What the Notice covers: personal information processed in North America
The Notice describes what personal information Starbucks Corporation and its subsidiaries and affiliates collect, how they use it, how and when it may be shared, and the rights and choices you have. It applies to personal information Starbucks processes in North America, including when you visit websites or applications owned and operated by Starbucks brands or products that direct you to this Notice (the Starbucks Rewards mobile app is the named example) and when you visit its stores. Together these are called the "Starbucks Services".
Supporting quotations
this Notice applies to the personal information that we process in North America
including when you visit websites or applications owned and operated by Starbucks brands or products that direct you to this Notice
and when you visit our stores
Qualifications & exceptions
Applies to websites and applications that direct you to this Notice, and to store visits
Stated scope is personal information processed in North America
Not stated here
The Notice does not list which Starbucks brands or products direct people to it
Sections 15 and 16 address people in the EEA, the U.K. and Switzerland even though the scope sentence says North America; the Notice does not explain how the two fit together
Cross-references
contrast (model-proposed): EEA, U.K. and Switzerland section: GDPR-based disclosures that do not replace an EEA affiliate's own policy — contrast: The introduction says the Notice applies to personal information processed in North America, while section 15 (and section 16) give additional disclosures for people in the EEA, the U.K. and Switzerland. The Notice does not explain how the North America scope statement relates to those sections.
Legal Rights & Agreement Rules · Context
The Notice states it was last revised January 22, 2026
The version analyzed states "Last Revised: January 22, 2026". The Notice does not announce a later effective date or a future version.
Supporting quotations
Last Revised: January 22, 2026
Qualifications & exceptions
Date is the publisher's own statement of the last revision
Not stated here
The Notice does not say when the January 22, 2026 version took effect separately from its revision date
Use & Processing · Company commitment
Starbucks says it strives to follow data minimization, limited collection and limited use
Starbucks says that, to protect your privacy and comply with applicable privacy and data protection laws, it "strives" to consider its data governance practices through the principles of data minimization, limited collection and limited use. This is a statement of effort and approach, not a specific rule or guarantee about any data type.
Supporting quotations
we strive to consider our data governance practices through the lens of the recognized principles of data minimization, limited collection, and limited use
Qualifications & exceptions
Worded as "strive to consider", an aim rather than a firm promise
Tied to "applicable privacy and data protection laws"
Not stated here
The Notice does not say how these principles are measured or enforced
Legal Rights & Agreement Rules · Company practice
Continuing to use Starbucks Services means you acknowledge the Notice and agree to the Terms of Use
The Notice says that by continuing to use Starbucks Services you acknowledge this Privacy Notice and agree to Starbucks' Terms of Use and other important policies available on its homepage. Use of the Services is therefore treated as acknowledgement of the Notice and agreement to those other documents.
Supporting quotations
By continuing to use Starbucks Services you acknowledge this Privacy Notice and agree to our Terms of Use and other important policies available on our homepage.
Qualifications & exceptions
Triggered by continuing to use Starbucks Services
The Terms of Use and "other important policies" are separate documents and were not supplied with this Notice
Not stated here
Which "other important policies" are meant is not specified
Legal Rights & Agreement Rules · Company commitment
Starbucks may update the Notice and says it will notify you of material changes
Starbucks may update the Notice from time to time. It says it will notify you of material changes and will update the Last Revised date, and it encourages you to look for updates and changes when you access its websites and mobile applications. The Notice does not say how a material change will be notified.
Supporting quotations
We may update this Notice from time to time.
We will notify you of material changes to this Notice and will update the Last Revised date on this Notice.
We encourage you to look for updates and changes to this Notice when you access our websites and mobile applications.
Qualifications & exceptions
Notification is promised for "material changes" only
The Last Revised date is updated with changes
Not stated here
The Notice does not say how or how far in advance you will be notified
Data Access & Collection · Company practice
Categories of information Starbucks may collect when you use its Services
When you visit and use the Starbucks Services, Starbucks says it may collect the categories of information listed in this section: identifiers, demographic information, financial information, commercial information, internet or device activity, general geolocation, audio/electronic/visual information, inferences and other information you provide. A separate group of categories "that may be considered sensitive under some privacy laws" is listed after them. The wording throughout is "may collect", so the list describes what Starbucks can collect, not what it collects from every person.
Supporting quotations
When you visit and use the Starbucks Services, we may collect the following categories of information
depending on how you use the Starbucks Services, we may collect the following categories of personal information from you that may be considered sensitive under some privacy laws
Qualifications & exceptions
Worded "may collect": categories Starbucks is able to collect, depending on how you use the Services
Not stated here
The Notice does not say which categories apply to which Service (website, app, store, voice ordering)
Data Access & Collection · Company practice
Identifiers: name, phone, address book, email, postal and IP address, and day and month of birthday
Starbucks may collect information that can identify you, including your first and last name, phone number, your address book, email address, postal address, IP address, and the day and month of your birthday. The list uses "such as", so it gives examples rather than a complete list. "Your address book" is among the examples.
Supporting quotations
We may collect information that can be used to identify you, such as your first and last name, phone number, your address book, email address, postal address, IP address, and the day and month of your birthday
Qualifications & exceptions
Examples introduced by "such as"; not a closed list
Only the day and month of birth are listed, not the year
Not stated here
The Notice does not explain when or how address book information is collected
Data Access & Collection · Company practice
Demographic information: age range and gender
Starbucks may collect certain demographic information, such as your age range and gender. The examples are introduced by "such as".
Supporting quotations
We may collect certain demographic information, such as your age range and gender.
Qualifications & exceptions
Examples only ("such as")
Charges & Financial Obligations · Company practice
Financial information: card details if you make purchases
Starbucks may collect payment information, such as your credit card and debit card information, if you make any purchases.
Supporting quotations
We may collect payment information such as your credit card and debit card information if you make any purchases.
Qualifications & exceptions
Applies "if you make any purchases"
Data Access & Collection · Company practice
Commercial information: purchases, frequency, Rewards and your Wishlist or My Bag
Starbucks may collect information about your transactions in its stores, on its websites or through the Starbucks App. That includes what products you buy, how often you buy them, any Rewards or promotions tied to a purchase, and the products you have placed on your "Wishlist" or "My Bag" for future purchase.
Supporting quotations
We may collect information about your transactions in our stores, on our websites or via our Starbucks App, including what products you purchase, how frequently you purchase them, any Rewards or promotions associated with a purchase, and the products you have placed on your “Wishlist” or “My Bag” for future purchase
Qualifications & exceptions
Covers store, website and app transactions
Data Access & Collection · Company practice
Internet and device activity: browsing history, usage, device details and live help chat
Starbucks may collect information about your electronic network activity. This includes your browsing history while using Starbucks Services, how you use the Services, details about your device (device type, browser type and language, hardware model, operating system version, unique device identifiers and IP address), and information related to the "live help" chat feature on the Starbucks website.
Supporting quotations
We may collect information related to your electronic network activity, such as your browsing history when you use Starbucks Services, information about how you use the Starbucks Services, information about your device (e.g., device type, browser type and language, hardware model, operating system version, unique device identifiers, and IP address), and information related to Starbucks website’s “live help” chat feature
Qualifications & exceptions
Device details are introduced by "e.g.", so they are examples
Data Access & Collection · Company practice
General location: approximate device location and device presence in or near stores
Starbucks may collect the imprecise or approximate location of your device, for example from your browser or device IP address. It may also use location-based technology when you are in or around its retail locations to collect information about the presence of your device, if your Bluetooth is turned on and your device settings allow it. The Notice points to later text for precise geolocation.
Supporting quotations
We may collect information about the imprecise or approximate location of your device, such as information derived from your device (e.g., based on a browser or device’s IP address).
We may also use location-based technology when you are in or around our retail locations to collect information about the presence of your device, if your Bluetooth is turned on and your device settings allow for this.
Qualifications & exceptions
Store presence detection only "if your Bluetooth is turned on and your device settings allow for this"
Approximate location, for example derived from an IP address
Not stated here
The Notice does not say how long approximate location or store presence information is kept
Data Access & Collection · Company practice
Audio and visual information: store cameras, voice ordering and Customer Care calls
Starbucks may collect audio and visual information when you use its Services. Some retail locations may have cameras installed for security and operational purposes, which may collect audio, visual and similar information to prevent and detect crime or to improve store design. Depending on how you interact with Starbucks, it may also collect audio when you use voice ordering at a drive-thru or in the Starbucks App, or when you call Customer Care.
Supporting quotations
some of our retail locations may have cameras installed for security and operational purposes, which may collect audio, visual, and similar information to prevent and detect crime or improve store design to better serve our customers
we may collect audio information when you use voice ordering at a drive-thru location or in the Starbucks App, or call Customer Care
Qualifications & exceptions
Store cameras are described as present at "some" retail locations
Stated purposes for cameras: security and operational, crime prevention and detection, store design
Voice audio collection depends on using voice ordering or calling Customer Care
Not stated here
The Notice does not say whether recorded calls or voice ordering audio is retained or for how long
Inference & Profiling · Company practice
Inferences drawn from collected information, and other information you provide
Starbucks may collect inferences drawn from the other information it collects. It may also collect other information that you voluntarily provide when you communicate with Starbucks.
Supporting quotations
We may also collect inferences drawn from the information described above.
We may collect other information that you voluntarily provide when you communicate with us.
Qualifications & exceptions
Inferences are drawn "from the information described above"
"Other" covers information you voluntarily provide when you communicate with Starbucks
Not stated here
The Notice does not say what kinds of inferences are drawn or what they are used for here
Data Access & Collection · Company practice
Precise location: GPS and other signals, used to facilitate services
Starbucks may collect the precise location of your device (for example GPS latitude and longitude), consistent with your device settings. It may also use location-based technology in or around its retail locations to detect your device if Bluetooth is on and your settings allow it. It may collect or derive this from GPS, WiFi, Bluetooth or other location technology for purposes of facilitating its services, such as showing stores near you, letting you order and pay remotely, or having products delivered to you by a third-party vendor. The Notice lists precise geolocation among categories that may be considered sensitive under some privacy laws.
Supporting quotations
We may collect information about the precise location of your device (e.g., GPS latitude and longitude), consistent with your device settings.
We may collect this location information or derive it from your GPS, WiFi, Bluetooth or other location-based technology for purposes of facilitating our services, such as to provide you with information about stores near you, to enable you to remotely order and pay for our products and services, or so that you may have certain Starbucks products delivered to you by a third-party vendor.
Qualifications & exceptions
Collection is "consistent with your device settings"
Store presence detection requires Bluetooth to be on and device settings to allow it
Purposes named: stores near you, remote order and pay, third-party delivery
Not stated here
Section 13(a) describes further uses of location sharing, such as customizing your experience and measuring marketing, which this section does not list
Cross-references
contrast (model-proposed): If you allow location sharing, Starbucks may use it to customize your experience, measure marketing and tailor messages — contrast: Section 2 ties collection of precise location to facilitating services such as nearby stores, remote ordering and delivery. Section 13(a) says that if you allow location sharing, Starbucks may also use it to customize your in-store experience, measure marketing effectiveness and tailor messages by time and location patterns. The two descriptions of what location is used for pull in different directions, and the Notice does not reconcile them.
Data Access & Collection · Company practice
Consumer health related data you provide when reporting a health event
Starbucks may collect information you provide when you report an event related to your health as a result of an experience at Starbucks. The Notice points to a separate Consumer Health Data Privacy Notice for Washington and Nevada for more on how it may process information that could be considered consumer health data.
Supporting quotations
We may collect information that you provide to us when reporting an event related to your health as a result of an experience at Starbucks.
Limited to information you provide when reporting a health-related event from a Starbucks experience
Further detail is in a separate notice for Washington and Nevada
Not stated here
The separate Consumer Health Data Privacy Notice was not supplied with this Notice, so its terms are not stated here
Account & Service Control · Company practice
Account login information together with passwords
Starbucks may collect login information for accounts in combination with the passwords that allow access to those accounts. The Notice lists this among categories that may be considered sensitive under some privacy laws.
Supporting quotations
We may collect login information for accounts in combination with passwords allowing access to the accounts.
Qualifications & exceptions
Login information is collected "in combination with passwords"
Not stated here
The Notice does not say how passwords are stored or protected in this section
Use & Processing · Restriction or exception
Aggregated or de-identified data that Starbucks does not try to re-identify is outside the Notice
Starbucks says it may aggregate or de-identify the information it collects. Aggregated or de-identified data that Starbucks does not attempt to reidentify is not subject to this Notice, so the Notice's statements about personal information do not govern that data.
Supporting quotations
We may aggregate or de-identify the information described above. Aggregated or de-identified data that we do not attempt to reidentify is not subject to this Notice.
Qualifications & exceptions
Exception applies only to data Starbucks does not attempt to reidentify
Not stated here
The Notice does not say how data is de-identified or how it may be used afterward
Data Access & Collection · Context
Without this information Starbucks may not be able to provide all requested services
Starbucks says that without the information described in this section it may not be able to provide you with all the services you request.
Supporting quotations
Without this information, we may not be able to provide you with all the requested services.
Qualifications & exceptions
Worded "may not be able to", not an absolute statement
Not stated here
The Notice does not say which services depend on which information
Linking & Identification · Company practice
Sources: stores, online, and third parties including other users, advertising partners and publicly available sources
Starbucks may obtain personal information from different sources, technologies and devices: in its stores, online, and from third parties. The third parties named are other users of the Services (for example someone buying you a gift), advertising partners, co-sponsors, internet service providers, data analytics providers, operating systems and platforms, social networks and publicly available sources. If you use social media or similar services through the Starbucks Services to log in or share your experience, Starbucks may collect information from those services. It may also combine information you provide or it collects automatically with information from other sources.
Supporting quotations
This information may be collected from various places including in our stores, online, and from third parties, including from other users of Starbucks Services (such as when they purchase a gift for you), advertising partners, co-sponsors, internet service providers, data analytics providers, operating systems and platforms, social networks, and publicly available sources.
if you access any social media or similar services through the Starbucks Services to login or to share information about your experience on our Starbucks Services with others, we may collect information from these third-party services
We may also combine the information that you provide us or that we collect automatically with information that we receive from other sources.
Qualifications & exceptions
Worded "may obtain" and "may be collected"; sources are possibilities, not a confirmed list for every person
Social network information is collected when you use social login or share through the Services
Combination of your information with information from other sources is stated as something Starbucks "may" do
Not stated here
The Notice does not say which third parties supply which data
Use & Processing · Company practice
Starbucks may use the information it collects for various business purposes
Starbucks says it may use the information it collects about you for various business purposes. The sections below group those purposes under providing services, communicating with you, research and improvement, legal reasons, targeted advertising and your consent.
Supporting quotations
We may use the information we collect about you for various business purposes, including to:
Qualifications & exceptions
Worded "may use"; the purposes are the ones listed below
Use & Processing · Company practice
Uses to provide services: orders, accounts, loyalty programs, gifts, debugging, app function and payments
Starbucks may process your information when you access or use the Starbucks Services to process or fulfill orders and transactions, maintain and service accounts, support and improve its loyalty programs such as Starbucks Rewards, deliver gift cards or e-gifts and any personalized messages in line with your instructions, debug and repair errors that impair existing functionality, make its websites and mobile applications work, and process payments.
Supporting quotations
We may process your information when you access or use the Starbucks Services, including to:
process or fulfill orders and transactions
maintain and service accounts
support and improve our loyalty programs, such as Starbucks® Rewards
deliver gift cards or e-gifts, and any associated personalized messages, in accordance with your instructions
debug to identify and repair errors that impair existing functionality
facilitate the functionality of our websites and mobile applications
process payments
Qualifications & exceptions
Worded "may process"
Gift delivery follows "your instructions"
Use & Processing · Company practice
Uses to communicate with you about accounts, orders, services and product safety
Starbucks may process information to communicate with you about your accounts, its services and your requests. That includes providing customer service (including through the website "live help" chat), communicating about orders, purchases, returns, services, accounts, programs, contests and sweepstakes, and providing important product safety information and notice of product recalls.
Supporting quotations
We may process certain information in order to communicate with you in relation to your accounts, our services, our marketing, and your requests
provide customer service, including when you interact with our customer service agents through our website’s “live help” chat feature, and requests for information
communicate with you about orders, purchases, returns, services, accounts, programs, contests, and sweepstakes
provide important product safety information and notice of product recalls
Qualifications & exceptions
Worded "may process"
Not stated here
The text of any product safety or recall notices Starbucks sends is not supplied here, so this card cannot say what they contain
Sharing & Disclosure · Company practice
Uses to send personalized promotions and marketing, including sharing with business partners so they can email you
Starbucks may use information to send you personalized promotions, content and special offers, and to communicate about its brands, products, events or other promotional purposes. It also lists, as a way of implementing your communications preferences, "sharing information with Starbucks business partners so that they may email you about their promotions, products and initiatives". So marketing use includes sharing information with business partners for their own emails, not only Starbucks' own messages.
Supporting quotations
send you personalized promotions, content, and special offers
communicate with you about our brands, products, events, or other promotional purposes
implement your communications preferences, such as sharing information with Starbucks business partners so that they may email you about their promotions, products and initiatives
Qualifications & exceptions
Worded "may"
The sharing with business partners is described as implementing your communications preferences, "such as" an example
Not stated here
The Notice does not say which of your preferences lead to sharing with business partners, or which partners
Use & Processing · Company practice
Uses for research, development and improvement, and for security, integrity and fraud detection
Starbucks may process personal information to maintain, improve and analyze its websites, mobile applications, ads and the products and services it offers. It may also process information to help ensure the security and integrity of the Starbucks Services, including to detect, prevent or investigate suspicious activity or fraud.
Supporting quotations
we may process certain personal information, including to:
maintain, improve, and analyze our websites, mobile applications, ads, and the products and services we offer
help to ensure security and integrity of the Starbucks Services, including to detect, prevent, or investigate suspicious activity or fraud
Qualifications & exceptions
Worded "may process"
Covers analysis of its ads as well as its websites, apps, products and services
Legal Rights & Agreement Rules · Company practice
Uses for legal reasons: legal claims, enforcing terms, safety, records and compliance
Starbucks may use your personal information to maintain a safe, secure and trusted environment. Examples given are obtaining legal advice or establishing, exercising or defending legal claims; enforcing its terms, policies and agreements with you or third parties; and protecting the safety, rights, welfare or property of Starbucks, you or others. It may also be required to process information under laws such as tax laws, to keep appropriate records for internal administrative purposes, to comply with legal and regulatory obligations and to respond to lawful governmental requests, as needed.
Supporting quotations
we may use your personal information, for example, in relation to obtaining legal advice or establishing, exercising, or defending legal claims; ensuring our terms, policies, and agreements with you or any third parties are enforced; and protecting the safety, rights, welfare, or property of Starbucks, you, or others
We may also be required to process certain information under certain laws and regulations, such as tax laws, as well as to maintain appropriate records for internal administrative purposes, to comply with applicable legal and regulatory obligations, and to respond to lawful governmental requests, as needed.
Qualifications & exceptions
Worded "may" and "for example"; the legal uses are examples
Required processing is limited to what laws and regulations require, "as needed"
Use & Processing · Company practice
Uses for targeted advertising, also called cross-contextual and online behavioral advertising
Starbucks may process your information to provide targeted advertising, which the Notice also calls cross-contextual advertising and online behavioral advertising, and offers and promotions you may be interested in. The Notice says you may have certain privacy rights over processing for targeted advertising and points to the "Your Privacy Choices & Rights" section for how to exercise them.
Supporting quotations
We may process your information to provide you with targeted advertising (also known as cross-contextual advertising and online behavioral advertising) and offers and promotions that you may be interested in.
You may have certain privacy rights with respect to the processing of your information for targeted advertising purposes.
Qualifications & exceptions
Rights are stated as "may have certain privacy rights"
Details of the choices are in section 13
Not stated here
This section does not say which categories of information are used for targeted advertising; section 5 and section 13(b) say more
Other business or commercial purposes at your direction or with your consent
Starbucks may process certain information for any other business or commercial purposes at your direction or with your consent.
Supporting quotations
We may process certain information in order to fulfill any other business or commercial purposes at your direction or with your consent.
Qualifications & exceptions
Applies to purposes at your direction or with your consent
Not stated here
The Notice does not say how consent is requested or recorded
Sharing & Disclosure · Company practice
Starbucks may disclose information to the third parties described, for the Notice's purposes and as the law permits
Starbucks says it may disclose information about you to the third parties described in this section, for the purposes outlined in the Notice and as permitted by applicable law. The recipients are affiliates and subsidiaries, service providers, business partners, advertising and analytics providers, parties to corporate transactions, authorities and others as legally required or permitted, people you direct it to share with, and the public where you post.
Supporting quotations
We may disclose information about you to the third parties described below for the purposes outlined in this Notice and as permitted by applicable law.
Qualifications & exceptions
Worded "may disclose"
Limited to "the purposes outlined in this Notice and as permitted by applicable law"
Sharing & Disclosure · Company practice
Sharing within Starbucks Corporation, its subsidiaries and affiliates
Starbucks may share information between and among Starbucks Corporation, its subsidiaries and its affiliates for management and analysis, decision making and other business purposes. Examples given are administering loyalty programs, processing orders and requests, and expanding and promoting its product and service offerings.
Supporting quotations
We may share information between and among Starbucks Corporation, its subsidiaries, and affiliates for purposes of management and analysis, decision making, and other business purposes.
we may share your information with our subsidiaries and affiliates to administer our loyalty programs, process orders and requests, and expand and promote our product and service offerings
Qualifications & exceptions
Worded "may share"
The purposes are open-ended ("other business purposes"); the examples are introduced by "for example"
Sharing & Disclosure · Company practice
Sharing every collected category with service providers for a wide range of business purposes
Starbucks may share each of the categories of information described in the "Information We Collect" section with service providers that perform services for it or on its behalf. The services listed include payment processing, website and data hosting, location mapping, product and service delivery, customer service, advertising and marketing services, running sweepstakes and Starbucks Rewards benefits and communications, compliance with industry standards, analytics, security and performance monitoring, maintaining accounts, professional advisors such as auditors and lawyers, fulfilling orders, verifying customer information, research, auditing and data processing. The list is long and broad, and the sentence says "each of the categories", so no collected category is carved out in this section.
Supporting quotations
We may share each of the categories of information described, in the “Information We Collect” section, for a variety of business purposes with our service providers who provide an array of services for us or on our behalf, such as payment processing, website and data hosting, location mapping, product and service delivery, customer service, advertising and marketing services, facilitating sweepstakes and Starbucks® Rewards loyalty program benefits and communication, ensuring compliance with industry standards, analytics services, security and performance monitoring, maintaining and servicing accounts, professional advisors (such as auditors and lawyers), processing or fulfilling orders and transactions, verifying customer information, research, auditing, and data processing.
Qualifications & exceptions
Worded "may share"
Applies to "each of the categories of information" in section 2, which includes the categories the Notice marks as potentially sensitive
Recipients are providers who serve Starbucks "or on our behalf"
Not stated here
This section does not say which providers receive which categories
Sharing & Disclosure · Company practice
Fraud protection suppliers, including Ekata, which acts as a controller under its own privacy notice
Starbucks may share your personal information with service providers that help protect you and Starbucks from fraud. It names Ekata, Inc. as one such supplier, and says Ekata uses the information as a controller for the benefit of Starbucks and others in accordance with its own privacy notice. The Notice therefore points to Ekata's own notice, not this one, as the stated basis for Ekata's use of the information.
Supporting quotations
We may share your personal information with service providers who help to protect you and Starbucks from fraud.
One such supplier is Ekata, Inc., which uses the information as a controller for the benefit of Starbucks and others in accordance with its privacy notice located at
Qualifications & exceptions
Worded "may share"
Ekata is described as using the information as a controller, for the benefit of Starbucks and others
Not stated here
Ekata's privacy notice is not supplied here, so this card cannot say what Ekata does with the information
Sharing & Disclosure · Company practice
Sharing with independent business partners, whose practices the Notice does not cover
To make certain products, services and experiences available, Starbucks works with independent business partners such as co-branded loyalty and rewards partners, delivery partners, and authorized distributors or licensees. When you obtain products or services from these partners, Starbucks may share your information with them, or you may give it to them directly. It may also share information with independent partners when they sponsor sweepstakes, contests, events and other promotions together. The Notice says it does not address, and is not responsible for, the privacy or other practices of these partners, and encourages you to read their privacy notices.
Supporting quotations
we work closely with independent business partners, including, for example, co-branded loyalty and rewards partners, delivery partners, and partners who are authorized distributors of our products or licensees
we may share your information with them, or you may provide it to them directly
We may also share your information with independent business partners when we work with them to sponsor sweepstakes, contests, events, and other promotions.
This Notice does not address, and we are not responsible for, the privacy, information, or other practices of these business partners.
Qualifications & exceptions
Worded "may share"
Sharing is described for partners whose products or services you obtain, and for jointly sponsored promotions
The Notice disclaims responsibility for the partners' own practices
Not stated here
The partners' privacy notices are not supplied here, so this card cannot say how those partners use information
Sharing & Disclosure · Company practice
Sharing every collected category with marketing, advertising and analytics providers
Starbucks may share each of the categories of information described in the "Information We Collect" section with marketing, advertising and analytics providers to deliver advertising to you on Starbucks' behalf. This includes counting ad impressions, creating ad audiences, and conducting personalized advertising based on your interactions with Starbucks services and on your activity on third-party services.
Supporting quotations
We may share each of the categories of information described above (in the “Information We Collect” section) with marketing, advertising and analytics providers to deliver advertising to you on behalf of Starbucks, including counting ad impressions, creating ad audiences, and conducting personalized advertising based on your interactions with our services as well as your activity on third-party services.
Qualifications & exceptions
Worded "may share"
Applies to "each of the categories of information" in section 2
Purposes named: counting impressions, creating audiences, personalized advertising across Starbucks and third-party services
Not stated here
Section 13(b) separately says that sharing certain identifiers, device activity information, transaction information and inferences with some advertising partners may be deemed a "sale" or "sharing" for targeted advertising, and gives an opt-out; this section does not mention that opt-out
Cross-references
contrast (model-proposed): Opt out of sale or sharing for targeted advertising: Cookie Preferences, preference signals, Do Not Sell or Share link — contrast: Section 5 says each category of collected information may be shared with advertising and analytics providers. Section 13(b) describes the sale or sharing that may be deemed "sale" or "sharing" for targeted advertising as involving certain identifiers, device activity information, transaction information and inferences, and offers an opt-out for that. The Notice does not say whether the opt-out reaches every category section 5 lists.
Sharing & Disclosure · Company practice
Sharing in a merger or transfer of business assets
If Starbucks becomes involved in a merger, corporate transaction or another situation involving the transfer of some or all of its business assets, it may share your information with the business entities or people involved in the negotiation or transfer.
Supporting quotations
If we become involved with a merger, corporate transaction or another situation involving the transfer of some or all of our business assets, we may share your information with business entities or people involved in the negotiation or transfer.
Qualifications & exceptions
Applies if Starbucks is involved in a merger, corporate transaction or transfer of business assets
Not stated here
The Notice does not say whether you would be told or could object
Legal Rights & Agreement Rules · Company practice
Disclosure to authorities and others if required by law, to enforce agreements, or to protect rights and safety
Starbucks may disclose your information to third parties, including government authorities, if it believes disclosure is required by law, necessary to enforce its agreements or policies, or will help protect the rights, property or safety of Starbucks or others, including customers and partners. Each trigger turns on what Starbucks believes.
Supporting quotations
We may disclose your information if we believe that the disclosure is required by law, if we believe that the disclosure is necessary to enforce our agreements or policies, or if we believe that the disclosure will help us protect the rights, property, safety of Starbucks or others, including our customers or partners.
Qualifications & exceptions
Worded "may disclose"
Triggers turn on what Starbucks "believes": required by law, necessary to enforce agreements or policies, or helpful to protect rights, property or safety
Not stated here
The Notice does not say whether you would be told of such a disclosure
Sharing & Disclosure · Permission or license
Sharing with others when you give permission or direct it, including gift card recipients
Starbucks may share information about you with other persons or companies if you give permission or direct it to, including with individuals to whom you send a gift card.
Supporting quotations
We may share information about you with other persons or companies if you give us permission or direct us to share the information, including to individuals to whom you send a gift card.
Qualifications & exceptions
Applies if you give permission or direct Starbucks to share
Sharing & Disclosure · Company practice
Content you share publicly may be seen by others, and Starbucks is not responsible for what you post
Starbucks displays content and information that you share publicly or permit or authorize it to share publicly, such as reviews. If you post information on a blog or another part of its websites, other visitors may see it. Starbucks says it is not responsible for the information you choose to submit in these public areas.
Supporting quotations
We display content and information that you share publicly or permit or authorize us to share publicly, such as reviews.
the information that you post may be seen by other visitors to our websites
We are not responsible for the information you choose to submit in these public areas.
Qualifications & exceptions
Applies to content you share publicly or permit Starbucks to share publicly
Starbucks disclaims responsibility for what you submit in public areas
Data Access & Collection · Company practice
Starbucks and others use cookies, pixels and similar technologies to collect device and usage information automatically
Starbucks says that it and others may use a variety of technologies to automatically collect information about your device and your use of the Starbucks Services, and about how you interact with emails, advertisements or other electronic messages it sends you. The technologies include first- and third-party cookies, web beacons, pixels, JavaScript, entity tags, HTML local storage and similar technologies. Because the Notice says "we and others", third parties may also use these technologies.
Supporting quotations
We and others may use a variety of technologies to automatically collect information about your device and use of Starbucks Services or when you interact with emails, advertisements, or other electronic messages we send to you through the Services, our websites and mobile applications.
These technologies include first- and third-party cookies, web beacons, pixels, JavaScript, entity tags, HTML local storage, and similar technologies.
Qualifications & exceptions
Worded "may use"
"We and others": third parties as well as Starbucks may use these technologies
Covers websites, mobile applications and emails or messages Starbucks sends
Not stated here
The Notice does not name the third parties that use these technologies
Use & Processing · Company practice
Three stated purposes: strictly necessary and functionality, analytics, and advertising
Starbucks lists three purposes for these technologies. Strictly necessary and functionality: some are needed to access and use the websites and apps and to display content and remember your preferences and log-in. Analytics: some help it analyze and measure site usage, testing and performance, such as estimating traffic. Advertising: some may be set by Starbucks or its advertising partners to tailor your experience on its website, in its apps or across your applications or devices by controlling the promotions, advertisements and marketing messages you see. Taken together, it may use this information to personalize your visit or send relevant promotions and advertisements.
Supporting quotations
Some of these technologies are necessary to allow you to access and use our websites or mobile applications and enable the various services and functionalities we offer, including displaying content and remembering your preferences and log-in.
Some of these technologies help us analyze and measure site usage, testing and performance, including by estimating traffic and assessing the volume of the use of services and functionality on websites and mobile applications.
Some of these technologies may be set by us or our advertising partners to tailor your experience on our website, within our mobile applications, or across your applications or devices by controlling the promotions, advertisements and other marketing messages that may appear when you access or use these or other digital properties.
We may use this information to personalize your visit to a website or use of a mobile application or to send you relevant promotions and advertisements.
Qualifications & exceptions
Each purpose is introduced by "some of these technologies"
Advertising technologies "may be set by us or our advertising partners", and can work across your applications or devices
Use & Processing · User right or choice
You can set your browser to accept or reject cookies and similar technologies, but you must take extra steps
Starbucks says most web browsers can be set to accept or reject some or all of these technologies, although you must take additional steps to disable or control them. You may be able to reject some or all of them through your browser settings, and many browsers let you choose before they are set or installed, or remove or reject them altogether. It points you to your browser's Help menu or instructions.
Supporting quotations
Most web browsers can be programmed to accept or reject the use of some or all of these technologies, although you must take additional steps to disable or control these technologies.
You may be able to reject some or all of these technologies by adjusting the appropriate settings in your browser.
Without these technologies, some of the services and functionality on our websites and mobile applications would not work properly.
Qualifications & exceptions
Worded "may be able to"; availability depends on your browser
Rejecting these technologies affects the Services: the Notice says that without strictly necessary technologies some services and functionality would not work properly
Use & Processing · User right or choice
On certain sites you may opt out of certain cookies through the Do Not Sell or Share link or Cookie Preferences
Starbucks says that on certain sites you may also be able to opt out of certain cookies by clicking the "Do Not Sell or Share My Personal Information" link on its website or by choosing in the Cookie Preferences link. For more on exercising your preferences, including how it processes opt-out preference signals, it points to the "Your Privacy Choices & Rights" section.
Supporting quotations
On certain sites, you may also be able to opt out of certain cookies by clicking the “Do Not Sell or Share My Personal Information” link on our website or making a selection using the Cookie Preferences link.
including how we process opt-out preference signals
Qualifications & exceptions
Available "on certain sites" and for "certain cookies"
Details and opt-out preference signals are covered in section 13
Use & Processing · User right or choice
Advertising-industry opt-out portals for interest-based advertising: DAA, DAA of Canada, NAI, EU and mobile apps
Starbucks notes that many advertising companies that collect information through cookies and similar technologies for interest-based advertising are members of the Digital Advertising Alliance (DAA) or the Network Advertising Initiative (NAI), which maintain opt-out websites for their members. It gives the DAA, DAA of Canada and NAI opt-out portals for website interest-based advertising by each organization's participating companies. Residents of the European Union may opt out of online behavioral advertising from the European Interactive Digital Advertising Alliance's participating members through its website, and the DAA's AppChoices app lets you opt out of interest-based advertising across mobile apps by participating companies.
Supporting quotations
Many advertising companies that collect information from cookies and similar technologies for interest-based advertising are members of the Digital Advertising Alliance (DAA) or the Network Advertising Initiative (NAI), both of which maintain websites where people can opt out of interest-based advertising from their members.
To opt-out of website interest-based advertising provided by each organization’s respective participating companies
Residents of the European Union may opt-out of online behavioral advertising served by the European Interactive Digital Advertising Alliance’s participating member organizations
To opt-out of data collection for interest-based advertising across mobile applications by participating companies, download the DAA’s App Choices mobile application opt-out offering
Qualifications & exceptions
Each opt-out applies only to the participating companies or members of that organization
Separate tools are given for websites, European Union residents and mobile apps
Not stated here
These opt-out portals are run by third-party organizations and are not supplied here; this card cannot say what they cover beyond what the Notice states
Security & Safeguards · Company commitment
Reasonable security measures, no guarantee of safety, and you protect your password and devices
Starbucks says it uses reasonable technical, physical and administrative security measures to reduce the risk of loss, misuse, unauthorized access, disclosure or modification of your information. It also says no security system is perfect and, because of the nature of the Internet, it cannot guarantee that data, including personal information, is absolutely safe from intrusion or unauthorized access by others. You are responsible for protecting your password(s) and maintaining the security of your devices and accounts.
Supporting quotations
Starbucks uses reasonable technical, physical, and administrative security measures to reduce the risk of loss, misuse, unauthorized access, disclosure or modification of your information.
we cannot guarantee that data, including personal information, is absolutely safe from intrusion or other unauthorized access by others
You are responsible for protecting your password(s) and maintaining the security of your devices and accounts.
Qualifications & exceptions
The commitment is to "reasonable" measures to "reduce the risk", not to prevent all incidents
Starbucks expressly does not guarantee absolute safety
Responsibility for passwords and device and account security is placed on you
Not stated here
The Notice does not describe the specific measures
Retention & Deletion · Company practice
Retention: kept as reasonably necessary, based on service needs and legal requirements; no fixed periods stated
Starbucks says it stores information as reasonably necessary and proportionate to accomplish the purposes identified in the Notice, based on criteria such as how long it needs the information to provide services to you and to meet legal requirements, including record retention, resolving disputes and enforcing its agreements. It says its retention of your information is governed by applicable law. The section gives criteria, not specific retention periods.
Supporting quotations
Starbucks stores information as reasonably necessary and proportionate to accomplish the purposes identified in this Notice based on criteria such as the length of time we need to provide the services to you, and to meet legal requirements, including record retention, resolving disputes, and enforcing our agreements.
Our retention of your information is governed by applicable law.
Qualifications & exceptions
Retention is "as reasonably necessary and proportionate" to the stated purposes
Criteria named: time needed to provide services, legal requirements, record retention, resolving disputes, enforcing agreements
Retention is described as governed by applicable law
Not stated here
No specific retention periods are given for any category of information; the EEA section (15(c)) refers to "our specified retention periods", but this section does not state any
Information is stored and processed in the United States, Canada or elsewhere, including outside your country
Starbucks says the personal information you provide is stored and processed on servers owned by Starbucks and other companies in the United States, Canada or elsewhere around the world, including outside the country or jurisdiction where you are located. Regardless of who processes it and where, Starbucks says it will take steps to transfer and protect your information through appropriate safeguards in line with applicable data protection laws and the Notice. EEA, U.K. and Swiss residents are pointed to section 15 for more.
Supporting quotations
The personal information that you provide us is stored and processed on servers owned by Starbucks and other companies in the United States, Canada or elsewhere around the world, including locations outside of the country or jurisdiction where you are located.
we will take steps to transfer and protect your information through appropriate safeguards in accordance with applicable data protection laws and this Notice
If you are a resident of the EEA, the U.K., and Switzerland, please find more information in “Additional Disclosures for Data Subjects in the EEA, the U.K., and Switzerland” below.
Qualifications & exceptions
Servers are owned by Starbucks "and other companies"
Safeguards are described as "appropriate safeguards in accordance with applicable data protection laws and this Notice"
EEA, U.K. and Switzerland: see section 15
Not stated here
The safeguards are not described in this section
Data Access & Collection · Company commitment
Not intended for children under 13 (or the local minimum age); Starbucks does not knowingly collect their information
Starbucks says it does not intend its websites or online services to be used by, and does not knowingly collect information from, anyone under 13 or under the relevant minimum age under applicable local law. If you are a parent or guardian and believe Starbucks may have collected your child's information, the Notice asks you to contact Starbucks immediately as described in "Contact Us". It also points to the Terms of Use for more.
Supporting quotations
We do not intend for our websites or online services to be used by, and do not knowingly collect information from, anyone under the age of 13, or the relevant minimum age under applicable local law.
If you are a parent or guardian and believe we may have collected information about your child, please contact us immediately as described in the “Contact Us” section of this Notice.
Qualifications & exceptions
Worded "do not knowingly collect": covers what Starbucks knows
The age threshold is 13, or the higher "relevant minimum age under applicable local law"
Not stated here
The Terms of Use are not supplied here, so this card cannot say what they add about children
Sharing & Disclosure · Company commitment
No knowing sale or sharing of under-18 customers' information for targeted advertising
Starbucks says it does not knowingly sell or share the information of its customers under the age of 18 for targeted advertising.
Supporting quotations
Additionally, we do not knowingly sell or share information of our customers under the age of 18 for targeted advertising.
Qualifications & exceptions
Worded "do not knowingly": limited to what Starbucks knows
Limited to "sell or share" for targeted advertising; the sentence does not address other uses of under-18 customers' information
Cross-references
narrows (model-proposed): Sharing every collected category with marketing, advertising and analytics providers — narrows: The general statement that each category may be shared with advertising and analytics providers is narrowed by the statement that Starbucks does not knowingly sell or share information of customers under 18 for targeted advertising.
Sharing & Disclosure · Company practice
Linked third-party sites and apps are governed by their own policies, not Starbucks
Starbucks' websites and apps may offer links to websites and apps run by third parties. Starbucks tells you to read the privacy notice, terms and conditions and other policies of any linked site you visit, says it is not responsible for third parties' policies and practices, and says information you give those organizations is governed by their own notices, terms and policies.
Supporting quotations
Our websites and mobile applications may offer links to websites and/or other mobile applications that are operated by third parties and not by Starbucks.
We are not responsible for the policies and practices of third parties.
Any information you give to those organizations is governed under their privacy notice, terms and conditions, and other policies.
Qualifications & exceptions
Applies to links to sites and apps operated by third parties, not by Starbucks
Starbucks disclaims responsibility for third parties' policies and practices
Not stated here
The third parties' policies are not supplied here, so this card cannot say what they provide
Legal Rights & Agreement Rules · Procedure
Starbucks WiFi: read the terms of use on the activation page before connecting
Many Starbucks stores offer WiFi at no charge. For that access, the Notice asks you to review carefully the terms of use on the activation page before accepting and connecting. The WiFi terms are separate from this Notice.
Supporting quotations
Many Starbucks stores support providing you access to wireless internet (WiFi) at no charge.
For any such WiFi access, please carefully review the terms of use listed on the activation page prior to accepting and connecting.
Qualifications & exceptions
Applies to stores that support WiFi
The terms are on the activation page, not in this Notice
Not stated here
The WiFi terms of use are not supplied here, so this card cannot say what data practices they describe
Data Access & Collection · User right or choice
Location services must be enabled to use mobile order and pay and location-based features, and you can turn them off
To use certain Starbucks Services, such as mobile order and pay (MOP) and location-based services, you must enable "location services" in the Starbucks App and/or set your mobile device permissions to allow that information to be communicated. For most devices you can stop geolocation collection by turning off location services on your device, and you can turn it back on at any time. Starbucks says certain app features and some Services may not work properly without location information, and suggests contacting your device provider or manufacturer if you have questions about preventing collection.
Supporting quotations
In order to use certain Starbucks Services, such as mobile order and pay (“MOP”) and location-based services and technology, you must (a) enable “location services” in the Starbucks App; and/or (b) set the permissions in your mobile device to allow communication of this information.
For most mobile devices, you can disable the collection of geolocation information by turning off location services on your device.
Certain Starbucks App features and some Starbucks Services may not work properly without information about your location.
if your Bluetooth is turned on and your device settings allow for this
Qualifications & exceptions
Enabling location is a condition of using MOP and location-based features
Collection can be stopped in device settings; some features then may not work properly
Applies to "most mobile devices"
Use & Processing · Company practice
If you allow location sharing, Starbucks may use it to customize your experience, measure marketing and tailor messages
If you allow location sharing, Starbucks says your device may communicate with it in ways that let it customize your experience in and around its stores, monitor the effectiveness of its marketing efforts, tailor messages based on your time and location patterns, and limit how many times you see a promotional message or offer. It adds that precise geolocation may be used to fulfill services and application functionality you choose to engage with, and that you can manage the use of that information in your device settings. These uses go beyond the services-only purposes listed with precise geolocation in section 2.
Supporting quotations
If you allow for location sharing, your device may communicate with us in ways that allow for us to customize your experience in and around Starbucks stores, to monitor the effectiveness of our marketing efforts, to tailor messages based on your time and location patterns, and to limit the number of times you see a promotional message or offer.
Precise geolocation may be used to fulfill services and application functionality you choose to engage with.
You can manage the use of that personal information at any time in your device settings.
for purposes of facilitating our services, such as to provide you with information about stores near you, to enable you to remotely order and pay for our products and services, or so that you may have certain Starbucks products delivered to you by a third-party vendor
Qualifications & exceptions
Applies "if you allow for location sharing"
Marketing uses named: measuring marketing effectiveness, tailoring messages by time and location patterns, capping promotional messages
Precise geolocation use for services is tied to features "you choose to engage with"
Managed through device settings
Not stated here
The Notice does not say whether the marketing uses apply to precise location or only to general location
Data Access & Collection · User right or choice
Voice ordering requires microphone and speech recognition permissions
To use certain Starbucks Services such as voice ordering, when available, you must enable "microphone" and "speech recognition" in the Starbucks App and/or set your mobile device permissions to allow that information to be communicated.
Supporting quotations
In order to use certain Starbucks Services, such as voice ordering, when available, you must (a) enable “microphone” and “speech recognition” in the Starbucks App; and/or (b) set the permissions in your mobile device to allow communication of this information.
Qualifications & exceptions
Voice ordering is available only "when available"
Enabling the permissions is a condition of using voice ordering
Use & Processing · User right or choice
Preferences for promotional emails, push notifications and inbox messages; promotional emails can be opted out of
The Starbucks App lets all customers set preferences for receiving promotional emails, push notifications on your device, and inbox messages. You may opt out of promotional emails at any time by adjusting your Starbucks online account settings or by clicking the "unsubscribe" link in any promotional email. If you opt out of promotional emails, Starbucks may still send communications about your orders, transactions and any accounts you have with it. Opting out of promotional emails does not turn off automated marketing text messages if you have opted in to them.
Supporting quotations
The Starbucks App allows all customers to set preferences for receiving promotional email communications from Starbucks, receiving push notifications on your device, and receiving inbox messages.
You may opt-out of receiving promotional emails at any time by adjusting your Starbucks online account settings or by clicking the “unsubscribe” link included within any promotional emails we send you.
If you opt-out of receiving promotional emails from us, we may still send communications to you about your orders and transactions, and any accounts you have with us.
Please note that when you opt-out of receiving promotional emails, you may still receive automated marketing text messages if you have opted-in to receiving them.
Qualifications & exceptions
Promotional emails can be stopped at any time through account settings or the unsubscribe link
Order, transaction and account communications may continue after you opt out of promotional emails
Automated marketing texts you opted into continue until you opt out of texts separately
Automated text messages need your consent and you can opt out by replying STOP, END, CANCEL, UNSUBSCRIBE or QUIT
In connection with certain Starbucks Services you may consent to receive automated text messages, including when you contact Customer Care or for marketing purposes. You may opt out of automated texts at any time by replying STOP, END, CANCEL, UNSUBSCRIBE or QUIT to any text you receive. Opting out of automated marketing texts does not stop promotional emails.
Supporting quotations
In connection with certain Starbucks Services you may consent to receiving automated text messages, including when you contact Customer Care or for marketing purposes.
You may opt-out of receiving automated text messages at any time by texting any of the following replies at the end of any text message you receive: STOP, END, CANCEL, UNSUBSCRIBE, or QUIT.
Please note that when you opt-out of receiving automated marketing text messages you may still receive promotional emails.
Qualifications & exceptions
Texts are sent based on your consent
Reply keywords: STOP, END, CANCEL, UNSUBSCRIBE or QUIT
Opting out of marketing texts does not stop promotional emails
Use & Processing · Permission or license
Using the app features described means you consent to Starbucks recording, processing and storing the information
Starbucks says that if you use the Starbucks App features described in this section (location, voice ordering, and messages), you consent to the transmission of your information to Starbucks and/or its agents, and authorize Starbucks and/or its agents to record, process and store that information as necessary to administer the app features and for the purposes described in the Notice. The authorization is tied to the purposes in the Notice as a whole, not only to the feature you used.
Supporting quotations
If you use the Starbucks App features described above, you consent to the transmission of your information to Starbucks and/or its agents, and authorize Starbucks and/or its agents, to record, process, and store such information as necessary for administering the Starbucks App features and for purposes described in this Notice.
Qualifications & exceptions
Triggered by using the described Starbucks App features
Covers Starbucks "and/or its agents"
Purposes are those "necessary for administering the Starbucks App features and for purposes described in this Notice"
Not stated here
The Notice does not say whether you can withdraw this consent other than by not using the features or changing device settings
Account & Service Control · Procedure
U.S. and Canada: you may submit rights requests, answered consistent with applicable law and its exceptions
Under the heading "Your Privacy Rights in the U.S. and Canada", Starbucks says you may submit a request to exercise the rights described. It will respond consistent with applicable law, including applicable exceptions. The rights are described with "may have", so which rights you have depends on the law that applies to you.
Supporting quotations
(b) Your Privacy Rights in the U.S. and Canada
You may submit a request to exercise the rights described below. We will respond to your request consistent with applicable law, including applicable exceptions.
Qualifications & exceptions
Section heading limits the rights to the U.S. and Canada
Response is "consistent with applicable law, including applicable exceptions"
Account & Service Control · User right or choice
Right to know and to receive a copy of your personal information, including a list of third parties
You may have the right to (1) know what personal information Starbucks processes about you, including the categories of information, the categories of sources, the business or commercial purposes for collecting, selling or sharing it, and the categories of third parties it may disclose it to, including a specific list of the third parties to whom Starbucks has disclosed its customers' personal information, and (2) receive a copy of the specific personal information Starbucks has processed or is processing about you.
Supporting quotations
You may have the right to (1) know what personal information Starbucks processes about you, including the categories of personal information, the categories of sources from which it is collected, the business or commercial purposes for collecting, selling, or sharing it, the categories of third parties to whom we may disclose it, including a specific list of third parties to whom we have disclosed our customers’ personal information; and (2) receive a copy of the specific personal information we have processed or are processing about you.
Qualifications & exceptions
Worded "may have the right"; depends on applicable law
Includes a "specific list of third parties" to whom customers' personal information has been disclosed
Retention & Deletion · User right or choice
Right to request deletion of information collected from you, subject to exceptions
You may have the right to ask Starbucks to delete information it collected from you and retained, subject to certain exceptions. The Notice does not list the exceptions in this section.
Supporting quotations
You may have the right to request that we delete information that we collected from you and retained, subject to certain exceptions.
Qualifications & exceptions
Worded "may have the right"
Applies to information collected from you and retained
Subject to "certain exceptions"
Not stated here
The exceptions to deletion are not listed in this section
Account & Service Control · User right or choice
Right to request correction, and self-service correction of some Rewards account information
You may have the right to ask Starbucks to correct inaccuracies in the personal information it maintains about you. You may also correct certain personal information associated with your Starbucks Rewards account yourself in the Starbucks App or by signing in at Starbucks.com.
Supporting quotations
You may have the right to request that we correct inaccuracies in the personal information we maintain about you.
You may also correct certain personal information associated with your Starbucks Rewards account yourself in the Starbucks App or by signing in at Starbucks.com.
Qualifications & exceptions
Worded "may have the right"
Self-service correction is limited to "certain personal information" tied to a Starbucks Rewards account
Sharing & Disclosure · User right or choice
Opt out of sale or sharing for targeted advertising: Cookie Preferences, preference signals, Do Not Sell or Share link
Starbucks says it does not sell your personal information for money, but sharing some information with some advertising partners (certain identifiers, internet or device activity information, transaction information, and inferences about your use of the Services) may be deemed a "sale" or "sharing" for targeted advertising under privacy laws. You may have the right to opt out. For sale or sharing that happens through cookies and similar technologies on its website, you use the Cookie Preferences link at the bottom of the website; you may need to repeat your selections on each device and browser, and again if you clear cookies or reset the browser. Starbucks says it will honor browser opt-out preference signals. For sale or sharing that does not happen through cookies or similar technologies on the website, you submit a request through the "Do Not Sell or Share My Personal Information" link.
Supporting quotations
Although we do not sell your personal information for money, our sharing of your personal information with some advertising partners (including certain identifiers, internet or other network or device activity information, transaction information, and inferences about your use of Starbucks Services) may be deemed a “sale” or “sharing” for targeted advertising purposes under applicable privacy laws.
You may have the right to opt-out of your personal information being sold or shared for purposes of targeted advertising.
You may exercise this right with respect to such selling or sharing that takes place via cookies and similar technologies on this website by managing your preferences using the Cookie Preferences link at the bottom of the website.
(You may need to repeat the Cookies Preference selections from each device and browser that you use in connection with Starbucks Services, as well as in a particular browser or device if you clear cookies or reset the browser.)
We will honor such opt-out preference signals.
To opt out of the sale or sharing of personal information for targeted advertising that does not take place via cookies or similar technologies on this website, please submit an opt-out request using the “Do Not Sell or Share My Personal Information” link.
Qualifications & exceptions
Worded "may have the right"; depends on applicable law
The Cookie Preferences route covers only sale or sharing "via cookies and similar technologies on this website", and must be repeated per device and browser
Starbucks says it will honor opt-out preference signals sent by a browser
The categories named here are a subset; section 5 says each category of information may be shared with advertising and analytics providers
Not stated here
The Notice does not say whether the opt-out covers every category of information section 5 lists for advertising and analytics providers
Use & Processing · Restriction or exception
Starbucks says it does not use sensitive information beyond what the law permits, so it offers no Limit link
Starbucks says it does not collect, process or disclose sensitive personal information for the purpose of inferring characteristics about you, or for any purpose other than when permitted under applicable law. For that reason it says it is not required to provide a "Limit the Use and Disclosure of My Sensitive Personal Information" link. The statement is bounded by "when permitted under applicable law", so it does not by itself list the purposes Starbucks uses sensitive information for.
Supporting quotations
We do not collect, process or disclose sensitive personal information for the purpose of inferring characteristics about you or for any purpose other than when permitted under applicable law.
As such, we are not required to provide a “Limit the Use and Disclosure of My Sensitive Personal Information” link.
Qualifications & exceptions
The exception is "any purpose other than when permitted under applicable law"
Starbucks gives this as its reason for not providing a Limit link
Not stated here
The Notice does not list which sensitive categories are used for which permitted purposes; section 2 lists precise geolocation, consumer health data and account login information as possibly sensitive
Account & Service Control · Procedure
You may appeal a decision on your request by contacting Starbucks
You may appeal Starbucks' decision about a request you submitted by contacting Starbucks as described in the "Contact Us" section.
Supporting quotations
You may appeal our decision with respect to a request you have submitted by contacting us as described in the “Contact Us” section below.
Qualifications & exceptions
Appeals go through the contact methods in section 17
Account & Service Control · User right or choice
Additional consumer health data rights in Washington and Nevada are described in a separate notice
You may have additional rights relating to consumer health data. The Notice refers you to a separate Consumer Health Data Privacy Notice for Washington and Nevada for more.
Supporting quotations
You may have additional rights relating to consumer health data.
Consumer Health Data Rights in Washington and Nevada
Qualifications & exceptions
Worded "may have additional rights"
Region: Washington and Nevada
Not stated here
The Consumer Health Data Privacy Notice for Washington and Nevada is not supplied here, so this card cannot say what those rights are
Account & Service Control · Procedure
How to submit a rights request: separate U.S. and Canadian web forms, or phone 1-800-STARBUC
Requests for U.S. residents are submitted through a web form, and requests for Canadian residents through a separate web form. U.S. and Canadian residents may also submit a request by calling 1-800-STARBUC (782-7282).
Supporting quotations
Requests for U.S. residents should be submitted through this form
Request for Canadian residents should be submitted through this form
U.S. and Canadian residents may also submit a request by calling 1-800-STARBUC (782-7282).
Qualifications & exceptions
Different forms for U.S. and Canadian residents
Phone requests are open to both U.S. and Canadian residents
Account & Service Control · Procedure
Starbucks may verify your identity, and authorized agents may be asked for written proof
Once Starbucks receives a request it may verify it by asking for information sufficient to confirm your identity. You may be entitled to submit a request through an authorized agent, or to appeal a refusal to act on your request. To designate an authorized agent, Starbucks may require written proof that the agent is authorized to act for you or a copy of the power-of-attorney document granting that right. Agents submit requests on behalf of a customer through a separate web form.
Supporting quotations
Once we receive your request, we may verify it by requesting information sufficient to confirm your identity.
You may be entitled to submit a request through an authorized agent or to appeal a refusal to take action on your request.
we may require written proof that the authorized agent has been authorized to act on your behalf or a copy of the power-of-attorney document granting that right
If you are an authorized agent or you are submitting a request on behalf of a customer, please submit your request through this form
Qualifications & exceptions
Verification is something Starbucks "may" require
Written proof or a power-of-attorney copy "may" be required for an authorized agent
Agents use a separate form
Account & Service Control · Company commitment
No discrimination for exercising rights; a request may be denied if identity is unverified or an exception applies
Starbucks says it will not discriminate against you for exercising any of your applicable rights. It reserves the right to deny your request if it cannot verify your identity or if an exception applies under applicable law.
Supporting quotations
We will not discriminate against you for exercising any of your applicable rights.
We reserve the right to deny your request if we cannot verify your identity or if an exception applies under applicable law.
Qualifications & exceptions
Non-discrimination applies to "applicable rights"
Starbucks reserves the right to deny a request if it cannot verify identity or an exception applies
Not stated here
The Notice does not list which exceptions may apply
Sharing & Disclosure · User right or choice
California residents: no disclosure to third parties for their direct marketing if you have opted out
If you are a California resident, Starbucks says it will not disclose your personal information to third parties for those third parties' direct marketing purposes, if you have exercised your option to prevent such disclosures. To make that request you use the "Do Not Sell or Share My Personal Information" link.
Supporting quotations
(c) Additional California Rights
If you are a California resident, we will not disclose your personal information to third parties for the third parties’ direct marketing purposes, if you have exercised your option to prevent such disclosures.
To request such option, please submit your request using the “Do Not Sell or Share My Personal Information” link.
Qualifications & exceptions
Region: California residents
Applies only "if you have exercised your option to prevent such disclosures"
Starbucks does not currently respond to browser Do Not Track signals
Some browsers send a "Do Not Track" header that says you do not want your activity tracked. Starbucks says it currently does not respond to those signals because there is no standard for how online services should respond, and says it may develop policies for responding as standards develop and describe them in the Notice. This is separate from the opt-out preference signals it says it will honor for sale or sharing.
Supporting quotations
We currently do not respond to browser “Do Not Track” signals, as there is no standard for how online services should respond to such signals.
As standards develop, we may develop policies for responding to do-not-track signals that we will describe in this Notice.
Qualifications & exceptions
Stated as "currently"; Starbucks may change this as standards develop
Separate from opt-out preference signals, which Starbucks says it will honor
Legal Rights & Agreement Rules · Context
Privacy metrics: U.S. and Canadian requests received from January 1 to December 31, 2025
The Notice reports metrics on rights requests received from customers in the United States and Canada during the applicable period, January 1, 2025 to December 31, 2025. The figures are for that period only and combine the two countries.
Supporting quotations
(d) Privacy Metrics
Applicable Period: January 1, 2025 – December 31, 2025
Scope: The below metrics reflect requests received from customers in the United States and Canada during the applicable period.
Qualifications & exceptions
Period: January 1, 2025 to December 31, 2025
Scope: customers in the United States and Canada combined
Not stated here
The metrics are not broken out by country or by law
Account & Service Control · Context
Right to Know requests: 718 received, 295 completed, 419 unable to be completed, 7 days on average
For the Right to Know, Starbucks reports 718 requests received, 295 completed and 419 unable to be completed, with an average completion time of 7 days. The "unable to be completed" row carries an asterisk that refers to a footnote after the metrics.
Supporting quotations
Right to Know
Requests Received – 718
Requests Completed – 295
Requests unable to be completed* – 419
Average completion time – 7 days
Qualifications & exceptions
Asterisk on "unable to be completed" refers to the footnote after the metrics list
Same period and U.S. and Canada scope as the other metrics
Not stated here
The completed and unable-to-complete figures add up to 714, four fewer than the 718 received; the Notice does not explain the difference
Account & Service Control · Context
Right to Delete requests: 4,180 received, 1,437 completed, 2,730 unable to be completed, 11 days on average
For the Right to Delete, Starbucks reports 4,180 requests received, 1,437 completed and 2,730 unable to be completed, with an average completion time of 11 days. The "unable to be completed" row carries an asterisk that refers to a footnote after the metrics.
Supporting quotations
Right to Delete
Requests Received – 4,180
Requests Completed – 1,437
Requests unable to be completed* – 2,730
Average completion time – 11 days
Qualifications & exceptions
Asterisk on "unable to be completed" refers to the footnote after the metrics list
Same period and U.S. and Canada scope as the other metrics
Not stated here
The completed and unable-to-complete figures add up to 4,167, thirteen fewer than the 4,180 received; the Notice does not explain the difference
Account & Service Control · Context
Right to Correct requests: 104 received, 72 completed, 32 unable to be completed, 7 days on average
For the Right to Correct, Starbucks reports 104 requests received, 72 completed and 32 unable to be completed, with an average completion time of 7 days. The "unable to be completed" row carries an asterisk that refers to a footnote after the metrics.
Supporting quotations
Right to Correct
Requests Received – 104
Requests Completed – 72
Requests unable to be completed* - 32
Average completion time – 7 days
Qualifications & exceptions
Asterisk on "unable to be completed" refers to the footnote after the metrics list
Same period and U.S. and Canada scope as the other metrics
Account & Service Control · Context
Opt-out of sale or sharing requests: 1,230,955 received and 1,230,955 completed
For the Right to Opt-Out of Sales or Sharing of Personal Information, Starbucks reports 1,230,955 requests received and 1,230,955 completed. The list under this heading shows no "unable to be completed" row. Its average completion time is listed in the next block.
Supporting quotations
Right to Opt-Out of Sales or Sharing of Personal Information
Requests Received – 1,230,955
Requests Completed – 1,230,955
Qualifications & exceptions
Same period and U.S. and Canada scope as the other metrics
Account & Service Control · Context
Opt-out of sale or sharing requests: average completion time 7 days
Under the Right to Opt-Out of Sales or Sharing of Personal Information, Starbucks lists an average completion time of 7 days. The figure is for requests received in the same January 1 to December 31, 2025 period from customers in the United States and Canada.
Supporting quotations
Requests Completed – 1,230,955
Average completion time – 7 days
Qualifications & exceptions
Same period and U.S. and Canada scope as the other metrics
Account & Service Control · Context
Metrics footnote: requests may be unable to be completed for reasons such as unverified identity, duplicates or no data
The asterisk on the "unable to be completed" rows refers to a footnote saying requests may be unable to be completed due to factors such as inability to verify the customer, duplicate requests, or no information being found. The reasons are examples ("such as"), not a complete list, and the Notice gives no counts by reason.
Supporting quotations
*Requests may be unable to be completed due to factors such as inability to verify the customer, duplicate requests, or no information is found.
Qualifications & exceptions
Reasons are introduced by "such as"; the list is not complete
Applies to the rows marked with an asterisk
Not stated here
The Notice does not say how many requests fall under each reason
Account & Service Control · Context
Starbucks Rewards is voluntary: members opt in and earn benefits through Stars or a number of purchases
Starbucks says Starbucks Rewards members opt in by signing up online or through the Starbucks App, and can earn benefits such as rewards and exclusive offers through accumulated "Stars" or after a certain number of purchases at participating stores. If you want to become a member, the Notice points to the Starbucks Rewards Terms of Use.
Supporting quotations
Starbucks® Rewards members opt in by signing up for Rewards online or through the Starbucks App and are able to earn certain benefits, such as rewards and exclusive offers through accumulated “Stars” or after you make a certain number of purchases, at participating Starbucks stores.
Qualifications & exceptions
Membership is by opt-in sign-up
Benefits are earned at participating Starbucks stores
Not stated here
The Starbucks Rewards Terms of Use are not supplied here, so this card cannot say what the program terms provide
Use & Processing · Company practice
Rewards uses the collected categories of information and works with licensees, affiliates, providers and partners
For the Starbucks Rewards loyalty program, Starbucks says it uses the categories of personal information described in the "Information We Collect" section, including information you provide, information collected automatically and information from other sources, to operate the program, including to send you promotions, content and special offers and for the other uses in the Notice. It says it works with many third parties to offer the program's benefits, falling into three categories: Starbucks licensees, subsidiaries and affiliates; service providers; and business partners, and points to the "How We Disclose Your Information" section. It also says it does not assign monetary value for the information collected through the program when sending email communications.
Supporting quotations
Starbucks collects and uses the categories of personal information described in the “Information We Collect” section, including information you voluntarily provide us (such as your name and email), information we collect automatically, and information from other sources to operate the Starbucks® Rewards loyalty program, including to send you promotions, content, and special offers and the other uses described in this Notice.
We work with many third parties to offer the benefits of our Starbucks® Rewards loyalty program. Those partners may fall into the following categories: Starbucks licensees, subsidiaries, and affiliates; service providers; and business partners.
Starbucks does not assign monetary value for the information we collect through the Starbucks® Rewards loyalty program when sending email communications.
Qualifications & exceptions
Uses "the other uses described in this Notice" are included, so the program use is not limited to loyalty benefits
Partners are described by category, not named
Not stated here
The statement that no monetary value is assigned is limited to information collected through the program "when sending email communications"; the Notice does not address other uses
Account & Service Control · User right or choice
Rewards is voluntary: you can opt out of promotional emails or withdraw, but withdrawing loses points and rewards
You may opt out of promotional emails at any time through your Starbucks online account settings or the unsubscribe link. Participation in Starbucks Rewards is voluntary and you may withdraw by visiting the Account section in the Starbucks App, by requesting deletion of your information through the deletion form, or by calling Starbucks customer service. If you withdraw, you no longer have access to your Rewards account but can otherwise keep using the app, and all points and rewards you earned up to withdrawal are no longer available. Starbucks says it needs your personal information to provide Rewards services, so if you delete your personal information from the program it can no longer provide services through it.
Supporting quotations
You may opt out of receiving promotional emails at any time by adjusting your Starbucks online account settings, or by clicking the “unsubscribe” link included within any promotional emails we send you.
Participation in Starbucks® Rewards is voluntary, and you may withdraw from the Starbucks® Rewards loyalty program by visiting the Account section in the Starbucks App, by requesting deletion of your information by filling out this form
Please note that by withdrawing from Starbucks® Rewards, you will no longer have access to your Starbucks® Rewards account, but you can otherwise continue to use the Starbucks app. All points and rewards you have earned until the time of withdrawal will no longer be available.
if you choose to delete your personal information from the Starbucks® Rewards loyalty program, we can no longer provide you with services through this loyalty program
Qualifications & exceptions
Withdrawal ends access to the Rewards account
Earned points and rewards are not available after withdrawal
Deleting your information from the program ends services through it
Charges & Financial Obligations · Company practice
Starbucks says it receives value from Rewards in increased customer loyalty and patronage, varying by member
Based on its reasonable and good faith estimate, Starbucks says it receives value from Starbucks Rewards in increased customer loyalty and patronage. It says any value varies by member depending on the purchases made, which offers a member takes up, and many other factors. The Notice gives no dollar figure or method.
Supporting quotations
Based on our reasonable and good faith estimate, we receive value from Starbucks® Rewards in increased customer loyalty and patronage, though any value will vary by Starbucks® Rewards member depending on purchases made, which offers a member takes advantage of, and many other factors.
Qualifications & exceptions
Stated as a "reasonable and good faith estimate"
Value varies by member
The value is described as loyalty and patronage, not a stated amount
Not stated here
No monetary value or calculation method is given
Legal Rights & Agreement Rules · Context
EEA, U.K. and Switzerland section: GDPR-based disclosures that do not replace an EEA affiliate's own policy
Section 15 gives general information about how Starbucks collects, stores, uses, transfers and otherwise processes personal data in or from certain countries in the European Economic Area, the United Kingdom and Switzerland (together called "EEA" in this section), in accordance with the GDPR and its local implementations. It says the section does not supersede the privacy policy on the website of an EEA-based Starbucks affiliate you have engaged with, because that entity would be the data controller for your data and the one to which your data subject rights requests should be directed. The Notice's scope statement in the introduction refers to personal information processed in North America.
Supporting quotations
15. Additional Disclosures for Data Subjects in the EEA, the U.K., and Switzerland
This section provides general information about how Starbucks collects, stores, uses, transfers and otherwise processes personal data in or from certain countries in the European Economic Area, the United Kingdom, and Switzerland (together, for purposes of this section of this Notice, “EEA”), in accordance with the General Data Protection Regulation (GDPR) and its local implementations.
This section does not supersede the applicability of any privacy policy found on the website of an EEA-based Starbucks affiliate with whom you have engaged, as that entity would be the data controller with respect to your personal data and the entity to which your data subject rights requests should be directed.
Qualifications & exceptions
Applies to personal data in or from "certain countries" in the EEA, U.K. and Switzerland, not all countries
Does not supersede an EEA-based affiliate's own privacy policy
An EEA-based affiliate you engaged with is described as the data controller and the recipient of rights requests
Not stated here
The Notice does not say which countries or which Starbucks affiliates are covered
The introduction says the Notice applies to information processed in North America; this section covers EEA, U.K. and Swiss data, and the Notice does not explain how the two fit together
Use & Processing · Company practice
EEA lawful bases: Starbucks must have a lawful basis whenever it acts as a data controller
Where a Starbucks entity acts as a data controller that determines the purposes and means of processing, such as when it collects, uses and shares personal data as described in the Notice, it says it must have a lawful basis for the processing. The bases it lists are performing a contract, its legitimate business purposes, complying with legal obligations, and your consent.
Supporting quotations
Where a Starbucks entity is acting as a data controller that determines the purposes and means of processing your personal data, such as when we collect, use, and share personal data as described in this Notice, we must have a lawful basis for processing for doing so.
Our lawful bases for processing personal data include:
Qualifications & exceptions
Applies where a Starbucks entity "is acting as a data controller"
Bases listed with the word "include", so the list may not be complete
Use & Processing · Company practice
EEA basis: performing a contract with you, such as purchases, gift card delivery and order communications
One lawful basis is to conclude or perform a contract with you, for example to process your purchases of or requests for products and services, including delivering gift cards in accordance with your instructions, and to communicate with you about orders, purchases, returns, services, accounts, programs, contests and sweepstakes. The item is split across several blocks in the extracted text, but reads as one list.
Supporting quotations
to conclude or perform a contract with you, for example to:
process your purchases of or requests for products and services, including delivering
gift cards in accordance with your instructions;
communicate with you about orders, purchases, returns, services, accounts, programs,
contests, and sweepstakes;
Qualifications & exceptions
Examples are introduced by "for example"
Gift card delivery follows your instructions
Use & Processing · Company practice
EEA basis: legitimate business purposes such as customer service, improving services, fraud and security, app function
Another lawful basis is Starbucks' legitimate business purposes, including to respond to customer service inquiries and requests for information; maintain, improve and analyze its websites, mobile applications, ads and the products and services it offers; detect, prevent or investigate security breaches or fraud; and facilitate the functionality of its websites and mobile applications. The list is introduced by "including", so it gives examples. The items are split across several blocks in the extracted text.
Supporting quotations
for our legitimate business purposes, including to:
respond to your customer service inquiries and requests for information;
maintain, improve, and analyze our websites, mobile applications, ads, and the
products and services we offer;
detect, prevent, or investigate security breaches or fraud; and
facilitate the functionality of our websites and mobile applications;
Qualifications & exceptions
Introduced by "including", so examples rather than a closed list
Not stated here
The Notice does not describe any balancing test or how you can object beyond the rights listed below
Legal Rights & Agreement Rules · Company practice
EEA basis: complying with legal obligations, including records and product safety notices
Another lawful basis is to comply with Starbucks' legal obligations, for example to maintain appropriate records for internal administrative purposes and as required by applicable law, and to provide important product safety information and notice of product recalls.
Supporting quotations
to comply with our legal obligations, for example to maintain appropriate records for internal administrative purposes and as required by applicable law, and provide important product safety information and notice of product recalls
Qualifications & exceptions
Examples are introduced by "for example"
Not stated here
The text of any product safety or recall notices Starbucks sends is not supplied here, so this card cannot say what they contain
Use & Processing · User right or choice
EEA basis: your consent for promotional email and other electronic messages, which you can withdraw at any time
The last lawful basis is your consent, for example to send you personalized promotions and special offers by email and other electronic means, or to tell you about its brands, products, events or other promotional purposes. You can withdraw consent at any time by changing your promotional preferences in your Starbucks App account online, or by contacting Starbucks as described in "Contact Us".
Supporting quotations
on the basis of your consent, for example to send you via email and other electronic means personalized promotions and special offers or informing you about our brands, products, events, or other promotional purposes.
You can withdraw your consent at any time by modifying your promotional preferences in your Starbucks App account online, or by contacting us as described in the “Contact Us” section below.
Qualifications & exceptions
Consent covers electronic promotional messages in this example
Withdrawal is available "at any time" through promotional preferences or by contacting Starbucks
Account & Service Control · User right or choice
EEA data subject rights: access, correction, erasure, objection, restriction and transfer
Under certain circumstances, and by law, the Notice says you have the right to request access to your personal information (a data subject access request, which gives you a copy), request correction, request erasure where there is no good reason for Starbucks to keep processing it, object to processing based on a legitimate interest or for direct marketing, request restriction of processing, and request transfer of your information to another party when possible.
Supporting quotations
(b) Your EEA Data Subject Rights – Under certain circumstances, by law you have the right to:
Request access to your personal information
Request correction of the personal information that we hold about you.
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it.
Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party), or where we are processing your personal information for direct marketing purposes.
Request the restriction of processing of your personal information.
Request the transfer of your personal information to another party, when possible.
Qualifications & exceptions
Rights apply "under certain circumstances"
Objection applies where Starbucks relies on legitimate interest or processes for direct marketing
Transfer is available "when possible"
Use & Processing · User right or choice
EEA: right not to be subject to legal or significant automated decisions, which Starbucks says it does not make
The listed EEA rights include the right not to be subject to automated decision-making that produces legal or significant effects on an individual. Starbucks adds that it does not engage in such decision-making.
Supporting quotations
Not be subject to automated decision-making producing legal or significant effects on an individual, which we do not engage in.
Qualifications & exceptions
The statement that Starbucks does not engage in this applies to automated decision-making producing legal or significant effects
Account & Service Control · Procedure
EEA rights requests: identity verified, answer within 30 days of receipt
To exercise these rights, the Notice points you to the "Your Privacy Choices & Rights" section or to the "Contact Us" section, and asks you to say which GDPR right or rights you want to exercise. Starbucks says it must verify your identity to honor a request, and that it will respond within 30 days of receipt.
Supporting quotations
To exercise any of these rights, please see the “Your Privacy Choices & Rights” section, or contact us as set forth in the “Contact Us” section below and specify which GDPR privacy right(s) you wish to exercise.
We must verify your identity in order to honor your request, which we will respond to within 30 days of receipt.
Qualifications & exceptions
Starbucks must verify identity before honoring a request
Response is promised within 30 days of receipt
Not stated here
Section 13 forms and contact details are written for U.S. and Canadian requests; the Notice does not say which route EEA requests use beyond "Contact Us"
Retention & Deletion · Company practice
EEA retention: kept only as long as needed or required, and longer to honor requests or meet legal duties
For the EEA, Starbucks says that, as a general rule, it keeps data only as long as needed to complete the purpose for which it was collected or as required by law. It may need to keep data longer than its "specified retention periods" to honor your requests, including to keep you opted out of marketing emails, or to comply with legal, regulatory, accounting or other obligations.
Supporting quotations
as a general rule, we keep your data for only as long as it is needed to complete the purpose for which it was collected or as required by law
We may need to keep your data for longer than our specified retention periods to honor your requests, including to continue keeping you opted out of marketing emails, or to comply with legal, regulatory, accounting or other obligations.
Qualifications & exceptions
Stated as a "general rule" with exceptions for honoring requests and legal duties
Not stated here
The section refers to "specified retention periods", but the Retention section (8) does not state specific periods
Use & Processing · Company practice
EEA transfers: data may be moved to and processed in the United States and elsewhere, with protection steps
Your personal information may be transferred to, stored and processed in a country other than the one in which it was collected, including the United States. It may also be processed by staff outside the EEA who work for Starbucks or its third-party service providers. In those cases Starbucks says it will take appropriate steps to ensure an adequate level of data protection for the recipient as required under the GDPR and as described in the Notice.
Supporting quotations
Your personal information may be transferred to, stored, and processed in a country other than the one in which it was collected, including the United States.
It may also be processed by staff operating outside the EEA who work for Starbucks or for our third-party service providers.
we will take appropriate steps to ensure an adequate level of data protection of the recipient as required under the GDPR and as described in this Notice
stored and processed on servers owned by Starbucks and other companies in the United States, Canada or elsewhere around the world
Qualifications & exceptions
Transfers include the United States and processing by staff of Starbucks and its service providers outside the EEA
Safeguards are described only as "appropriate steps to ensure an adequate level of data protection"
Not stated here
The specific transfer mechanisms are not described in this section; section 16 describes participation in the Data Privacy Framework
Legal Rights & Agreement Rules · User right or choice
EEA complaints: a supervisory authority, a dispute resolution provider, or the Data Protection Officer
If you have issues with Starbucks' compliance, you have the right to lodge a complaint with an EEA supervisory authority. Starbucks says it would appreciate the chance to address your concerns first, and welcomes an inquiry to it under "Contact Us" or to its U.S.-based third-party dispute resolution provider, free of charge. You may also contact its Data Protection Officer at any time at the privacy@starbucks.com address given.
Supporting quotations
you have the right to lodge a complaint with an EEA supervisory authority
We would, however, appreciate the opportunity to first address your concerns and would welcome you directing an inquiry first to us per the “Contact Us” section below, or to our U.S.-based third-party dispute resolution provider (free of charge)
You may also contact our Data Protection Officer (“DPO”) at any time
Qualifications & exceptions
The right to complain to an EEA supervisory authority is stated without condition
Contacting Starbucks first is requested, not required
Not stated here
The dispute resolution provider's procedures are not supplied here
Legal Rights & Agreement Rules · Company commitment
Data Privacy Framework: Starbucks Corporation states it complies; the Principles govern in a conflict
Starbucks Corporation says it complies with the EU-U.S. Data Privacy Framework, the UK Extension to it and the Swiss-U.S. Data Privacy Framework, as set by the U.S. Department of Commerce. It says it has certified to the Department of Commerce that it adheres to the Principles for personal data received from the European Union and the United Kingdom (and Gibraltar), and from Switzerland, in reliance on those frameworks. If there is any conflict between the Notice and the Principles, the Principles govern. The Notice points to the official Data Privacy Framework website to learn more and view the certification.
Supporting quotations
Starbucks Corporation complies with in the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.
Starbucks Corporation has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) under the UK Extension to the EU-U.S. DPF.
Starbucks Corporation has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.
If there is any conflict between the terms in this Privacy Notice and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.
Qualifications & exceptions
Statements are made by Starbucks Corporation, not every Starbucks entity
Applies to personal data received from the EU, the U.K. (and Gibraltar) and Switzerland in reliance on the frameworks
The Principles prevail over the Notice in a conflict
Not stated here
The Data Privacy Framework website and certification are not supplied here, so this card cannot say what the Principles require or what the certification covers
Sharing & Disclosure · Company commitment
Framework onward transfers: Starbucks stays liable for its agents unless it proves it is not responsible
For onward transfers of personal data from the EU, the U.K. and Switzerland, Starbucks Corporation says it complies with the Data Privacy Framework Principles, including the onward transfer liability provisions. It says it is accountable for personal data it receives under the frameworks and then transfers to a third party acting as its agent. It remains liable under the Principles if that agent processes personal information in a way inconsistent with them, unless Starbucks Corporation proves it is not responsible for the event giving rise to damage.
Supporting quotations
Starbucks Corporation is accountable for the processing of personal data it receives
subsequently transfers to a third party acting as an agent on its behalf
unless Starbucks Corporation proves that it is not responsible for the event giving rise to damage
Starbucks Corporation complies with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF Principles for all onward transfers of personal data from the EU, the UK, and Switzerland, including the onward transfer liability provisions.
Qualifications & exceptions
Applies to onward transfers to third parties acting as agents on Starbucks' behalf
Liability is subject to Starbucks Corporation proving it is not responsible for the event giving rise to damage
Not stated here
The Principles themselves are not supplied here
Legal Rights & Agreement Rules · Context
Data Privacy Framework: FTC oversight, and disclosure to public authorities for national security or law enforcement
Starbucks says the Federal Trade Commission has jurisdiction over Starbucks Corporation for compliance with the Data Privacy Framework programs. It also says that in certain situations Starbucks Corporation may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
Supporting quotations
The Federal Trade Commission has jurisdiction over Starbucks Corporation for’ compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
In certain situations, Starbucks Corporation may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
Qualifications & exceptions
Disclosure applies "in certain situations" and to "lawful requests by public authorities"
National security and law enforcement requirements are named examples
Legal Rights & Agreement Rules · User right or choice
Data Privacy Framework complaints: contact Starbucks first, then other mechanisms, and possibly binding arbitration
Starbucks Corporation commits to resolve complaints about its collection and use of your personal information under the Data Privacy Framework Principles. EU, U.K. and Swiss individuals with inquiries or complaints about personal data received in reliance on the frameworks should first contact Starbucks Corporation at privacy@starbucks.com. For complaints not resolved by any other framework mechanism, you have the possibility, under certain conditions, to invoke binding arbitration, and the Notice points to the official framework website for further information.
Supporting quotations
Starbucks Corporation commits to resolve DPF Principles-related complaints about our collection and use of your personal information.
EU and UK and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first contact Starbucks Corporation at
For complaints regarding EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF compliance not resolved by any of the other DPF mechanisms, you have the possibility, under certain conditions, to invoke binding arbitration.
Qualifications & exceptions
The first step is to contact Starbucks Corporation
Binding arbitration is available only "under certain conditions" and for complaints not resolved by other mechanisms
Not stated here
The official Data Privacy Framework website is not supplied here, so this card cannot say what the arbitration conditions are
Legal Rights & Agreement Rules · Procedure
Contact: Customer Service online, phone or post; Global Privacy Department and Data Protection Officer by email
For questions, comments and concerns about privacy, you can contact Starbucks Customer Service online, by phone at 800-782-7282, or by postal mail at Starbucks Customer Service, Starbucks, P.O. Box 549, Fort Smith, AR 72902. You may reach the Global Privacy Department and the Data Protection Officer by email at privacy@starbucks.com. Additional contact information for various Starbucks entities is listed afterwards.
Supporting quotations
We welcome your questions, comments and concerns about privacy.
You can contact Starbucks Customer Service online at
by postal mail at: Starbucks Customer Service, Starbucks, P.O. Box 549, Fort Smith, AR 72902
You may reach our Global Privacy Department and our Data Protection Officer at
Additional contact information may be found below for various Starbucks entities.
Qualifications & exceptions
The same email address reaches the Global Privacy Department and the Data Protection Officer
For Canada, the Notice lists the entity Starbucks Corporation (Canada) at P.O. Box 20430, Augusta, GA 30916 USA, with Customer Service at 800-STARBUC (782-7282) as additional contact.
Supporting quotations
Country – Canada
Entity Name – Starbucks Corporation (Canada)
Entity Address – P.O. Box 20430, Augusta, GA 30916 USA
Additional Contact (If Any) –
Customer Service
800-Starbuc (782-7282)
Qualifications & exceptions
Region: Canada
The listed entity address is in the United States
Legal Rights & Agreement Rules · Procedure
U.S. entity contact: Starbucks Reserve and Princi, P.O. Box 20430, Augusta, GA, customer service online or 800-STARBUC
For the U.S., the Notice lists the entities Starbucks Reserve and Princi at Starbucks, P.O. Box 20430, Augusta, GA 30916, with Customer Service available at the customer service website or at 800-STARBUC (782-7282).
Supporting quotations
Country – U.S.
Entity Name – Starbucks Reserve; Princi
Entity Address – Starbucks, P.O. Box 20430, Augusta, GA 30916
U.K. contact: Starbucks Coffee Company (UK) Limited, Chiswick Park, London, with Customer Care online or by phone
For the U.K., the Notice lists the entity Starbucks Coffee Company (UK) Limited at Building 4 Chiswick Park, 566 Chiswick High Road, London, W4 5YE. Additional contact is Customer Support through the U.K. Customer Care team online, or by phone at +443330050449 or +442088345050 (app).
Supporting quotations
Country – U.K.
Entity Name – Starbucks Coffee Company (UK) Limited
Entity Address – Building 4 Chiswick Park, 566 Chiswick High Road, London, W4 5YE