Walgreens collects your most sensitive personal data including health information, financial details, and precise location, and uses it for the stated purposes as well as any other uses permitted by law.
This analysis describes what Walgreens's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Sensitive personal information categories carry heightened regulatory protection under multiple state laws, and the phrase 'as otherwise permitted by applicable law' leaves the scope of permitted uses subject to evolving legal standards.
Interpretive note: The phrase 'as otherwise permitted by applicable law' creates inherent uncertainty about the full scope of permitted uses, which depends on evolving state and federal legal standards.
Your health data, financial information, and precise location are collected by Walgreens, and while the policy states these are used for stated purposes, the qualifier 'as otherwise permitted by applicable law' means the scope of use is not fully fixed in the policy text and may expand as legal standards develop.
Cross-platform context
See how other platforms handle Sensitive Personal Information Collection and Use and similar clauses.
Compare across platforms →Monitoring
Walgreens has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"We collect certain sensitive personal information, including health and medical information, financial account information, precise geolocation data, and information about your racial or ethnic origin where you choose to provide it. We use sensitive personal information for the purposes for which it was collected and as otherwise permitted by applicable law.— Excerpt from Walgreens's Walgreens Privacy Policy
REGULATORY LANDSCAPE: CPRA in California establishes specific use limitation rights for sensitive personal information, requiring that consumers be able to limit use to what is necessary to perform the requested service unless additional consent is obtained. State health data statutes in Washington, Nevada, and other states may impose affirmative consent requirements for sensitive health data. HIPAA applies to health information in clinical and pharmacy contexts where Walgreens acts as a covered entity. GOVERNANCE EXPOSURE: High. The collection of multiple sensitive personal information categories in a single consumer profile, combined with digital advertising infrastructure, creates compounded compliance exposure across health privacy, financial data, and geolocation regulations. The open-ended qualifier 'as otherwise permitted by applicable law' creates interpretive flexibility that regulators may scrutinize. JURISDICTION FLAGS: California CPRA sensitive personal information use limitation rights apply. Washington MHMD may require affirmative consent for health data categories. Illinois Biometric Information Privacy Act may apply if biometric data is collected. Financial data elements may engage state financial privacy statutes in certain jurisdictions. CONTRACT AND VENDOR IMPLICATIONS: Service providers and analytics vendors receiving sensitive personal information must be contractually restricted to specified processing purposes. Advertising partners receiving any data derived from sensitive personal information categories require heightened contractual controls and may require separate data use agreements. COMPLIANCE CONSIDERATIONS: Compliance teams should map all sensitive personal information categories to their specific processing purposes and verify that use limitation mechanisms are operational; assess whether the 'as otherwise permitted by applicable law' qualifier is operationally defined with sufficient specificity; evaluate consent mechanisms for sensitive data categories across applicable state frameworks; and conduct regular audits of data flows involving health, financial, and geolocation data.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Sensitive personal information categories carry heightened regulatory protection under multiple state laws, and the phrase 'as otherwise permitted by applicable law' leaves the scope of permitted uses subject to evolving legal standards.
Your health data, financial information, and precise location are collected by Walgreens, and while the policy states these are used for stated purposes, the qualifier 'as otherwise permitted by applicable law' means the scope of use is not fully fixed in the policy text and may expand as legal standards develop.
ConductAtlas has identified this type of provision across 2 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Walgreens.