California residents have legally enforceable rights to access, delete, correct, and opt out of the sale of their data, and to limit how sensitive information is used. Washington residents have additional rights under Washington state law.
This analysis describes what Starbucks's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
These rights are legally enforceable under the CPRA and Washington state law, meaning Starbucks is obligated to respond to qualifying requests, and consumers who exercise these rights cannot be penalized or given worse service as a result.
If you live in California, you can submit requests to see, delete, or correct your data, opt out of advertising data sharing, and restrict the use of sensitive information like your location. Starbucks is legally required to respond to these requests within statutory deadlines.
How other platforms handle this
If you are a California resident, you may have certain rights under the California Consumer Privacy Act (CCPA). These rights may include: the right to know about personal information collected, disclosed, or sold; the right to delete personal information collected from you; the right to opt-out of t...
California law gives residents the right to know what personal information we collect, use, share or sell; to delete personal information under certain circumstances; to opt-out of the sale or sharing of their personal information; to correct inaccurate personal information; to limit the use and dis...
If you are a California resident, you have the right to know what personal information we collect, use, disclose, and sell about you. You have the right to request deletion of your personal information, subject to certain exceptions. You have the right to opt out of the sale or sharing of your perso...
Monitoring
Starbucks has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"If you are a California resident, you have the right to know what personal information we collect, use, disclose, and sell or share about you; the right to delete personal information we have collected from you; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of your personal information; and the right to limit the use and disclosure of sensitive personal information. If you are a Washington State resident, you may have additional rights under Washington State privacy law.— Excerpt from Starbucks's Starbucks Privacy Policy
(1) REGULATORY LANDSCAPE: The CPRA, enforced by the California Privacy Protection Agency and the California Attorney General, mandates specific response timelines for consumer rights requests (45 days, extendable to 90 days), requires non-discrimination for exercising rights, and obligates businesses to maintain at least two methods for submitting requests. The Washington My Health MY Data Act creates additional rights for Washington residents related to consumer health data, which may include purchase data tied to health-related products or location-based inferences. (2) GOVERNANCE EXPOSURE: Medium. The disclosure of multi-state privacy rights is standard practice for businesses of Starbucks' scale operating in California and Washington. The governance exposure lies in the operational fulfillment of these rights, including timely response, accurate data identification, and non-discrimination enforcement. (3) JURISDICTION FLAGS: California and Washington are the expressly named jurisdictions. However, residents of Colorado, Connecticut, Texas, Virginia, and other states with enacted comprehensive privacy laws may have analogous rights that the notice does not expressly enumerate, which may create expectations gaps. (4) CONTRACT AND VENDOR IMPLICATIONS: Data processors and service providers holding Starbucks customer data must be capable of supporting deletion, correction, and access requests within statutory timelines. Vendor contracts should include provisions requiring cooperation with consumer rights fulfillment within required response windows. (5) COMPLIANCE CONSIDERATIONS: Legal teams should audit the end-to-end consumer rights request workflow, including identity verification procedures, response time tracking, and data mapping accuracy. The notice's reference to Washington rights should be assessed against current Washington My Health MY Data Act requirements to confirm scope and completeness. Non-discrimination policies for consumers who exercise privacy rights should be documented and operationalized.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
These rights are legally enforceable under the CPRA and Washington state law, meaning Starbucks is obligated to respond to qualifying requests, and consumers who exercise these rights cannot be penalized or given worse service as a result.
If you live in California, you can submit requests to see, delete, or correct your data, opt out of advertising data sharing, and restrict the use of sensitive information like your location. Starbucks is legally required to respond to these requests within statutory deadlines.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Starbucks.