Sale or Sharing of Personal Information for Advertising

What it is

Starbucks shares your personal data with advertising companies and social media platforms to show you targeted ads, and California law classifies this as a 'sale' or 'sharing' of your data, giving you the right to opt out.

Why it matters (compliance & governance perspective)

This means your purchase history, browsing behavior, and profile data may be used by third-party advertisers outside the Starbucks ecosystem to target you with ads, which many consumers do not anticipate when signing up for a coffee loyalty program.

Consumer impact (what this means for users)

Your personal information, including purchase history and behavioral data, may be shared with advertising and social media partners for targeted advertising purposes. California residents have the right to opt out of this sharing, and the opt-out mechanism is accessible via the Starbucks website.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision directly implicates the California Consumer Privacy Act as amended by the California Privacy Rights Act, which defines 'sharing' broadly to include disclosure of personal information to third parties for cross-context behavioral advertising purposes regardless of monetary consideration. The California Privacy Protection Agency and California Attorney General hold enforcement authority. The FTC Act is also engaged given the FTC's current enforcement posture on commercial surveillance and undisclosed data sharing practices. Compliance with CPRA requires a functioning opt-out mechanism and recognition of Global Privacy Control signals. (2) GOVERNANCE EXPOSURE: High. The disclosure of personal information to advertising and social media partners for behavioral targeting is one of the highest-scrutiny areas under current state privacy law enforcement. Failure to honor opt-out requests, recognize GPC signals, or maintain valid service provider agreements with advertising partners creates material regulatory exposure. (3) JURISDICTION FLAGS: California residents are the primary affected population with enforceable opt-out rights under CPRA. Colorado, Connecticut, Virginia, Texas, and other states with enacted comprehensive privacy laws also recognize opt-out rights for targeted advertising, creating a multi-state compliance obligation. EU and UK residents are not addressed, which may create exposure if Starbucks digital services are accessible in those jurisdictions. (4) CONTRACT AND VENDOR IMPLICATIONS: All advertising and analytics partners receiving personal information must be covered by CPRA-compliant contracts that restrict downstream use, prohibit retaining, using, or disclosing data for independent business purposes, and permit Starbucks to audit compliance. Social media platform data-sharing arrangements warrant particular scrutiny given platforms' independent data use rights under their own terms. (5) COMPLIANCE CONSIDERATIONS: Legal teams should audit the opt-out workflow end-to-end, including GPC signal recognition, to confirm technical compliance. Data processing agreements with all advertising partners should be reviewed and updated to meet CPRA contractor or service provider standards. A record of categories of personal information shared, the purposes, and the identities of recipient categories should be maintained and reflected in the annual CPRA data inventory.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Precise Geolocation Data Collection medium
• Voice and Audio Data Collection medium
• Inference and Consumer Profiling medium
• California and Washington Resident Privacy Rights low
• Starbucks Rewards Program Data Collection medium
• Third-Party Analytics and Advertising Cookies medium

Related Analysis

• What 38 AI Companies Actually Say About Your Data (2026)

  We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.