What Macy's does with your data

What it collects and does with your data

• 10-K reports Macy's Media Network revenue, net, of $188M in fiscal 2025, up from $176M (2024) and $155M (2023), with growth attributed to an Amazon ad partnership that started in 2025.
• Privacy notice lists Biometric Information (voice recordings, facial recognition) and states Macy's may sell biometric personal information; it separately states Macy's may sell sensitive personal information.
• Notice's sharing table lists 'Third Parties and/or Data Brokers for Marketing Purposes' as recipients of identifiers, commercial, internet activity, and sensitive personal information, marked Sold/Shared: Y, and says these parties may also share the information with others.
• Notice discloses automatic license plate reader cameras in parking lots and first-person body cameras worn by asset protection staff that capture video and audio.
• Offline data opt-out uses a separate Do Not Sell link; online tracking needs the Cookie Preferences link and separate app privacy settings. Notice says that with GPC on, website use may still be tracked.
• Notice explains the email sign-up discount code by stating that the cost of sending an email is nominal.
• 2025 California metrics in the notice: 6,997 Do Not Sell or Share requests received, 6,091 completed, 906 rejected or unverified.

Sensitive data

• biometrics (voice recordings, facial recognition, per notice)
• license plates (ALPR)
• body-camera video and audio
• precise location
• payment/credit card

Enforcement and litigation

2 matters in the research. Where the research says alleged, pending, or settled without admitting wrongdoing, so does this page.

• In re Clearview AI Consumer Privacy Litigation (N.D. Ill. MDL): plaintiffs alleged Macy's used Clearview's faceprint database more than 6,000 times on store security images. Court granted final approval of the nationwide settlement (class receives an equity stake in Clearview); the release covers Macy's with no Macy's payment, and the court noted discovery showed Macy's did not itself possess the biometric data. No admission of wrongdoing.
• Washington CEMA class action (W.D. Wash.) alleging false time-limited sale email subject lines. Pending as of last report.

Who else holds your data

Organizations holding a copy of your data, as the research counts them: at least 7. Floor: Macy's, Citibank, Amazon, Clearview AI (historical), plus at least one organization per disclosed service-provider, business-partner, and data-broker category. Data brokers are disclosed as a category, not named, and may re-share.

Third parties: 6 disclosed recipient categories. Named: Citibank (credit card), Amazon (ad partnership, per 10-K), Clearview AI (historical, per litigation). 6 recipient rows in the notice's sharing table: internal brands, service providers, business partners, third parties and/or data brokers, successors, law enforcement/compliance.

Data brokers linked to Macy's

• Sells or shares with data brokers it doesn't name. "Notice's sharing table lists 'Third Parties and/or Data Brokers for Marketing Purposes' as recipients of identifiers, commercial, internet activity, and sensitive personal information, marked Sold/Shared: Y, and says these parties may also share the information with others." Macy's own notice. Data brokers are a recipient category, not named. Already counted in Macy's own figure.

Confidence: confirmed means the company confirmed it or reported it in a filing. Alleged means a complaint or petition says so, with no ruling found. Reported means journalism or a Senate letter. How brokers are included

Data practices score

12 of 15. Five components, each 0 to 3. How the score works

Sells or shares

3

Enforcement

2

Retail media scale

2

Sensitive data

3

Opt-out friction

2

Estimated emissions for one person

Research gaps

• No current Star Rewards member count; used 2022 active customers.
• No Macy's email frequency measurement found.
• Macy's CEMA case name and number not confirmed.