Instacart Privacy Policy

This is Instacart's privacy policy explaining how the grocery delivery company collects and uses your personal information, including your name, address, purchase history, location data, and even prescription delivery details. The single most important thing to know is that Instacart explicitly sells and shares your personal data — including shopping habits and device identifiers — with retail partners and advertising networks, but you can opt out. California residents have the strongest rights including the ability to request deletion of their data and opt out of data sales by visiting Instacart's privacy choices page.

This Privacy Policy, last updated January 15, 2026, governs Maplebear Inc. d/b/a Instacart's collection, use, and disclosure of Personal Information across its websites, mobile apps, APIs, and white-label retailer platforms, relying on consent, contractual necessity, and legitimate interest as legal bases depending on jurisdiction. The policy creates significant obligations around data sharing, including disclosure of Personal Information to retail partners, advertising networks, data brokers, and third-party service providers, while simultaneously granting users opt-out rights for data sales and targeted advertising. Notable provisions include explicit acknowledgment that Instacart 'sells' and 'shares' Personal Information under CCPA definitions, collection of sensitive health-adjacent data through prescription delivery services, and broad retention language that preserves data beyond transaction completion for unspecified 'business purposes.' The policy engages CCPA/CPRA (Cal. Civ. Code §1798.100 et seq.), Canada's PIPEDA, Nevada SB 220, and implicitly the FTC Act Section 5; California residents have the most materially distinct rights including opt-out of sale/sharing, deletion, and correction. Compliance teams should note the prescription delivery data handling section, which implicates potential HIPAA adjacency risk, and the cross-border transfer provisions affecting Canadian users, which require PIPEDA-compliant data transfer mechanisms.