What Your Store Loyalty Card Actually Knows About You

Three loyalty programs, three very different disclosure regimes, and one California investigation saying what the lawyers already knew.

State of Surveillance

TL;DR: Loyalty cards are not loyalty programs. They are data-collection relationships that pay you a discount to keep the relationship open. Kroger's privacy policy, last updated December 10, 2025, lists the loyalty account fields by name and says it shares that data with "AdTech companies," along with "AdTech vendors, social networks, technology/SaaS providers, analytics providers, marketing vendors, identity resolution providers."[1] CVS Media Exchange (CMX), the in-house retail media network that CVS Health runs for advertisers, markets a different model. The CMX public page says the network "allows advertisers to target ads across channels informed by front-store ExtraCare® purchase history data combined with digital engagements on CVS properties" and that it "creates unique 1:1 connections through the precision of our ExtraCare member loyalty data to turn real purchase behavior into measurable brand outcomes."[2] On January 27, 2026, California Attorney General Rob Bonta announced "an investigative sweep focused on businesses' use of consumers' personal information to set targeted, individualized prices for products and services, a practice known as surveillance pricing," targeting "prominent businesses in the retail, grocery, and hotel sectors."[3] Under the California Consumer Privacy Act, you have "the right to opt-out of sale or sharing" of personal information, including via "a user-enabled global privacy control," but "if you ask a business to delete or stop selling your personal information, you may not be able to continue participating in the special deals they offer in exchange for personal information."[4] The discount at the register is the price the chain pays you. The profile is the price you pay.

How the Data Flow Actually Works

Major US grocery chains and pharmacies run the same pipeline: a loyalty card number linked to your name, address, and phone number; a per-transaction record of what you bought and when; a household-level inference about the family that uses the card; and a sale of that profile to advertising partners, usually inside a corporate retail media network the chain also owns.[1][2] The chain pays you a discount to keep your participation in the pipeline stable. Both sides know the trade.

The mechanism looks opaque from the outside because retailers describe it in legal language. Kroger's policy frames loyalty as a member relationship to which the customer has consented, with a tiered opt-out: you can decline to participate, you can withdraw your consent, or you can ask the chain to forget you.[1] The withdrawal path runs through a phone call.[1]

What Kroger Takes from the Loyalty Account

Kroger's privacy policy, last updated December 10, 2025, names the loyalty-account fields it collects. The category list is broad: identifiers such as name, online identifiers, state and federal government ID numbers, date of birth, signature, and Kroger-assigned unique identifiers.[1] Under account information, the policy treats loyalty participation as a context for collecting your username, password, security questions, purchase and coupons data, fuel-point balance, preferred store, address, email and text communication preferences, and your "advertising preferences."[1] Purchase history and CCTV footage are tracked separately: the policy keeps CCTV for "a period ranging from 45 to 90 days" depending on the store, and retains loyalty-account data "for as long as you remain a customer."[1]

The sharing side is where loyalty data becomes a product someone else can rebrand. Kroger says: "We may share with or make available personal information to AdTech companies."[1] Earlier in the same notice, the categories of recipients are spelled out: "AdTech vendors, social networks, technology/SaaS providers, analytics providers, marketing vendors, identity resolution providers."[1] "Identity resolution providers" is the corporate word for vendors whose entire product is matching your Kroger profile to your browsing profile, your social profile, and the advertising ID on your phone.[1]

Kroger's privacy policy also tells you how to leave the pipeline. The full text of the opt-out is short, single-spaced: "If you wish to withdraw your consent and opt out of any of our loyalty programs, you can contact Kroger's Customer Contact Center by telephone at 1-800-KROGERS (1-800-576-4377)."[1] A web form path covers most of the state-law requests (right to know, right to delete, right to correct), but only the phone number is named as the program-opt-out mechanism.[1]

What CVS Sells to Advertisers

CVS Health runs an in-house retail media network, CMX (CVS Media Exchange), that markets ExtraCare purchase data to consumer brands as its core product. The CMX public page describes the offering in unusually explicit terms:

  • "CMX allows advertisers to target ads across channels informed by front-store ExtraCare® purchase history data combined with digital engagements on CVS properties."[2]
  • "Our deep knowledge of our ExtraCare members' shopping behaviors means that CMX is more than a media partner; we help brands build trust, develop highly-relevant targeting and drive growth."[2]
  • "CMX creates unique 1:1 connections through the precision of our ExtraCare member loyalty data to turn real purchase behavior into measurable brand outcomes."[2]
  • "CMX (CVS Media Exchange®) is a data-led, technology-driven retail media network that enables partners to reach CVS Pharmacy® customers and loyal ExtraCare® customers through a variety of digital platforms, including social channels, programmatic display and on CVS.com®."[2]

This is the cleanest case study of how a loyalty card becomes ad targeting: CVS gives advertisers access to "1:1 connections" built from ExtraCare purchase history, and the chain markets that service as a measurable ad-tech product.[2] The CMX page asks shoppers for no separate opt-in and offers no opt-out switch: campaigns reach ExtraCare members "as permitted by law," and the only privacy reference on the page is a Privacy Center link in the footer.[2] The register discount is what keeps you in the pipeline.

The TJX Disclosure from 2017

The TJX Companies (parent of T.J. Maxx, Marshalls, and HomeGoods) takes a different, narrower approach to its privacy statement: it names vendors. TJX's statement says it "use[s] a company called Adobe to collect and analyze information about the use of our websites," and that it "use[s] a company called Google to collect and analyze information about the use of our websites."[5] TJX says it uses "third parties to host our websites or mobile apps, operate certain of its features, send e-mails, print or send mailings, run our sweepstakes, contests or other promotions, conduct customer research, authorize and process your payments, manage and analyze data and our advertising effectiveness, and fulfill orders."[5]

The TJX privacy statement carries an "Effective Date: March 2017," the oldest policy among the three chains profiled here, and that version predates the modern retail-media-network era.[5] Treat the named-vendor list as a floor. A first-party disclosure written in 2017 describes what was true in 2017, not what is true about the swipe a reader makes today.

The California Investigation That Names the Problem

California's attorney general has publicly opened an investigation into how retailers use customer data for individualized pricing. On Tuesday, January 27, 2026, Attorney General Rob Bonta's office announced the sweep on Data Privacy Day. The press release's lead sentence is direct: "California Attorney General Rob Bonta today announced an investigative sweep focused on businesses' use of consumers' personal information to set targeted, individualized prices for products and services, a practice known as surveillance pricing."[3]

Bonta's quoted framing of the action is more specific: "Today, my office is launching a formal inquiry and will ask prominent businesses in the retail, grocery, and hotel sectors to provide my office with information so we can understand how these companies are using personal data."[3] The framing here is "surveillance pricing," not data sharing, but the data sharing is the precondition. The system cannot charge a higher loyalty price to a customer it has profiled as expecting a budget bus fare without first building the profile, and the loyalty card is the simplest way to build that profile at scale.

California's bill on the same issue, AB 2564, was introduced February 20, 2026, and proposes civil penalties of up to $12,500 per violation per consumer, up to three times that amount for an intentional violation, plus the revenues earned from it.[6] The bill reaches prices, not data collection. It would ban the price discrimination that uses a collected profile without touching the collection itself, and it leaves loyalty and rewards discounts exempt when their eligibility criteria are clearly and conspicuously disclosed and the discount is offered on equal terms to everyone who qualifies.[6] Loyalty-card-driven data sale stays lawful under the bill, while loyalty-card-driven individualized pricing does not.

What You Lose When You Opt Out

California's privacy regulator puts the tradeoff on the page in plain language, the part that loyalty-marketing copy never says out loud: "If you ask a business to delete or stop selling your personal information, you may not be able to continue participating in the special deals they offer in exchange for personal information."[4] The same page frames the alternatives: "Businesses can also offer you promotions, discounts and other deals in exchange for collecting, keeping, or selling your personal information. But they can only do this if the financial incentive offered is reasonably related to the value of your personal information."[4]

The legal hook that lets the discount pause work is the "right to opt-out of sale or sharing," which the same page says means "you may request that businesses stop selling or sharing your personal information ('opt-out'), including via a user-enabled global privacy control."[4] The browser-level Global Privacy Control signal, sent by browsers that support it, is treated as a valid opt-out under CCPA, and the chain cannot require you to do more than send the signal to take the selling off the table.[4]

Practical Takeaways

  1. Read the chain's "Notice at Collection" page before you sign up the next time. Kroger's California Notice at Collection table sets out each category of data the chain collects, the purposes it is collected for, and whether it is sold or shared, and it sets retention for loyalty-account data at "as long as you remain a customer."[1]
  2. Turn off the advertising preferences in your account. Kroger stores "your advertising preferences" and lets you ask it to stop "disclosures of your personal data for targeted advertising."[1]
  3. Send a global privacy control signal in your browser. California law treats GPC as a valid opt-out of sale or sharing.[4]
  4. Use the phone-call opt-out when you want it gone entirely. Kroger publishes the number as the opt-out path for the program itself: 1-800-KROGERS (1-800-576-4377).[1] The law notes the discount tradeoff plainly.[4]
  5. Cash, app-pay, or pre-paid gift cards remove the loyalty card from the pipeline. The chain still records a transaction, but a transaction not tied to a phone number is not tied to your loyalty profile.

None of those steps fully shut the retail media network if the chain already runs one. CMX-style purchase data sale runs on the loyalty profile, but it is also adjacent to browsing data, app data, and the corporate vendor network that the chain uses for "advertising effectiveness."[2][5] The transaction-level record, the AdTech recipients, and the household inference are three pipelines that have to be turned off separately to stop the data from leaving the loyalty gate.

The Bottom Line

The loyalty card is the data relationship. The retailer pays you a discount, and you pay the retailer in profile data, and the chains and their in-house retail media networks describe that trade in their own words.

  1. Kroger's privacy policy, last updated December 10, 2025, lists the loyalty-account fields the chain collects by name and shares with "AdTech companies" plus "AdTech vendors, social networks, technology/SaaS providers, analytics providers, marketing vendors, identity resolution providers." The phone-call opt-out runs through 1-800-KROGERS (1-800-576-4377).[1]
  2. CVS Health's in-house retail media network, CMX, markets ExtraCare purchase data to advertisers with "front-store ExtraCare® purchase history data combined with digital engagements on CVS properties" and "1:1 connections through the precision of our ExtraCare member loyalty data."[2]
  3. The TJX Companies' privacy statement names Adobe and Google as the companies it uses "to collect and analyze information about the use of our websites," under an "Effective Date: March 2017."[5]
  4. On January 27, 2026, California Attorney General Rob Bonta launched an "investigative sweep focused on businesses' use of consumers' personal information to set targeted, individualized prices for products and services, a practice known as surveillance pricing," in the retail, grocery, and hotel sectors.[3]
  5. The California Consumer Privacy Act gives consumers "the right to opt-out of sale or sharing" of personal information, including via "a user-enabled global privacy control," and warns that opting out may forfeit "the special deals they offer in exchange for personal information."[4]

Sources

  1. Kroger Co.: Privacy Policy (last updated December 10, 2025)
  2. CVS Health / CVS Media Exchange (CMX): CVS Retail Media Network public page
  3. Office of the California Attorney General: "On Data Privacy Day, Attorney General Bonta Focuses on Surveillance Pricing, Compliance with California Consumer Privacy Act" (January 27, 2026)
  4. Office of the California Attorney General: California Consumer Privacy Act, Consumer Rights page
  5. The TJX Companies, Inc.: Privacy Statement (Effective Date March 2017)
  6. CalMatters Digital Democracy: AB 2564 (Ward), Surveillance pricing (introduced February 20, 2026)

Published: October 17, 2026