[Enforcement library](/enforcement)

# Marriott v. Sperling Kenny: a company answers a 7,000-claim pixel arbitration with evidence about the claimant firms' own pixels

This page is about the plaintiff side and about evidence. Marriott says it honours privacy choices and opt-out signals on its site, and it hired an expert to capture what the claimant firms' own websites sent. Whichever way the court rules, the dispute runs on dated technical records.

US District Court, District of Maryland · Attorney disqualification, Lanham Act, tortious interference · Motions fully briefed 18 August 2026; underlying arbitration stayed

## The problem

Two law firms, Sperling Kenny Nachwalter and Hilliard Law, filed nearly 7,000 arbitration demands against Marriott with the American Arbitration Association. Each alleged that the Meta Pixel and similar code on marriott.com shared California visitors' data without consent ([FAC ¶¶ 5, 97](https://storage.courtlistener.com/recap/gov.uscourts.mdd.601066/gov.uscourts.mdd.601066.38.1.pdf)). Marriott then sued the firms. It alleges their own client-intake websites used the Meta Pixel and other trackers, without privacy controls, while collecting information from people seeking legal help. It says that creates a conflict that should disqualify them. The firms deny it. No court has decided any of these points.

- The problem
- Case record
- What was alleged
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Court | US District Court, District of Maryland (Judge Matthew J. Maddox) |
| Case number | 1:26-cv-00900-MJM |
| Parties | Marriott International, Inc. v. Sperling Kenny Nachwalter, LLC and Hilliard, Martinez & Gonzales, LLP |
| Counsel | Marriott: Watstein Terepka LLP. Sperling Kenny: Farra & Wang PLLC. Hilliard: Eccleston & Wolf (\[Dkt. 40-1\](https://storage.courtlistener.com/recap/gov.uscourts.mdd.601066/gov.uscourts.mdd.601066.40.1.pdf), signature page) |
| Laws | Disqualification under Maryland professional conduct rules; Lanham Act §43(a); tortious interference. Underlying demands: CIPA §631, §638.51, CCPA |
| Stage | Motion to disqualify and motion to dismiss or stay pending; arbitration stayed by the AAA process arbitrator |
| Amount | None decided |
| Source review | 17 October 2026 |

## What was alleged

| Claim | What it requires | What each side says | Status |
| --- | --- | --- | --- |
| Disqualification (declaratory and injunctive relief) | A conflict of interest or necessary-witness problem that taints the representation | Marriott: the firms' sites used the same pixels "in a far more invasive manner" (Compl. ¶ 5). Firms: an opponent cannot assert conflicts of its adversaries' clients, and there is no private cause of action (Dkt. 40-1, pp. 8–13) | Pending |
| Lanham Act and tortious interference (added June 2026) | False or misleading commercial statements; interference with business relations | Marriott: ads falsely branded its practices as criminal (FAC ¶ 23). Firms: Marriott admits using pixels and disputes only the legal consequence; client communications are privileged (Dkt. 40-1, p. 2) | Pending |
| Underlying arbitration demands (for context) | CIPA §631 and §638.51 at USD 5,000 per violation; CCPA USD 100 to USD 750 per instance | Marriott's site relayed visitors' data to Meta and others from 20 February 2024 to 19 May 2025, as the demands describe it (FAC Ex. C, ¶ 4) | Stayed; merits not reached |

## Technical issue

These are allegations and expert opinions filed by one side.

- **Marriott's site:** Marriott pleads that marriott.com uses "standard third-party website technologies, including cookies and pixels", offers "Tracking Preferences" and "Privacy Center" controls, and "recognizes and honors universal opt-out signals" (FAC ¶¶ 39–40). It also pleads that using the site is consent, which the firms dispute.
- **The firms' sites:** Marriott's technical expert, Ron Schnell, examined hilliard-law.com, privacyviolationclaim.com, legalsettlementexperts.com and sperlingkenny.com. He reports two Meta Pixel IDs, a TikTok Pixel, Google Analytics through Google Tag Manager, the PixelYourSite plug-in and Unbounce scripts (FAC Ex. C, ¶¶ 21, 45–48). He states that "form submissions on these sites result in user-entered data being transmitted to third-party platforms" (Dkt. 38-1, p. 71). On the Hilliard Law site, he says, enabling Global Privacy Control "did not prevent the loading or execution of the Meta Pixel, TikTok Pixel, HubSpot, or other third-party analytics technologies", while "Marriott's website, by contrast, detects and honors the GPC opt-out signal" (Ex. C, ¶ 43). One site had been taken down, so he worked from archived source code (¶ 44).
- **The firms' response:** in an April 2025 letter they said Marriott was "simply wrong as a factual matter" and that the intake websites did not pass form information to third parties (Dkt. 40-1, p. 5).
- **How it came to light:** archived page source, HAR captures and the expert's own testing, cited file by file in the declarations (FAC Ex. C, nn. 41–44, 56; supplemental declaration at Ex. D).

**Inth's technical interpretation:** both sides' arguments reduce to factual questions an engineer can answer with records. Which tags ran on which page and when? Did a form submission's fields reach a vendor? Was an opt-out signal such as Global Privacy Control received and honoured? Those questions are hard to answer after the fact without dated captures.

Illustrative pattern, not either party's code.

```js
// Risky on an intake form: the plug-in forwards form fields with the Lead event
document.querySelector('#claim-form').addEventListener('submit', (e) => {
  const data = Object.fromEntries(new FormData(e.target));
  fbq('track', 'Lead', { content_name: data.issue, em: data.email }); // sends what the person typed
});
```

Illustrative pattern, not either party's code. Generic consent API, not a c15t call.

```js
// Safer: honour GPC, send no form content, and keep a record of the decision
const optedOut = navigator.globalPrivacyControl === true || !consent.has('marketing');
if (!optedOut) fbq('track', 'Lead');              // event only, no field values
consentLog.record({ gpc: navigator.globalPrivacyControl === true, sent: !optedOut, at: Date.now() });
```

## Timeline

| Date | Event |
| --- | --- |
| 20 December 2024 | Firms' demand letter claiming to represent thousands of California residents (Compl. ¶ 69) |
| 16 January 2025 | Follow-up letter demanding at least USD 5,000 per claimant (Compl. ¶ 70) |
| 26 March 2025 | Marriott replies that the firms' own sites use pixels (Compl. Ex. A) |
| 5 June 2025 | Nearly 7,000 AAA demands filed; amended 22 October 2025 (FAC ¶ 97) |
| January 2026 | AAA process arbitrator appointed (Dkt. 40-1, p. 6) |
| 3 March 2026 | Marriott files this suit (\[docket\](https://www.courtlistener.com/docket/72358913/marriott-international-inc-v-sperling-kenny-nachwalter-llc/)) |
| 25 March 2026 | Motion to disqualify with technical and ethics expert declarations |
| April 2026 | Process arbitrator stays the mass arbitration pending this court's decision (FAC ¶ 105) |
| 4 June 2026 | Public first amended complaint adds Lanham Act and interference claims |
| 2 July to 18 August 2026 | Motion to dismiss or stay briefed |

## Outcome

None yet. As of the last docket entry reviewed (18 August 2026), the court had not ruled on disqualification or dismissal. The firms argue that the professional rules create no private right of action and that Marriott lacks standing to assert conflicts belonging to its adversaries' clients (Dkt. 40-1, pp. 8–13). Marriott says disqualification is a question for a court, not the arbitrator (Compl. ¶ 17). Nothing in the record decides whether marriott.com or the firms' sites violated CIPA.

## What it cost

| Item | Record |
| --- | --- |
| Damages claimed in the arbitrations | "At least" USD 20,000 per claimant, which Marriott calculates as more than USD 135,000,000 in total (FAC ¶ 97). A demand, not an award |
| Arbitration fees | Not stated in the cited record; Marriott says it "could be forced to pay millions" (Compl. ¶ 46) |
| Expert billing rates disclosed | USD 950 per hour (technical expert's firm) and USD 850 per hour (ethics expert's firm) (FAC exhibits). Totals not stated |
| Settlement | None in the record |

## Why it matters

- **Mass arbitration.** Website terms that require individual arbitration can turn one tracking theory into thousands of fee-bearing claims. Compare [DesignTechnica v. Swigart](/enforcement/designtechnica-v-swigart), where a publisher's federal challenge to 36 such claims failed on jurisdiction.
- **Evidence cuts both ways.** Marriott's position rests on its stated controls and opt-out handling; its attack on the firms rests on captures of their sites. See [ignored opt-out signals](/enforcement/issues/ignored-opt-out-signals).
- **Underlying law.** The demands' §638.51 count faces SB 690 (Stats. 2026, ch. 976), signed 30 September 2026 and operative 1 January 2027 (the default effective date for a 2026 statute). It makes private §638.51 claims over website and app conduct Attorney General only, retroactively for pending claims in actions filed on or after 1 January 2025 ([bill text](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB690)). Whether an arbitration counts as an "action" for that purpose is not decided. SB 690 leaves §631, §632 and §632.7 untouched, so the demands' §631 count is unaffected.

## How Inth catches this

The court is weighing the lawyers' conduct, not Marriott's tags. Inth's relevant role is the evidence an operator keeps.

- **Consent banner:** consent records showing each visitor's choice, country and the policy that applied. In California, Global Privacy Control counts as an opt-out of sale and sharing, so marketing and analytics stay off for that visitor. Inth's default California policy is opt-out, so tags run until the visitor opts out; holding them until a choice is a California opt-in policy you configure.
- **Website audit:** dated observations of which scripts and destinations ran on each page, by region and consent state, across a claim period such as February 2024 to May 2025.
- **Code audit:** flags a change that forwards form fields into pixel events, and keeps the decision history for each tracker.
- **Evidence:** records like these let an operator answer "what did the site send, to whom, under which choice" for thousands of claimants with the same dataset.

No record replaces the legal questions here: arbitrability, consent through terms of use, and professional-conduct rules are for counsel and the court.

## Checks for your own systems

### In the repository

- Search form handlers for pixel calls that pass field values (`fbq('track', 'Lead', {...})`, enhanced conversions, plug-in settings).
- Confirm GPC handling exists and is tested for California visitors.

### In the browser and network

- With GPC enabled, load the site and submit a test form; list every third-party request and any field values in it.
- Keep dated captures of key pages each release.

### With the people responsible

- Check your terms: arbitration clause, choice of law, and how fees are allocated in mass filings.
- Agree with counsel which records you would need to answer thousands of identical claims, and confirm you keep them.

## Sources and limits

- [Complaint, 3 March 2026 (Dkt. 1)](https://storage.courtlistener.com/recap/gov.uscourts.mdd.601066/gov.uscourts.mdd.601066.1.0.pdf)
- [First amended complaint with exhibits, public version (Dkt. 38-1)](https://storage.courtlistener.com/recap/gov.uscourts.mdd.601066/gov.uscourts.mdd.601066.38.1.pdf)
- [Defendants' brief in support of motion to dismiss or stay (Dkt. 40-1)](https://storage.courtlistener.com/recap/gov.uscourts.mdd.601066/gov.uscourts.mdd.601066.40.1.pdf)
- [Defendants' reply (Dkt. 46)](https://storage.courtlistener.com/recap/gov.uscourts.mdd.601066/gov.uscourts.mdd.601066.46.0.pdf)
- [Docket, 1:26-cv-00900 (CourtListener)](https://www.courtlistener.com/docket/72358913/marriott-international-inc-v-sperling-kenny-nachwalter-llc/)

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Marriott International, Inc.'s current systems or the defendant firms' websites. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [DesignTechnica v. Swigart](/enforcement/designtechnica-v-swigart) · [Mitchener v. Talkspace](/enforcement/mitchener-v-talkspace) · [Notice, consent scope and assent](/enforcement/issues/notice-consent-scope-and-assent) · [Demand letters](/enforcement/demand-letters)