious diseases in locations where we own, manage, or franchise properties and areas of the world from which we draw a large number of guests, and these circumstances could continue or worsen in the future to an extent and for durations that we are not able to predict. Actual or threatened war, terrorist activity, political unrest, civil or geopolitical strife, and other acts of violence could have a similar effect. As with the effects we have already experienced from the COVID-19 pandemic, any one or more of these events may reduce the overall demand for lodging, limit the room rates that can be charged, affect our growth, and/or increase our operating costs, all of which could adversely affect our profits. If a terrorist event or other incident of violence were to involve one or more of our branded properties, demand for our properties in particular could suffer disproportionately, which could further hurt our revenues and profits.

Climate change and sustainability related concerns could have a material adverse effect on our business and results of operations. We are subject to the risks associated with the physical effects of climate change (including changes in sea levels, water shortages, droughts, and the natural disasters discussed in the preceding paragraph) and with changes in laws and regulations related to climate change and sustainability. Compliance with future climate-related legislation and regulation, and our efforts to achieve science-based emissions reduction targets, could be difficult and costly. Consumer travel preferences may also shift due to sustainability related concerns or costs. As a result of the foregoing, we may experience significant increased operating and compliance costs, operating disruptions or limitations, reduced demand, constraints on our growth, and physical damage to our hotels, all of which could adversely affect our profits.

Insurance may not cover damage to, or losses involving, properties that we own, manage, or franchise, or other aspects of our business, and the cost of such insurance could increase. We require comprehensive property and liability insurance policies for our managed, leased, and owned properties with coverage features and insured limits that we believe are customary. We also require our franchisees to maintain similar levels of insurance. Market forces beyond our control may nonetheless limit the scope of the insurance coverage we, our hotel owners, or our franchisees can obtain, or our or their ability to obtain coverage at reasonable rates. Certain types of losses, generally of a catastrophic nature, such as earthquakes, hurricanes and floods, terrorist acts, pandemics, or liabilities that result from incidents involving the security of information systems, may result in high deductibles, low limits, or may be uninsurable, or the cost of obtaining insurance may be unacceptably high. As a result, we, our hotel owners, and our franchisees may not be successful in obtaining insurance without increases in cost or decreases in coverage levels, or may not be successful in obtaining insurance at all. For example, over the past several years following the severe and widespread damage caused by natural disasters, coupled with continued large global losses, the property, liability and other insurance markets have seen significant cost increases. Also, due to the data security incident involving unauthorized access to the Starwood reservations database, which we initially reported in November 2018 (the “Data Security Incident”), and the state of the cyber insurance market generally, the costs for our cyber insurance increased with each of our renewals over the last several years, and the cost of such insurance could continue to increase for future policy periods. Further, in the event of a substantial loss, the insurance coverage we, our hotel owners, or our franchisees carry may not be sufficient to pay the full market value or replacement cost of any lost investment or in some cases could result in certain losses being totally uninsured. As a result, our revenues and profits could be adversely affected, and for properties we own or lease, we could lose some or all of the capital that we have invested in the property and we could remain obligated for guarantees, debt, or other financial obligations.

If our brands, goodwill, or other intangible assets become impaired, we may be required to record significant non-cash charges to earnings. As of December 31, 2021, we had $18.0 billion of goodwill and other intangible assets. We review goodwill and indefinite-lived intangible assets for impairment annually or whenever events or circumstances indicate impairment may have occurred. Estimated fair values of our brands or reporting units could change if, for example, there are changes in the business climate, unanticipated changes in the competitive environment, adverse legal or regulatory actions or developments, changes in guests’ perception and the reputation of our brands, or changes in interest rates, operating cash flows, or market capitalization. Because of the significance of our goodwill and other intangible assets, any future impairment of these assets could require material non-cash charges to our results of operations, which could have a material adverse effect on our reported financial condition and results of operations.

15

Our renovation activities expose us to project cost, completion, and resale risks. We occasionally acquire and renovate hotel properties, both directly and through partnerships and other business structures with third parties. This presents a number of risks, including that: (1) weakness in the capital markets may limit our ability, or that of third parties with whom we partner, to raise capital for completion of projects; (2) properties that we renovate could become less attractive due to decreases in demand for hotel properties, market absorption or oversupply, with the result that we may not be able to sell such properties for a profit or at the prices or time we anticipate, or we may be required to record additional impairment charges; and (3) construction delays or cost overruns, including those due to general market conditions, shortages or increased costs of skilled labor and/or materials, lender financial defaults, or so-called “Acts of God” such as earthquakes, hurricanes, floods, or fires may increase project costs. We could face similar risks to the extent we undertake development activities again in the future.

Our owned properties and other real estate investments subject us to numerous risks. We have a number of owned and leased properties, which are subject to the risks that generally relate to investments in real property. We may seek to sell some of these properties over time; however, equity real estate investments can be difficult to sell quickly and COVID-19 has disrupted the transaction markets for some hospitality assets. We may not be able to complete asset sales at prices we find acceptable, or at all. Moreover, the investment returns available from equity investments in real estate depend in large part on the amount of income earned and capital appreciation generated, if any, by the related properties, and the expenses incurred. A variety of other factors also affect income from properties and real estate values, including local market conditions and new supply of hotels, availability and costs of staffing, governmental regulations, insurance, zoning, tax and eminent domain laws, interest rate levels, and the availability of financing. Our real estate properties have been, and could in the future be, impacted by any of these factors, resulting in a material adverse impact on our results of operations or financial condition. If our properties continue to not generate revenue sufficient to meet operating expenses, including needed capital expenditures, our income could be further adversely affected, and we could be required to record additional significant non-cash impairment charges to our results of operations.

More hotel projects in our development pipeline may be cancelled or delayed in opening, which could adversely affect our growth prospects. We report a significant number of hotels in our development pipeline, including hotels under construction, hotels subject to signed contracts, and hotels approved for development but not yet under contract. The eventual opening of such pipeline hotels and, in particular, the approved hotels that are not yet under contract, is subject to numerous risks, including the risks described above in the risk factors entitled “Our ability to grow our management and franchise systems

16

is subject to the range of risks associated with real estate investments” and “COVID-19 has had a material detrimental impact on our business and financial results, and such impact could continue and may worsen for an unknown period of time.” We have seen construction timelines for pipeline hotels lengthen due to various factors, including competition for skilled construction labor, challenges related to financing, disruption in the supply chain for materials, and the impact of COVID-19 generally, and these circumstances could continue or worsen in the future. Accordingly, we cannot assure you that all of our development pipeline will result in new hotels entering our system, or that those hotels will open when we anticipate.

Losses on loans or loan guarantees that we have made to third parties impact our profits. At times, we make loans for hotel development, acquisition or renovation expenditures when we enter into or amend management or franchise agreements. From time to time we also provide third-party lenders with financial guarantees for the timely repayment of all or a portion of debt related to hotels that we manage or franchise, generally subject to an obligation that the owner reimburse us for any fundings. We have suffered losses, and could suffer losses in the future, when hotel owners or franchisees default on loans that we provide or fail to reimburse us for loan guarantees that we have funded.

If owners of hotels that we manage or franchise cannot repay or refinance mortgage loans secured by their properties, our revenues and profits could decrease and our business could be harmed. The owners of many of our managed or franchised properties have pledged their hotels as collateral for mortgage loans that they entered into when those properties were purchased or refinanced. If those owners cannot repay or refinance maturing indebtedness on favorable terms or at all, the lenders could declare a default, accelerate the related debt, and foreclose on the property, or the owners could declare bankruptcy, as we have seen in the past and could see in the future. Such foreclosures or bankruptcies have in the past and could in the future, in some cases, result in the termination of our management or franchise agreements and eliminate our anticipated income and cash flows, which could have a significant negative effect on our results of operations.

Changes affecting the availability of the London Interbank Offered Rate (“LIBOR”) may have consequences that we cannot yet fully predict. We are a party to various agreements, such as our multicurrency revolving credit agreement (as amended, the “Credit Facility”), and other instruments where obligations by or to us are calculated based on or otherwise dependent on LIBOR, many of which have not yet replaced LIBOR with an alternative benchmark rate. Effective January 1, 2022, the one week and two month USD LIBOR tenors and all tenors for EUR, CHF, JPY and GBP LIBOR are no longer being published, and all other USD LIBOR tenors will cease to be published after June 30, 2023. At this time, it is difficult for us to predict the full effect of any changes from LIBOR to an alternative benchmark rate upon or prior to the final LIBOR cessation date, the phase out of LIBOR generally, or the establishment and use of particular alternative benchmark rates to replace LIBOR. There continues to be uncertainty about how we, the financial markets, applicable law, and the courts will address the replacement of LIBOR with alternative benchmark rates for contracts that do not include fallback provisions to provide for such alternative benchmark rates. In addition, any changes from LIBOR to an alternative benchmark rate may have an uncertain impact on our cost of funds, our receipts or payments under agreements that reference LIBOR, and the valuation of derivative or other contracts to which we are a party, any of which could impact our results of operations and cash flows.

Any disruption in the functioning of our reservation systems could adversely affect our performance and results. We manage global reservation systems or use third-party service providers’ reservation systems that communicate reservations to our properties from individuals who book reservations directly with us online, through our mobile apps, through our telephone call centers, or through intermediaries like travel agents, Internet travel websites, and other distribution channels. The cost, speed, accuracy, and efficiency of our reservation systems are critical aspects of our business and are important considerations for hotel owners when choosing our brands. Our business may suffer if we fail to maintain, upgrade, or prevent disruption to our reservation systems. Disruptions in or changes to our reservation systems could result in a disruption to our business and the loss of important data.

A failure to keep pace with developments in technology could impair our operations or competitive position. The lodging industry continues to demand the use of sophisticated technology and systems, including those used for our reservation, revenue management, property management, human resources and payroll systems, our Loyalty Program, and technologies we make available to our guests and for our associates. These technologies and systems must be refined, updated, and/or replaced with more advanced systems on a regular basis, and our business could suffer if we cannot do that as quickly or effectively as our competitors or within budgeted costs and time frames. We also may not achieve the benefits that we anticipate from any new technology or system, and a failure to do so could result in higher than anticipated costs or lower guest satisfaction or could impair our operating results.

We are exposed to risks and costs associated with protecting the integrity and security of Company, associate, and guest data. In the operation of our business, we collect, store, use, and transmit large volumes of data regarding associates, guests, customers, owners, licensees, franchisees, and our own business operations, including credit card numbers, reservation

17

and loyalty data, and other personal information, in various information systems that we maintain and in systems maintained by third parties, including our owners, franchisees, licensees, and service providers. The integrity and protection of this data is critical to our business. Our guests and associates also have a high expectation that we, as well as our owners, franchisees, licensees, and service providers, will adequately protect and appropriately use their personal information. The information, security, and privacy requirements imposed by global laws and governmental regulation, our contractual obligations, and the requirements of the payment card industry continue to become increasingly stringent in many jurisdictions in which we operate. Our systems and the systems maintained or used by our owners, franchisees, licensees, and service providers may not be able to satisfy these changing legal and regulatory requirements and associate and guest expectations, or may require significant additional investments or time to do so. We have incurred and may in the future incur significant additional costs to meet these requirements, obligations, and expectations, and in the event of alleged or actual noncompliance, we may experience increased operating costs, increased exposure to fines and litigation, and increased risk of damage to our reputation and brand.

The Data Security Incident, and other information security incidents, could have numerous adverse effects on our business. As a result of the Data Security Incident, numerous lawsuits were filed against us, as described further in Note 7. We may be named as a party in additional lawsuits and other claims may be asserted by or on behalf of guests, customers, hotel owners, stockholders, or others seeking monetary damages or other relief related to the Data Security Incident. A number of federal, state, and foreign governmental authorities have also made inquiries, opened investigations, or requested information and/or documents related to the Data Security Incident, including under various data protection and privacy regulations. Responding to and resolving these lawsuits, claims, and/or investigations has resulted in fines and other expenses, such as the £18.4 million fine imposed by the Information Commissioner’s Office in the United Kingdom (the “ICO”) in connection with the ICO’s final decision issued in October 2020, and could result in material additional fines or remedial or other expenses. Other governmental authorities investigating or seeking information about the Data Security Incident may impose undertakings, injunctive relief, consent decrees, or other civil or criminal penalties, which could, among other things, materially increase our costs or otherwise require us to alter how we operate our business. Significant management time and Company resources have been, and will continue to be, devoted to the Data Security Incident. Future publicity or developments related to the Data Security Incident, including as a result of subsequent reports or regulatory actions or developments, could have a range of other adverse effects on our business or prospects, including causing or contributing to loss of consumer confidence, reduced consumer demand, reduced enrollment and/or participation in our Loyalty Program, and associate retention and recruiting difficulties. Insurance coverage designed to limit our exposure to losses such as those related to the Data Security Incident may not be sufficient or available to cover all of our expenses or other losses (including the final fine imposed by the ICO and any other fines or penalties) related to the Data Security Incident, and certain expenses by their nature (such as, for example, expenses related to enhancing our cybersecurity program) are not covered by our insurance program. In addition, following our March 31, 2020 announcement of an incident involving information for approximately 5.5 million guests that we believe may have been improperly accessed through an application using the login credentials of two franchise employees at a franchise property (the “Unauthorized Application Access Incident”), various governmental authorities opened investigations or requested information about the incident, and two lawsuits were filed against us related to the incident which have since been dismissed or otherwise resolved. The Unauthorized Application Access Incident or publicity related to it could negatively affect our business or reputation.

Additional cybersecurity incidents could have adverse effects on our business. We have implemented enhanced security measures to safeguard our systems and data, and we intend to continue implementing additional measures in the future, but, as we have seen in the past, our measures may not be sufficient to maintain the confidentiality, security, or availability of the data we collect, store, and use to operate our business. Measures taken by our service providers or our owners, franchisees, licensees, other business partners or their service providers also, as we have seen in the past, may not be sufficient. Efforts to hack or circumvent security measures, efforts to gain unauthorized access to, exploit or disrupt the operation or integrity of our data or systems, failures of systems or software to operate as designed or intended, viruses, “ransomware” or other malware, “supply chain” attacks, “phishing” or other types of business communications compromises, operator error, or inadvertent releases of data have impacted, and may in the future impact, our information systems and records or those of our owners, franchisees, licensees, other business partners, or service providers. Our reliance on computer, Internet-based, and mobile systems and communications, and the frequency and sophistication of efforts by third parties to gain unauthorized access or prevent authorized access to such systems, have greatly increased in recent years. Our increased reliance on cloud-based services and on remote access to information systems in response to COVID-19 increases the Company’s exposure to potential cybersecurity incidents. We have experienced cyberattacks, attempts to disrupt access to our systems and data, and attempts to affect the operation or integrity of our data or systems, and the frequency and sophistication of such efforts could continue to increase. Any additional significant theft of, unauthorized access to, compromise or loss of, loss of access to, or fraudulent use of guest, associate, owner, franchisee, licensee, or Company data could adversely impact our reputation and could result in legal, regulatory and other consequences, including remedial and other expenses, fines, or litigation. Depending on the nature and scope of the event, future compromises in the security of our information systems or those of our owners, franchisees, licensees, other business partners, or service providers or other future disruptions or compromises of data or systems could lead

18

to future interruptions in or other adverse effects on the operation of our systems or those of our owners, franchisees, licensees, other business partners, or service providers, resulting in operational inefficiencies and a loss of profits, and could result in negative publicity and other adverse effects on our business, including lost sales, loss of consumer confidence, boycotts, reduced enrollment and/or participation in our Loyalty Program, litigation, or associate satisfaction, retention and recruiting difficulties, all of which could materially affect our market share, reputation, business, financial condition, or results of operations.

Because we have experienced cybersecurity incidents in the past, additional incidents or the failure to detect and appropriately respond to additional incidents could magnify the severity of the adverse effects on our business. The techniques used to obtain unauthorized access, disable or degrade service, or sabotage information systems change frequently, can be difficult to detect for long periods of time, and can involve difficult or prolonged assessment or remediation periods even once detected, which could also magnify the severity of these adverse effects. We cannot assure you that all potential causes of past significant incidents have been identified and remediated; additional measures may be needed to prevent significant incidents in the future. The steps we take may not be sufficient to prevent future significant incidents and as a result, such incidents may occur again. Although we carry cyber insurance that is designed to protect us against certain losses related to cyber risks, that insurance coverage may not be sufficient or available to cover all expenses or other losses (including fines) or all types of claims that may arise in connection with cyberattacks, security compromises, and other related incidents. Furthermore, in the future such insurance may not be available on commercially reasonable terms, or at all.

Changes in privacy and data security laws could increase our operating costs and increase our exposure to fines and litigation. We are subject to numerous, complex, and frequently changing laws, regulations, and contractual obligations designed to protect personal information. Non-U.S. data privacy and data security laws, various U.S. federal and state laws, payment card industry security standards, and other information privacy and security standards are all applicable to us. Significant legislative, judicial, or regulatory changes have been and could be issued in the future. Compliance with changes in applicable data security and privacy laws and regulations and contractual obligations, including responding to investigations into our compliance, has increased and may in the future increase our operating costs, and may restrict our business operations, increase our exposure to fines and litigation in the event of alleged noncompliance, and adversely affect our reputation. Following the Data Security Incident, certain regulators also opened investigations into our privacy and security policies and practices. As a result of these investigations, we could be exposed to significant fines and remediation costs in addition to those imposed as a result of the Data Security Incident, and adverse publicity related to the investigations could adversely affect our reputation.

Changes in laws could adversely affect our ability to market our products effectively. We rely on a variety of direct marketing techniques, including email marketing, online advertising, and postal mailings. Any further restrictions in laws such as the proposed ePrivacy Regulation (EU) and the proposed Bill C-11 for the Digital Charter Implementation Act 2020 (Canada), various U.S. state laws, or new federal or state laws on marketing and solicitation or international privacy, e-privacy, and anti-spam laws that govern these activities could adversely affect the continuing effectiveness of email, online advertising, and postal mailing techniques and could force further changes in our marketing strategy. If this occurs, we may not be able to develop adequate alternative marketing strategies, which could impact the amount and timing of our sales of certain products. We also obtain access to potential guests and customers from travel service providers or other companies with whom we have substantial relationships, and we market to some individuals on these lists directly or by including our marketing message in the other companies’ marketing materials. If access to these lists were to be prohibited or otherwise restricted, our ability to develop new guests and customers and introduce them to our products could be impaired.

Delaware law and our governing corporate documents contain, and our Board of Directors could implement, anti-takeover provisions that could deter takeover attempts. Under the Delaware business combination statute, a stockholder holding 15 percent or more of our outstanding voting stock could not acquire us without Board of Directors’ consent for at least three years after the date the stockholder first held 15 percent or more of the voting stock. Our governing corporate documents also, among other things, require supermajority votes for mergers and similar transactions. In addition, our Board of Directors could, without stockholder approval, implement other anti-takeover defenses, such as a stockholder rights plan.