This California Privacy Notice gives information to California residents whose personal information is processed under the California Consumer Privacy Act (CCPA). It says it applies to personal information collected from California residents who have a business relationship with American Express, and also from individuals who are prospective customers. It defines personal information as information that identifies or could reasonably be linked with a particular individual or household, and says that definition leaves out information that is publicly available or has been de-identified or aggregated. The notice says it describes the categories of personal information collected, the purposes of collection, a summary of rights and how to exercise them. It also points readers to its "Your CA Privacy Rights" section if the notice applies to their relationship with American Express.
Details
Who
American Express
Where
California residents
What it covers
personal information processed under the CCPA
When
Effective February 19, 2026
Condition
Business relationship with American Express, or prospective customer
Supporting quotations
California Privacy Notice
Effective Date: February 19, 2026
This California Privacy Notice (the “CA Privacy Notice”) provides information to California residents whose personal information is processed pursuant to the California Consumer Privacy Act (“CCPA”).
It applies to personal information collected from CA residents (“you” or “your”) who have a business relationship with American Express (“we” or “us”), as well as individuals who are prospective customers.
Personal information is information that identifies or could reasonably be linked with a particular individual or household; it does not include information that is publicly available or has been de-identified or aggregated.
If this CA Privacy Notice applies to your relationship with us, please see the section below titled “Your CA Privacy Rights” to learn more about the rights you may have under California law.
Qualifications & exceptions
Coverage is limited by the exclusions in the next card: information protected under the Gramm-Leach-Bliley Act and job applicant or employee information are outside this notice.
The notice is stated to be effective February 19, 2026; it does not say it replaces an earlier version or announce a successor.
Not stated here
The notice does not define "business relationship" beyond this sentence, and does not list which American Express products or services create one.
Cross-references
narrowed by (model-proposed): What this notice does not cover — The exclusions narrow the coverage described in the scope card: the notice says a person using a product primarily for personal, family or household purposes would not be covered, even though it also says it applies to people with a business relationship and prospective customers.
Legal Rights & Agreement Rules · Restriction or exception
What this notice does not cover
The notice does not apply to personal information protected under the Gramm-Leach-Bliley Act (GLBA), a federal financial privacy law; the notice says that information is dealt with in American Express's U.S. Consumer Privacy Notice. It also does not apply to personal information about job applicants or employees, which it says is governed by the U.S. Online Recruitment Privacy Statement. The notice gives an example: someone using an American Express product or service primarily for personal, family or household purposes, or who has applied for a job at American Express, would not be covered by this notice. The rights section later repeats that its rights do not apply to individuals whose personal information is protected under the GLBA.
Details
Exception
Personal information protected under the Gramm-Leach-Bliley Act
Exception
Job applicant and employee personal information
Exception
Product or service used primarily for personal, family or household purposes
Who
American Express
Supporting quotations
This CA Privacy Notice does not apply to personal information that is protected under the Gramm-Leach-Bliley Act, a federal financial privacy law, as set out in our U.S. Consumer Privacy Notice.
It also does not apply to personal information relating to job applicants or employees as governed by our U.S. Online Recruitment Privacy Statement.
For example, if you are using our product or service primarily for personal, family or household purposes or you have applied for a job at American Express, you would not be covered by this CA Privacy Notice.
As outlined above, these rights do not apply to individuals whose personal information is protected under the Gramm-Leach-Bliley Act, as described in our U.S. Consumer Privacy Notice.
Qualifications & exceptions
The personal, family or household example is given by the notice itself as an illustration of who would not be covered; the notice does not list every kind of person or data that falls outside it.
Not stated here
The notice does not explain how its statement that personal, family or household users are not covered fits with the earlier statement that it applies to people with a business relationship and to prospective customers, so the notice does not make clear which individuals it reaches.
The U.S. Consumer Privacy Notice and the U.S. Online Recruitment Privacy Statement are named but not supplied in this document.
Cross-references
narrows (model-proposed): Who this notice is for — The exclusions narrow the coverage described in the scope card: the notice says a person using a product primarily for personal, family or household purposes would not be covered, even though it also says it applies to people with a business relationship and prospective customers.
Affiliates and non-American Express sites may have their own notices
The notice says American Express's affiliates, and its web properties that are not branded as American Express, may provide their own privacy notice to California residents. It tells readers to check those websites to understand their privacy practices, which means this notice should not be read as describing those affiliates or properties.
Details
Who
American Express affiliates and non-American Express-branded web properties
What it does
may provide their own privacy notice
Where
California residents
Supporting quotations
Our affiliates (and our web properties that are not branded as American Express) may provide their own privacy notice to CA residents. Please check their websites to better understand their privacy practices.
Not stated here
The notice does not name the affiliates or web properties that have their own notices.
Legal Rights & Agreement Rules · User right or choice
Who has the California privacy rights
The notice tells California residents they may have certain rights over their personal information under the CCPA. It says those rights do not apply to individuals whose personal information is protected under the Gramm-Leach-Bliley Act, as described in the U.S. Consumer Privacy Notice, and that exclusion matches the notice's earlier statement of what it does not cover.
Details
Who
California residents
What it covers
Rights over personal information under the CCPA
Exception
Individuals whose personal information is protected under the Gramm-Leach-Bliley Act
Where
California
Supporting quotations
Your CA Privacy Rights
As a California resident, you may have certain rights over the personal information we have about you pursuant to the CCPA.
these rights do not apply to individuals whose personal information is protected under the Gramm-Leach-Bliley Act, as described in our U.S. Consumer Privacy Notice.
This CA Privacy Notice does not apply to personal information that is protected under the Gramm-Leach-Bliley Act, a federal financial privacy law, as set out in our U.S. Consumer Privacy Notice.
Qualifications & exceptions
The wording is "may have" rights, and the rights are subject to the limitations described in the limitations card.
Not stated here
The U.S. Consumer Privacy Notice is named but not supplied, so which personal information it treats as protected under the Gramm-Leach-Bliley Act is not stated here.
Legal Rights & Agreement Rules · Restriction or exception
Limits on these rights
The notice says these rights are subject to limitations, and gives one example: when American Express is retaining personal information to comply with its own legal obligations.
Details
Who
American Express
Exception
Retaining personal information to comply with its own legal obligations
Supporting quotations
In addition, these rights are subject to limitations, such as when we are retaining personal information to comply with our own legal obligations.
Qualifications & exceptions
The legal-obligations case is given as an example ("such as"), so other limitations may exist.
Not stated here
The notice does not list the other limitations.
Cross-references
qualifies (model-proposed): Rights to access, delete and correct personal information — The rights to access, delete and correct are subject to limitations, such as retaining personal information to comply with legal obligations.