What Bath & Body Works does with your data

What it collects and does with your data

• Online privacy policy (last updated 2024-07-01; the version the site served on 2026-09-25) says BBW may sell or share name, postal address, and summary purchase information with other merchants and merchant exchanges who may use it to send their own offers.
• Same policy says BBW may share postal and email address, preferences, and purchase history with affiliated entities that operate sister brands so they may market to you.
• Checkout email sign-up text on bathandbodyworks.com says the brand doesn't share or sell personal info.
• Policy lists precise geolocation via the app, in-store security camera video, inferences (purchase and shopping profiles), and household and income-level information among categories collected.
• GPC opts out only data derived through the browser; to fully opt out a customer must also submit a Do Not Sell or Share request; separate links apply for California and Colorado versus other states.

Sensitive data

• precise location (app)
• in-store security camera video
• payment
• household and income information

Enforcement and litigation

None found in the research.

Who else holds your data

Organizations holding a copy of your data, as the research counts them: not estimable. No recipients named. Minimum is BBW plus one merchant exchange plus one ad platform, but none are identified.

Third parties: 6 disclosed recipient categories. 6 = sale/share recipient types in the policy tables (ad tech providers, affiliated brands, affiliate marketers, social media platforms, survey companies) plus other marketers (merchants and merchant exchanges).

Data brokers linked to Bath & Body Works

None. The research documents no flow between Bath & Body Works and a data broker.

Data practices score

6 of 15. Five components, each 0 to 3. How the score works

Sells or shares

3

Enforcement

0

Retail media scale

0

Sensitive data

1

Opt-out friction

2

Estimated emissions for one person

Research gaps

• Policy version is dated 2024-07-01; the rendered consumer page was bot-blocked, so it is unconfirmed whether a newer consumer policy exists (the bbwinc.com corporate policy is dated 2025-10-21 and covers only that site).
• No privacy enforcement found.
• The 114-email count comes from a secondary summary of TargetBay data with no stated time window.