Online Privacy Statement and Disclosures

American Express · agreement dated March 26, 2026 · Official agreement

66 cards.

Privacy Disclosures

At American Express, we value your trust and respect your privacy.

Explore our Privacy Disclosures to learn more about our privacy policies, principles, and notices.

Effective Date: March 26, 2026

At American Express, we are committed to safeguarding your privacy. We want you to know how we may collect, use, share, and keep information about you and the choices that are available to you.

When we provide certain American Express products or services to you, we may give you specific additional details about how we will use your Personal Information in that context.

If you have an American Express product or service that is not provided by American Express (such as a card issued by one of our partner banks), please review the relevant privacy notice that covers such product or service or contact your product or service provider for information about their privacy practices.

This online privacy statement applies to American Express websites and online applications ("apps") that run on smart phones, tablets, and other devices that link to this statement. This online privacy statement does not apply to those American Express websites that have their own online privacy statements, including Resy.com.

Information that we collect during recruitment or employment processes at American Express is governed by separate notices, which will be provided to you before or when your Personal Information is collected in those contexts.

Our products and services are not intended for children under 13 years of age. We do not knowingly solicit data online from, or market online to, children under 13 years of age.

Since we may update this online privacy statement, we recommend that you check the current version available from time to time. If we make updates to this statement, we will change the “Effective Date” at the top of this page.

What information does this Online Privacy Statement cover?

This online privacy statement describes how we (and our Service Providers) may collect, use, share and keep information that we get about you online. For example, we gather Online Information if you:

Some Online Information is Personal Information.

In this statement, we also explain how we may combine Online Information with Other Information and how we then use the combined information.

What information do we collect online and how do we collect it?

The types of information we collect depends on which product or service you use.

Sometimes you give information directly to us (or to our Service Providers). For example, you might give us your name, account number, email, mailing address, biometric data, phone number, or date of birth when you:

We (and our Service Providers or Advertising Partners ) also collect information including Personal Information through Cookies and Similar Technologies for purposes such as keeping our site secure, remembering website preferences, enhancing site functionality, analyzing site traffic, and advertising customization and measurement. For example, if you click Remember Me when you log in to our website, a cookie will store your username.

We (and our Service Providers or Advertising Partners) may collect information using Cookies and Similar Technologies about:

We (and our Service Providers or Advertising Partners) may also collect information made available through third-party platforms and apps (such as online social media platforms), through online databases or directories, or that is otherwise legitimately obtained. This information may be governed by the privacy notice(s) provided by the third party at the time of collection.

See the “What are your choices?” section below to learn more about your choices regarding the collection and use of your information, including through Cookies and Similar Technologies.

How do we use the information we collect about you?

We (or our Service Providers who may be assisting us or acting on our behalf) may use Online Information we collect about you on its own or combine it with Other Information to:

We may process Personal Information for the purposes described above using manual (human) and automated methods of processing, including artificial intelligence (AI), in accordance with applicable laws.

Some of our Advertising Partners are third-party advertising networks and social media partners that allow us to serve you with Targeted Advertising that is relevant to you when you are on a third-party website or app.

See the “What are your choices?” section below to learn more about how you can opt out of having your Personal Information shared with AdvertisingPartners for Targeted Advertising purposes as well as opt-outs that may be provided directly by our Advertising Partners.

How do we share your information?

We may share Personal Information as required or permitted by law, with:

We may also share Personal Information with other third parties for their own use with your consent. If you have a Business Card, please review the Business Card Privacy Notice for additional information.

We may transfer Personal Information to Service Providers or companies within the American Express Family of Companies throughout the world, for example, to process transactions and provide you with our products or services. Regardless of where we process your information, we still protect it in the manner described in this online privacy statement and according to the applicable laws.

How do we handle Aggregated and De-identified Information?

De-identified Information is information that cannot be reasonably linked to or associated with you. Aggregated Information is data or information relating to multiple people, which has been combined or aggregated and which does not identify you individually. We may share Aggregated Information or De-identified Information in several ways, for example:

How do we keep and safeguard your information?

We use administrative, technical, and physical security measures to protect your Personal Information. These measures include computer safeguards and secured files and facilities. We take reasonable steps to securely destroy or permanently de-identify Personal Information when we no longer need it. We will keep your Online Information only as long as we must to deliver our products and services, unless we are required by law or regulation or for litigation and regulatory investigations to keep it.

What are your choices?

Online and Targeted Advertising Choices

You have choices about how American Express uses and discloses your information, such as how we market to you or how we use Cookies and Similar Technologies.

Many Advertising Partners provide their own advertising-related opt-outs to consumers. We encourage you to learn more about Targeted Advertising and the choices you have by referring to the respective privacy statements of relevant Advertising Partners.

Direct Marketing Choices

You can choose how you would like to receive direct marketing communications - whether we send them to you through postal mail, email and/or telephone. If you choose to not receive marketing communications from us, we will honor your choice. Please be aware that if you choose not to receive such communications, certain offers attached to the product or services you have chosen may be affected. We will still communicate with you in connection with servicing your account, fulfilling your requests, or administering any promotion or any program in which you have elected to participate.

If you are a Card Member, a Merchant, or use another product or service, you may exercise your choices in the following ways:

You can also exercise certain choices by:

Please consult the Privacy Notice associated with your specific product to understand the choices that may be available to you.

How can you update your Personal Information?

You can update your Personal Information by logging in to your account at americanexpress.com. Card Members can also call the number on the back of their Card. Non-Card Members can call the customer service number associated with their product.

Glossary

Advertising Partners - partners we work with to place ads on our and third parties’ websites and apps and track how ads perform, including social media and online partners, such as FacebookFacebook and GoogleGoogle.

Aggregated Information - data or information relating to multiple people which has been combined or aggregated and which does not identify you individually. Aggregated Information includes information that we create or compile from various sources, including card transactions.

American Express (we, our, us) - the American Express Company as identified at the beginning of this online privacy statement.

American Express Family of Companies - any affiliate and subsidiary of, and any company owned or controlled by, the American Express Company.

Business Partners- any third parties with whom we conduct business and have a contractual relationship, such as a business that accepts American Express branded cards.

Co-brand Partners - businesses we partner with to offer cards featuring both brand logos.

Cookies and Similar Technologies - we and our Service Providers and Advertising Partners may use cookies, pixels, web beacons, Software Development Kits (“SDKs”), gifs, tags, Device ID technology and other similar technologies (collectively, “Cookies and Similar Technologies”) on our websites and apps. Cookies, for example, are small data files that a website transfers to your computer's hard drive, while SDKs are snippets of code embedded in websites or apps, both of which collect information about your activity.

De-identified Information - data or information which cannot be reasonably linked to or associated with you. We often derive De-identified Information from Personal Information. It includes information that we may collect from various sources, such as card transactions.

IP Address - a number assigned to a device when connecting to the Internet.

Online Information- data or information collected on the American Express websites and apps as well as on websites and apps of third parties relating to topics about our business.

Other Information- American Express internal information (for example, Card transaction data and customer call records), external data that financial companies use to process applications and complete transactions, and other online and offline information we collect from or about you.

Personal Information- information that can identify a person, such as name, address, telephone number, and email address.

Service Providers- any vendor, third party and/or company that performs business operations on our behalf, such as printing, mailing, and other communications services (email, direct mail, etc.), marketing, data processing, servicing, collections, or ad management.

Targeted Advertising- Ads that we, our Service Providers, or our Advertising Partners display on websites or in apps outside the American Express Family of Companies based on the preferences or interests inferred from data collected from a computer or device regarding viewing behaviors or app use over time and across different websites or apps. Targeted Advertising may occur across browsers or mobile devices that have been associated together.

Our Privacy Notices inform you of what personal information we collect, reasons we share information and how you can limit the sharing of your information. Click on the applicable product below to view associated privacy notice.

Effective: December 19, 2024

The following Data Protection and Privacy Principles (“Principles”) set out the way that American Express Company and its wholly owned direct and indirect subsidiaries (“American Express”) will collect, use, store, share, transmit, delete or otherwise process (collectively “process”) your personal data. Personal data means any information that relates to an identified or identifiable individual. The standard of personal data protection set out in these Principles will be used by American Express globally, providing adequate and consistent protection for the processing of your personal data. In these Principles, “you” and “your” means any individual customer or employee of American Express and any other individual whose personal data we process and “we”, “us”, “our” and “American Express Group” means American Express.

Collection

We will only collect personal data that is needed and by lawful and fair means.

Notice and Processing

Where it is not apparent from the products or services you require or the nature of your relationship with us, we will tell you how your personal data will be processed and which companies in the American Express Group are responsible for that processing. We will process your personal data fairly and only for those purposes we have told you, for purposes permitted by you or as permitted by applicable law. In addition, you may object to certain types of processing as expressly permitted by applicable law.

Choice

We give customers the option of having their personal data included or removed from lists used for marketing as required by applicable law. This includes product and service offers from American Express and those made in conjunction with our business partners. Of course each of our businesses will continue to send customers information about the products or services they receive from that business.

Data Quality

We use appropriate technology and well-defined employee practices to process your personal data promptly and accurately. We will not keep your personal data longer than is necessary, except as otherwise required by applicable law.

Security and Confidentiality

We will keep your personal data confidential and limit access to your personal data to those who specifically need it to conduct their business activities, except as otherwise permitted by applicable law. We refer to industry standards and use reasonable administrative, technical and physical security measures to protect your personal data from unauthorised access, destruction, use, modification or disclosure. We require industry standard data security measures from those third parties who are authorized by us to process your personal data on our behalf.

Data Sharing

We only share your personal data with third parties where it is necessary to provide you with products or services or as part of the nature of our relationship with you, where we have previously informed or been authorized by you, in connection with our efforts to reduce fraud or criminal activity, or as permitted by law.

Openness and Data Access

If you ask, we will inform you about how your personal data is processed and the rights and remedies you have under these Principles. You may inquire as to the nature of the personal data stored or processed about you by American Express. You will be provided access as is required by law in your country, regardless of the location of the data processing and storage. If any data is inaccurate or incomplete, you may request that the data be amended.

International Transfer

Where it is not apparent from the international products or services you require or the nature of your relationship with us, we will inform you if your personal data may be transferred outside of your country and ensure that such transfer is only performed in accordance with applicable law. Regardless of where your personal data is transferred, your personal data is protected by these Principles.

Responsibility

Each company in the American Express Group and their employees may only process your personal data in accordance with these Principles. We conduct training and reviews of our compliance with these Principles. Employees who violate these Principles may be subject to disciplinary action, up to and including dismissal. Employees are expected to report violation of these Principles, and may do so to their managers, to their business unit's compliance officer, to the legal department, to the Privacy Office or to the Amex Ethics Hotline.

Accountability

You may enforce these Principles in your country against any company in the American Express Group that is responsible for your personal data, as a third party contractual beneficiary to these Principles. If you have a complaint that we have breached these Principles and have attempted in good faith to resolve the complaint through our customer service process, but the complaint was not resolved by us within a reasonable amount of time, then you may enforce these Principles against us. If you complain to your local data protection authority and the data protection authority finds that we have breached these Principles, we will abide by the findings of the data protection authority, but we reserve the right to challenge or appeal such findings. These Principles do not affect any rights you have under applicable law, the requirements of any applicable regulatory data protection authority, or any other type of agreement that you may have with us.

These Principles emphasize our commitment to protect your personal data. They are binding on all companies in the American Express Group, demonstrating our commitment to privacy. In addition, each company in the American Express Group that holds personal data may maintain its own additional rules and practices for particular products or services, consistent with these Principles. If you have questions or comments about these Principles, please contact us at American Express.