What Starbucks does with your data

What it collects and does with your data

• Privacy notice: disclosures to advertising partners of identifiers, network activity, transaction information, and inferences may be deemed a sale or sharing under state law.
• Notice says Starbucks may use location-based technology to detect a device in and around stores if Bluetooth is on, and uses precise location to tailor messages based on time and location patterns and to limit the number of times a customer sees a promotional message.
• Notice names Ekata, Inc. as a fraud-prevention supplier that uses information as a controller for the benefit of Starbucks and others.

Sensitive data

• precise location
• in-store Bluetooth presence detection
• payment/stored value

Enforcement and litigation

1 matter in the research. Where the research says alleged, pending, or settled without admitting wrongdoing, so does this page.

• Class action alleging Starbucks and Amazon violated New York City's biometric identifier law at Just Walk Out stores; largely dismissed in federal court.

Who else holds your data

Organizations holding a copy of your data, as the research counts them: at least 3. Floor: Starbucks, Ekata, plus at least one advertising partner.

Third parties: 6 disclosed recipient categories. Named: Ekata as controller; Amazon (Just Walk Out stores, historical). 6 = affiliates, service providers, business partners, advertising and analytics providers, corporate transactions, legal/government.

Data brokers linked to Starbucks

None. The research documents no flow between Starbucks and a data broker.

Data practices score

4 of 15. Five components, each 0 to 3. How the score works

Sells or shares

2

Enforcement

0

Retail media scale

0

Sensitive data

1

Opt-out friction

1

Estimated emissions for one person

Research gaps

• No email frequency data.
• Member count taken from call highlights, not a filing.
• Final disposition of the Just Walk Out suit as to Starbucks not independently confirmed.