California Privacy Notice

Sharing & Disclosure · Company practice

Sharing for cross-context behavioral advertising

The notice says American Express may share information about your internet activity and other personal information with third parties to serve "cross-context behavioral advertising", which it describes as advertisements targeted to your interests based on inferences from your browsing across other sites. It points readers to the opt-out instructions in the "How to Exercise Your CA Privacy Rights" section.

Supporting quotations

How We Share Your Personal Information

However, we may share information about your Internet activity and other personal information with third parties to serve “cross-context behavioral advertising,” i.e., advertisements that are targeted to your interests based on inferences made from your browsing activities across other sites.

For more information about how you can opt-out of the sharing of your personal information for cross-context behavioral advertising, please see the “How to Exercise Your CA Privacy Rights” section, below.

Qualifications & exceptions

• The wording is "may share"; the notice does not say that every person's information is shared.
• Sharing for this purpose is not done for individuals under 16 (see the no-sale card) and the notice says it is not done from the American Express mobile application (see the mobile application card).
• You can opt out as described in the opt-out card.

Not stated here

• The notice does not name the third parties or the categories of information shared for this advertising beyond internet activity and "other personal information".

Cross-references

• qualified by (model-proposed): No sale of personal information; no sale or sharing for under-16s — The no sale or sharing statement for individuals under 16 limits the general statement that American Express may share information for cross-context behavioral advertising.

Sharing & Disclosure · Company commitment

No sale of personal information; no sale or sharing for under-16s

American Express says it does not sell personal information. It also says it does not sell or share the personal information of individuals under the age of 16.

Supporting quotations

We do not sell personal information.

Please note, we do not sell or share the personal information of individuals under the age of 16.

Qualifications & exceptions

• The statement that it does not sell is separate from the statement that it may share for cross-context behavioral advertising, which the notice describes as sharing rather than a sale.

Not stated here

• The notice does not say how American Express determines that an individual is under 16.

Cross-references

• qualifies (model-proposed): Sharing for cross-context behavioral advertising — The no sale or sharing statement for individuals under 16 limits the general statement that American Express may share information for cross-context behavioral advertising.

Sharing & Disclosure · Company practice

Disclosures to third parties in the past 12 months

For each category of personal information listed in the collection section, the notice refers readers to the Online Privacy Statement for additional information about the sources of personal information and the categories of third parties to whom it may disclose personal information. It says American Express may have disclosed each category of personal information to third parties during the preceding 12 months for the business purposes listed in the notice and in the Online Privacy Statement.

Supporting quotations

For each of the categories of personal information described above in “Categories of Personal Information We Collect,” please see our Online Privacy Statement for additional information about the sources of personal information and the categories of third parties with whom we may disclose personal information.

We may have disclosed each category of personal information with third parties during the preceding 12 months for the business purposes described above in “Why We Collect Personal Information” and in our Online Privacy Statement.

Qualifications & exceptions

• The wording is "may have disclosed", and it covers each listed category without saying which categories went to which third parties.

Not stated here

• The Online Privacy Statement is not supplied, so the sources of personal information and the categories of third parties are not stated in this document.

Sharing & Disclosure · User right or choice

Right to opt out of sharing for cross-context behavioral advertising

The notice lists, among the rights you may have under the CCPA, the right to opt out of the sharing of your personal information with third parties for cross-context behavioral advertising. How to use it is explained in the opt-out card.

Supporting quotations

Under the CCPA, you may have the right to request:

Opt-out of the sharing of your personal information with third parties for the purposes of cross-context behavioral advertising.

Qualifications & exceptions

• This is a right you "may have" under the CCPA.

Sharing & Disclosure · Procedure

How to opt out: footer link and Global Privacy Control

You can opt out of having your personal information shared for cross-context behavioral advertising by clicking the "Do Not Sell or Share My Personal Information" link in the footer of the American Express website. The notice also says American Express honors the Global Privacy Control, a browser-based opt-out preference signal that tells the websites you visit about your privacy preferences.

Supporting quotations

How to Exercise Your CA Privacy Rights

Right to Opt-Out of Sharing of Personal Information for Cross Context Behavioral Advertising

You can opt-out of having your personal information shared for cross-context behavioral advertising by clicking the “Do Not Sell or Share My Personal Information” link in the footer of the American Express website.

We also honor the Global Privacy Control, which is a browser-based opt-out preference signal that communicates your privacy preferences to the websites you visit.

Qualifications & exceptions

• The footer link is on the American Express website; the notice says there is no opt-out link inside the mobile application (see the mobile application card).
• The Global Privacy Control choice applies per browser (see the next card).

Not stated here

• The notice says more information about the Global Privacy Control "may be found here", but the link target is not part of the supplied text.

Cross-references

• qualified by (model-proposed): A Global Privacy Control opt-out applies only to that browser — The Global Privacy Control opt-out applies only to the browser where it was set unless enabled elsewhere.
• has exception (model-proposed): No opt-out link in the mobile application — The mobile application has no opt-out link because the notice says no information from the application is shared for cross-context behavioral advertising; the footer link is on the website.

Sharing & Disclosure · Restriction or exception

A Global Privacy Control opt-out applies only to that browser

Because the Global Privacy Control is a browser-based mechanism, the notice says your opt-out preference will apply only to the browser from which you exercised that choice. It adds that you may enable the Global Privacy Control on all of your browsers and devices that are currently compatible with the feature.

Supporting quotations

Note that because the Global Privacy Control is a browser-based mechanism, your opt-out preference will apply only to the browser from which you exercised that choice. However, you may enable the Global Privacy Control on all of your browsers and devices that are currently compatible with this feature.

Qualifications & exceptions

• This limit is stated for the Global Privacy Control; the notice does not say the footer-link opt-out is limited in the same way.

Cross-references

• qualifies (model-proposed): How to opt out: footer link and Global Privacy Control — The Global Privacy Control opt-out applies only to the browser where it was set unless enabled elsewhere.

Sharing & Disclosure · Company commitment

No opt-out link in the mobile application

American Express says it does not share personal information from its mobile application for cross-context behavioral advertising, and therefore does not offer the opt-out link within the mobile application.

Supporting quotations

We do not share personal information from the American Express mobile application for the purpose of cross-context behavioral advertising and, therefore, do not offer the opt-out link within the mobile application.

Qualifications & exceptions

• The statement is limited to personal information from the mobile application and to the cross-context behavioral advertising purpose.

Cross-references

• exception to (model-proposed): How to opt out: footer link and Global Privacy Control — The mobile application has no opt-out link because the notice says no information from the application is shared for cross-context behavioral advertising; the footer link is on the website.