Is Marriott safe to use?

Marriott integrates 36 third-party SDKs spanning analytics, media, and attribution. Its App Store privacy label declares cross-app tracking via Search History and Identifiers. It collects data linked to your identity including Purchases, Contact Info, User Content, and Search History and 2 more categories. It includes 1 advertising or attribution SDK. Whether this is acceptable depends on your personal privacy preferences.

What permissions does Marriott need?

Marriott requests 12 iOS permissions: App Tracking Transparency, Camera, Microphone, Contacts, Photo Library, Location (When In Use), Location (Always), Calendars, Speech Recognition, Face ID, Bluetooth, and Bluetooth Peripheral.

What data does Marriott collect?

According to its App Store privacy label, Marriott declares cross-app tracking via Search History and Identifiers. It collects data linked to your identity including Purchases, Contact Info, User Content, Search History, Identifiers, and Usage Data. It collects Financial Info, Location, and Diagnostics not linked to your identity.

How many SDKs does Marriott have?

Marriott integrates 36 third-party SDKs. 1 for attribution, 8 for analytics, 1 for crash reporting, 1 for infrastructure, and 24 for other.

Does Marriott use App Tracking Transparency?

Yes. Marriott requests the App Tracking Transparency permission, which means it asks for your consent to track your activity across other companies' apps and websites.

Does Marriott access your location?

Yes. Marriott requests location access. The developer states: "We’ll use your location to find nearby hotels, locate airport shuttles, show accurate maps and provide directions.".

Does Marriott access your camera or microphone?

Marriott requests access to both your camera and microphone. The developer says camera access is for "We'll use your camera to scan your card". Microphone access is for "Marriott Bonvoy does not need the microphone, but websites you visit might". These permissions are only active when you grant them in iOS Settings.

Does Marriott access your contacts?

Yes. Marriott requests access to your contacts. The developer states: "Add contacts to your Calendar invitation.".

Does Marriott run in the background?

Yes. Marriott registers 3 background modes, which means it can perform certain tasks when you're not actively using it.

What are some alternatives to Marriott?

Other travel apps include Air Canada , Aeroméxico , Air France , Airalo , Airbnb , and Priority Pass+ . Each app takes a different approach to travel and varies in its data collection and SDK usage.

Travel · Privacy report

Marriott Bonvoy: Book Hotels

Free · ★4.9 · Marriott International

Is Marriott safe?

It leans heavily on third-party trackers.

Our take. Marriott is built with more third-party tracking code than 76% of the travel we have scanned.

Privacy footprint · vs 103 travelHeavy

Trackers from other companies9 · a lot

typical travel: 5

Data the app links to you6 types · some

typical travel: 5 · from its own privacy label

What it collects about you

Marriott links 6 categories of your data to you.

From the developer's own App Store privacy label. These are the kinds of data Marriott ties to your identity, and it also declares it shares data to track you across other apps.

PurchasesContact InfoUser ContentSearch HistoryIdentifiersUsage Data

Who else is inside

It carries trackers from 3 companies.

Third-party SDKs found in the app, matched to the company that publishes each. Present in the code; we do not observe what they transmit.

🏢Other third partiesanalytics

A third-party SDK.

SDKs

🇺🇸BranchAttribution

Deep linking and marketing attribution.

SDK

🏢Analytics SDKAnalytics

A product analytics platform.

SDK

How it compares

Where it sits among travel.

Every one of these apps we have scanned, on the two measures above: third-party trackers it carries (across) and data it links to you on its own label (up). Toward the top right is more invasive.

Each dot is one travel app. Marriott sits to the right, carrying more third-party tracking than most.

Other signals

One more flag.

Each is a fact read straight from the app. The same checks run on every app we scan. Only the ones that apply here are shown.

It declares cross-app tracking

Its own App Store label says it tracks you across other companies apps and websites using your advertising identifier.

The evidence

What it's built from.

All 36 SDKs in the app, grouped by what they are for. 9 are third-party trackers.

1attribution

8analytics

1crash reporting

26standard libraries

9 of the 36 are third-party trackers. The rest are the app's own code and standard open-source building blocks.

Show the full SDK list

Other third partiesanalytics

Adobe Analytics · Adobe Experience Platform · Adobe Identity · Adobe Lifecycle · Adobe Rules Engine · Adobe Services · FullStory

BranchAttribution · USA

Branch

Analytics SDKAnalytics

Mixpanel

Standard libraries26 · on-device

The app's own code plus open-source interface, storage and networking libraries.

How we know this

Counterspy downloads the app from the App Store and statically analyzes its compiled binary. Embedded SDKs are matched against a signature database and resolved to the company that operates each. We also read the developer's App Store privacy label, which lists the data the app says it collects and links to you. We do not run the app or intercept its traffic, so we report capabilities present in the code and the developer's own disclosures, not proven transmission. We assess privacy and data collection, not malware, security flaws, or developer intent. Reports are automated and never edited for payment. Scan v10.100.0, 2026-04-03.

Third-party trackers are advertising, analytics and attribution SDKs detected by static signature matching. Presence shows a capability is compiled in, not that it ran or transmitted data.
"Data the app links to you" is the count of data categories the developer declares as Data Linked To You in its App Store privacy label. Labels are self-reported and not verified by Apple.
Comparison across the 103 travel in our corpus. Trackers: median 5. Data linked to you: median 5.