Class action waiver prevails: Fourth Circuit reverses certification in Marriott data breach litigation again

Background

The litigation stems from a cyberattack that potentially affected millions of records from Starwood Hotels’ reservation system. Following Marriott’s acquisition of Starwood in 2016, plaintiffs sued both Marriott and Starwood’s IT vendor, Accenture, asserting negligence, breach of contract, and consumer protection claims. The cases were consolidated in a multi-district litigation (“MDL”) proceeding in the District of Maryland. The district court certified “damages” classes under Rule 23(b)(3) against Marriott on breach of contract and consumer protection act claims. It also certified “issue” classes under Rule 23(c)(4) on the “duty” and “breach” elements of plaintiffs’ negligence claims against Marriott and Accenture.

Marriott and Accenture appealed certification of these classes, and the Fourth Circuit reversed. The panel found that the district court erred by failing to consider Marriott’s argument that putative class members agreed to a class action waiver when signing the Starwood Preferred Guest (“SPG”) Program contract. The panel further found that vacatur of the Marriott classes necessitated vacatur of all the issue classes, because the superiority analysis that supported them had been eliminated. The panel then remanded the case for the district court to consider whether Marriott had preserved the class action waiver argument.

On remand, the district court re-certified each of the classes. The court held that Marriott waived its class-waiver defense by agreeing to pretrial consolidation of claims in an MDL proceeding in Maryland, while also expressing reservations about the validity of the class action waiver.

Holding

Marriott and Accenture appealed again, and Fourth Circuit proceed to reverse the district court for a second time.

Class action waiver

There was no dispute that the SPG Contract, signed by all plaintiffs, included a class-action waiver. The Fourth Circuit rejected each of the arguments the district court advanced for refusing to enforce that waiver. First, it found that Marriott had preserved the waiver defense by raising it at each relevant stage the litigation, including in its answer. Second, it held that participation in MDL proceedings did not waive Marriott’s contractual rights and that MDLs, by nature, do not override such defenses. The panel also found no conflict between Rule 23 and class waivers, relying on the Supreme Court’s decision in American Express Co. v. Italian Colors Restaurant, 570 U.S. 228 (2013).

Enforceability under New York law

Apart from the question of preservation, the Fourth Circuit also held that the class action waiver was enforceable under New York law, which governed the SPG Contract. The panel determined that the waiver was neither unconscionable nor against public policy, rejecting the plaintiffs’ reliance on out-of-circuit case law. The panel further found that the waiver applied to all of plaintiffs’ claims – including tort and statutory claims – because they all “arise out of or relate to” the SPG Program.

Impact on Accenture

The decision to certify duty-and breach-of-duty-specific issue classes against Accenture also was reversed. With the Marriott damages classes decertified, there was no longer an efficiency justification for Accenture issue classes to proceed in parallel. The Fourth Circuit emphasized that “the need for extensive individual litigation on injury, causation, and damages, in other words, called into question the efficiency of threshold class proceeding on just two elements of the plaintiffs’ negligence claims,” and piecemeal certification on elements of negligence would generally fail the superiority requirement under Rule 23(b)(3).

Implications

The Fourth Circuit’s decision underscores that class action waivers have teeth and can help companies avoid class certification under Rule 23, especially when clearly preserved and properly framed in the underlying agreement. The enforceability of such waivers turns not only on their language, but also on contractual features like severability clauses, which the panel found allowed Marriott to enforce the waiver even when other provisions were not invoked.

The panel’s finding on the validity of class action waivers outside the arbitration context lends further support to enforcement so long as they are not unconscionable or contrary to public policy under applicable law. The decision also signals skepticism toward issue classes that isolate individual elements of claims – such as duty or breach in negligence – where significant individualized proceedings remain necessary for causation, injury, or damages. The court clarified that piecemeal certification does little to promote efficiency and is more likely to fail Rule 23(b)(3)’s superiority requirement.

Finally, the ruling highlights the importance of preserving class-action defenses early and consistently, through the pleadings and opposition to certification. For defendants, this case demonstrates the substantial impact that contract-based class-action waivers can have on limiting aggregate litigation and risk exposure.

Authored by Allison Holt Ryan, Adam Cooke, Alicia Paller, and Baily Martin.