Starbucks Privacy Policy

This document is Starbucks' Privacy Notice governing the collection, use, and sharing of personal information across its websites, mobile applications, in-store services, and Starbucks Rewards program, with stated legal basis rooted in consent, contractual necessity, and legitimate business interests. The notice states that Starbucks collects identifiable data including name, email, phone, payment card details, precise geolocation, purchase and transaction history, device identifiers, voice and audio data from customer service interactions, and inferences drawn from consumer behavior to build profiles used for personalized marketing, loyalty program administration, and analytics. The notice authorizes sharing of personal data with a broad range of third parties including advertising partners, data analytics vendors, social media platforms, and business partners for cross-context behavioral advertising purposes, and discloses the sale or sharing of personal information as defined under California law, which triggers specific opt-out rights; the breadth of inference and profiling activities, combined with sharing for advertising purposes, represents a notable scope of data monetization relative to what a retail food-and-beverage consumer might reasonably anticipate. The notice explicitly engages the California Consumer Privacy Act as amended by the California Privacy Rights Act, citing rights to know, delete, correct, opt out of sale or sharing, and limit sensitive personal information use, and references compliance with Washington State privacy law for Washington residents; the document is primarily US-focused with no substantive GDPR or UK GDPR framework described, which may create gaps for any EU or UK customer interactions. Compliance teams should note that the notice discloses collection of precise geolocation, voice and audio data, and inferences as categories of sensitive or functionally sensitive data, each carrying heightened regulatory attention under the CPRA and emerging state privacy statutes, and that the disclosed advertising-partner data-sharing model warrants ongoing assessment under FTC unfair or deceptive practices authority.