Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy discloses that health-related retail product purchase data, categorized as Sensitive Personal Information under California law, has been and may continue to be shared with online advertising networks, marketing companies, financial services partners, and social media companies in transactions that may constitute a sale or sharing under the California Consumer Privacy Act.
This analysis describes what Walgreens's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses that health-related retail purchase data is among the categories of Sensitive Personal Information shared with advertising and marketing third parties for secondary purposes, which triggers CPRA opt-out rights for California residents and may require evaluation under CPRA's purpose limitation and sensitive data handling requirements.
Under this provision, information about health-related retail product purchases may be shared with advertising networks, social media companies, and marketing companies in a manner that constitutes a sale or sharing under California law. California residents can opt out of this sharing by submitting a request through the link in the policy or by calling 800-925-4733.
Cross-platform context
See how other platforms handle Health-Related Retail Data Disclosed as Potential CA Data Sale and similar clauses.
Compare across platforms →Monitoring
Walgreens has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"In the 12 months prior to the date of this Privacy Policy, we shared for secondary purposes (which may constitute a 'sale' or 'sharing' of CA Personal Information under California law), and may continue to share, the following categories of CA Personal Information: [...] Sensitive Personal Information: such as information concerning your health, which may include certain health-related retail product purchases. The categories of third parties to which we may sell or share (as defined by California law) the above-described categories of CA Personal Information include Online Advertising Networks, Marketing Companies, Financial Services Partners and Social Media Companies.Excerpt from Walgreens's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages the California Consumer Privacy Act as amended by the California Privacy Rights Act, enforced by the California Privacy Protection Agency and the California Attorney General. CPRA imposes opt-out rights and purpose-limitation requirements on the sale or sharing of Sensitive Personal Information. The FTC Act may also be implicated if health-related retail data sharing practices are found to be unfair or deceptive. The FTC's 2024 guidance on health data and the FTC Act is relevant context, though enforcement outcomes should not be assumed. 2. GOVERNANCE EXPOSURE: High. The disclosure that health-related retail product purchases may be included in data sold or shared with advertising networks and social media companies is operationally significant because health data generally receives heightened protection under multiple frameworks. The policy's characterization of this data as Sensitive Personal Information under CPRA requires that Walgreens honor opt-out requests and may require that the data not be used for purposes beyond those disclosed without additional consent. 3. JURISDICTION FLAGS: California creates the primary statutory exposure given CPRA's explicit Sensitive Personal Information category and opt-out mechanism. Residents of the nineteen additional states listed in the policy may have analogous rights under their respective state privacy laws depending on how those laws define sensitive or health data categories. Illinois and Washington have enacted separate health data statutes that may independently govern some retail health data disclosures. 4. CONTRACT AND VENDOR IMPLICATIONS: Agreements with online advertising networks, marketing companies, and social media companies that receive this data should include data use restrictions consistent with the policy's disclosure and applicable state law requirements. If third parties receiving this data use it for purposes beyond those disclosed, Walgreens may face secondary liability under CPRA's contractor and service provider provisions. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should assess whether the opt-out mechanism for California residents is operationally connected to actual data flows to each named third-party category, including social media companies and financial services partners. Data mapping should identify which specific retail product categories generate health-related purchase data and confirm that the opt-out preference signal recognition process described in the policy applies to this data category. Records of opt-out requests and downstream vendor notification workflows should be documented.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision discloses that health-related retail purchase data is among the categories of Sensitive Personal Information shared with advertising and marketing third parties for secondary purposes, which triggers CPRA opt-out rights for California residents and may require evaluation under CPRA's purpose limitation and sensitive data handling requirements.
Under this provision, information about health-related retail product purchases may be shared with advertising networks, social media companies, and marketing companies in a manner that constitutes a sale or sharing under California law. California residents can opt out of this sharing by submitting a request through the link in the policy or by calling 800-925-4733.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Walgreens.