Governance document

CA-D-000625

Starbucks Privacy Policy

Starbucks

Last change detected May 5, 2026 Privacy policy

SHA-256: d5e55caca30087576ff… 1 version captured 0 changes documented

Get the research letter

Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.

View original document at Starbucks ↗

This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology

114 Total

27 High severity

71 Medium severity

16 Low severity

Key Facts

What health-related information may Starbucks collect?

Starbucks may collect health-related information that you provide when reporting an event related to your health as a result of an experience at Starbucks.

What may Starbucks collect about the precise location of your device?

Starbucks may collect information about the precise location of your device, consistent with your device settings.

For unresolved EU-U.S. DPF compliance complaints, do you have the possibility to invoke binding arbitration?

For unresolved EU-U.S. DPF compliance complaints that are not resolved by other DPF mechanisms, you have the possibility, under certain conditions, to invoke binding arbitration.

Under what conditions can you invoke binding arbitration for unresolved EU-U.S. DPF compliance complaints?

For unresolved EU-U.S. DPF compliance complaints that are not resolved by other DPF mechanisms, you have the possibility, under certain conditions, to invoke binding arbitration.

Will all points and rewards earned until the time of withdrawal be available upon withdrawal from the Starbucks Rewards program?

Upon withdrawal from the Starbucks Rewards program, all points and rewards earned until the time of withdrawal will no longer be available.

Can Starbucks guarantee that personal information is absolutely safe from intrusion or other unauthorized access?

Starbucks cannot guarantee that personal information is absolutely safe from intrusion or other unauthorized access by others due to the inherent nature of the Internet.

Does Starbucks knowingly sell or share information of its customers under the age of 18 for targeted advertising?

Starbucks does not knowingly sell or share information of its customers under the age of 18 for targeted advertising.

What right may you have regarding personal information Starbucks processes about you?

You may have the right to know what personal information Starbucks processes about you and to receive a copy of the specific personal information Starbucks has processed or is processing about you.

Do you have the right to opt-out of your personal information being sold or shared for purposes of targeted advertising?

You may have the right to opt-out of your personal information being sold or shared for purposes of targeted advertising.

Who may Starbucks share each category of information it collects with?

Starbucks may share each category of information it collects with marketing, advertising, and analytics providers to deliver advertising on behalf of Starbucks, including counting ad impressions.

Stay ahead of the changes

Track Starbucks and get the diff the day its terms change.

Monitor Starbucks + up to 20 platforms — $4.99/mo →

Summary

Starbucks's privacy policy describes what personal data Starbucks collects about you — including your location, health information you report, and personal identifiers — and explains that it may use and share that data broadly for advertising purposes. You may have rights to see what data Starbucks holds about you and to opt out of having your information sold or shared for targeted advertising. If you leave the Starbucks Rewards program, you permanently lose all points and rewards you have earned.

Analysis

This privacy policy establishes the categories of personal information Starbucks may collect — including precise device location, health-related information, and a broad set of personal identifiers such as address book contents and IP address — along with the purposes for which that information may be used and shared. Starbucks may process personal information for targeted, cross-contextual, and online behavioral advertising, and may share every category of information it collects with marketing, advertising, and analytics providers. The policy sets out conditional privacy rights, including the right to know what personal information is processed, receive a copy of it, and opt out of its sale or sharing for targeted advertising. Starbucks acknowledges it cannot guarantee absolute protection of personal information from unauthorized access, and retains liability under EU-U.S. DPF Principles for agent mishandling unless it proves non-responsibility. Withdrawal from Starbucks Rewards results in immediate and permanent forfeiture of all accumulated points and rewards.

What this means for you

Starbucks may collect sensitive information about you, including your precise device location and any health information you voluntarily report, as well as a wide range of personal identifiers including your address book contacts. Every category of information Starbucks collects may be shared with marketing, advertising, and analytics providers for targeted advertising. Starbucks cannot guarantee your personal information is fully protected from unauthorized access. You may have the right to know what personal information Starbucks processes about you, receive a copy of it, and opt out of the sale or sharing of your personal information for targeted advertising — to exercise that opt-out, you can contact Starbucks through the mechanism provided in the policy.

Institutional Analysis

Stay ahead of the changes

Institutional analysis available with Insight

Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.

Monitor Starbucks + up to 20 platforms — $4.99/mo → Get the research letter, free

Featured, High severity

Collection of Consumer Health Related Data Compare →

Health information is among the most sensitive categories of personal data; its collection, even when user-initiated, creates records that could be used or disclosed in ways that affect the user.

Added July 10, 2026 Standard Seen across 296 platforms
Collection of Precise GPS Geolocation Compare →

Precise GPS coordinates reveal granular physical movements and location history, making this among the most sensitive categories of data Starbucks may collect.

Added July 10, 2026 Standard Seen across 296 platforms
DPF Binding Arbitration Available for Unresolved Complaints Compare →

Binding arbitration is a formal, legally enforceable dispute resolution process; its availability as a last resort provides a concrete remedy pathway for unresolved DPF complaints, but only under unspecified conditions.

Added July 10, 2026 Standard Seen across 206 platforms
Forfeiture of Points Upon Rewards Withdrawal Compare →

Users who withdraw from the program lose all accumulated loyalty value with no indication of any exception or redemption window, making withdrawal irreversible in terms of earned rewards.

Added July 10, 2026 Common Seen across 125 platforms
No Guarantee of Absolute Data Security Compare →

This disclaimer establishes a ceiling on Starbucks's security assurance, putting users on notice that a data breach or unauthorized access remains a possibility regardless of security measures in place.

Added July 10, 2026 Standard Seen across 287 platforms
No Sale or Share of Under-18 Data for Advertising Compare →

The 'knowingly' qualifier limits the protection's strength — the policy does not warrant absolute prevention, only that Starbucks does not do so with knowledge of the customer's age.

Added July 10, 2026 Standard Seen across 245 platforms
Right to Know and Access Personal Information Compare →

These rights, if they apply to you, give you visibility into what data Starbucks holds, which is foundational to exercising other privacy rights such as correction or deletion.

Added July 10, 2026 Standard Seen across 290 platforms
Right to Opt-Out of Sale or Sharing for Advertising Compare →

This right, where it applies, gives you a mechanism to stop Starbucks from monetising your personal information through targeted advertising channels.

Added July 10, 2026 Standard Seen across 290 platforms
Sharing Data with Advertising and Analytics Providers Compare →

Because the clause covers 'each of the categories of information described above,' the scope of data shared with third-party advertisers and analytics providers is as broad as Starbucks's entire data collection, including sensitive categories.

Added July 10, 2026 Standard Seen across 288 platforms
Starbucks Liable for Agent DPF Non-Compliance Compare →

This clause places the burden on Starbucks to prove non-responsibility when an agent violates DPF Principles, giving affected individuals a direct liability pathway against Starbucks rather than only against the agent.

Added July 10, 2026 Standard Seen across 229 platforms
Use of Data for Targeted Advertising Compare →

This clause establishes the legal basis for Starbucks to use personal information for behaviorally targeted advertising, a practice that relies on tracking user behavior across contexts.

Added July 10, 2026 Standard Seen across 279 platforms

Featured, Medium severity

Collection of Identifier Information Compare →

The breadth of identifier categories collected — including address book contacts and IP address — means Starbucks may hold data that can identify not only the user but potentially their contacts.

Added July 10, 2026 Standard Seen across 296 platforms