Direct-booking engines, digital check-in, and guest portals built with AI move independents away from 18–30% OTA commissions - but hospitality is one of the most breach-scarred industries, and 98% of hoteliers now use AI in operations. A booking or check-in app storing card data or passport scans without hardening sits at the intersection of PCI DSS, GDPR, and state breach law.
Get a Free Security Scan See Our AI App AuditHotel apps process a uniquely toxic data mix - payment cards, passports/IDs, and rich stay histories - and 2025–2026 saw a drumbeat of hotel-tech breaches proving it.
Card-not-present transactions make up roughly 80% of hotel bookings, and a custom checkout built to dodge OTA commissions is squarely inside PCI DSS 4.0.1 scope - client-side script monitoring, MFA, and automated log review, none of which AI builders generate by default. Emailing virtual card details in plaintext also violates Requirement 4.2.1.
Tabiq's check-in system left 1M+ passports, driver's licenses, and verification selfies in a public AWS bucket readable "by knowing only the bucket name" (reported May 2026) - the same misconfiguration AI builders produce by default. Chekin leaked 311,400 records including 253,000 ID document numbers via hardcoded API keys (March 2026). A passport can't be reissued with a phone call, and its exposure triggers all-50-state breach statutes.
Roughly 10% of scanned Lovable apps had vulnerable endpoints, and the April 2026 Booking.com breach showed criminals weaponizing exact hotel names, dates, and reservation references in WhatsApp/SMS scams within days of a breach. A leaky guest portal damages guests and reviews, not just the database.
Loyalty fraud exceeds B a year across large travel/hospitality companies, and stolen hotel accounts sell for roughly .15 each - 13,000+ were listed for sale in Q1 2025 alone. An AI-built rewards feature without MFA, rate limiting, or redemption controls is an account-takeover farm.
Prompt injection is #1 on the OWASP LLM Top 10. A concierge chatbot with database access can be manipulated into leaking other guests' reservations, and staff pasting guest profiles into public AI tools risks leaking PII into training data.
Otelier fell to a single stolen employee credential, exposing 7.8TB of data including Marriott, Hilton, and Hyatt guest records across 10,000+ hotels. Chekin/Gastrodat ran on Python scripts with hardcoded API keys across 527 compromised hotel accounts. AI-generated integration code with keys left in the frontend is the same failure mode, miniaturized.
| Regulation | When it applies | Penalty |
|---|---|---|
| PCI DSS 4.0.1 | Booking engine/checkout captures card data, even briefly; 51 new reqs mandatory since 2025-03-31 | –nth acquirer fines + card-brand liability |
| GDPR | Any hotel offering bookings to EU guests or monitoring them - even a US property marketing to EU travelers | Up to €20M or 4% turnover; Marriott £18.4M (ICO) |
| CCPA/CPRA | CA-resident guests + thresholds; opt-out/deletion/notice | unintentional / intentional |
| State breach-notification (all 50) | Breach of name + passport number, DL, or card data | AG enforcement + notification costs + class actions; Marriott M to 50 states/DC |
| ADA Title III + hotel reservation rule | Any hotel booking website - must let disabled guests book accessible rooms with described features | Settlements ~– + fees |
| TCPA | SMS confirmations drifting into marketing without prior express written consent | – per text, uncapped |
| Illinois BIPA (+ TX, WA) | Selfie/face-match ID verification at digital check-in for IL guests | negligent / willful per person |
Not by default. Roughly 10% of scanned Lovable apps had vulnerable endpoints, and one leaked 18,000 people's data. Before taking reservations, confirm row-level security is enabled and your checkout meets PCI DSS 4.0.1's script-monitoring requirements.
Yes. GDPR follows the guest, not the hotel's address - Article 3(2) applies to any business offering bookings to or monitoring EU/UK travelers, even a small US property marketing to European visitors. Marriott's £18.4M UK fine was specifically for failing the technical measures GDPR requires.
In May 2026, a hotel check-in system called Tabiq was found leaving over 1 million passports, driver's licenses, and verification selfies in a public, unauthenticated AWS S3 bucket - accessible to anyone who knew the bucket name. The files dated back to 2020.
Yes. Any checkout that captures card data, even briefly, falls under PCI DSS 4.0.1. Since March 31, 2025, that includes client-side script monitoring and automated log review - controls AI booking-engine builders don't generate by default.
Not automatically. The hotel-specific ADA reservation rule (28 CFR 36.302(e)) requires booking sites to let disabled guests reserve accessible rooms and to describe accessible features. Hospitality is a top target for web-accessibility suits - 3,117 were filed federally in 2025, up 27%.
Rotate every API key and PMS/channel-manager credential, enable row-level security if it wasn't already on, and determine whether passport or ID data was involved - that triggers breach notification in all 50 states. Notify guests quickly, since stolen reservation data is now being weaponized in SMS/WhatsApp phishing within days of a breach.
We audit AI-built hotel booking and check-in apps for exposed guest data, missing RLS, and PCI/GDPR/ADA gaps - then fix what we find.
Get a Free Security Scan