What CVS Pharmacy does with your data

What it collects and does with your data

• CMX markets ExtraCare data to advertisers: 90M+ addressable members, 77% of CVS sales and 90% of CVS online sales made by ExtraCare members, average membership tenure of 10 years.
• Privacy policy: CVS may sell or share for targeted advertising online and other identifiers, commercial information, internet activity, and non-precise location with business partners and third parties.
• Policy says CVS discloses personal information to research partners, and uses automatic license plate recognition near stores, deleting ALPR data after 60 days unless retention is otherwise necessary.
• Policy lists biometric information among categories of personal information collected.
• The Markup and KFF Health News found trackers on CVS.com telling large social media and advertising platforms which products customers viewed, including at-home HIV tests; CVS said it complied with applicable laws.

Sensitive data

• health/pharmacy
• license plates (ALPR)
• biometric (listed category)
• payment

Enforcement and litigation

3 matters in the research. Where the research says alleged, pending, or settled without admitting wrongdoing, so does this page.

• FTC consent order: FTC charged CVS Caremark failed to take reasonable measures to protect health and financial information after pharmacies discarded prescription records and pill bottles in unsecured trash containers. Settled.
• HHS resolution agreement over the same HIPAA disposal allegations. Amount: $2.25 million.
• Brewer et al. v. CVS Pharmacy and Criteo (Broward County, Fla., No. CACE-26-008094): class alleged website and app trackers sent sensitive data to Criteo and other technology providers (HIPAA Journal names Adobe, Medallia, and Quantum Metric; the settlement agreement lists them, with Braze and Branch Metrics, only among released technology providers). Settlement preliminarily approved with a $20.5M cap covering payments, fees, and costs; claims up to $10 with proof of membership or $5 without; final approval hearing 2026-12-01. Defendants deny that they violated any law. Amount: $20.5 million.

Who else holds your data

Organizations holding a copy of your data, as the research counts them: at least 3. Floor: CVS; Criteo, the co-defendant and the only recipient the Brewer settlement agreement and court-authorized notice name for the alleged disclosure; and at least one research partner (CVS privacy policy). Adobe, Medallia and Quantum Metric are recipients only in HIPAA Journal's summary of the complaint; the settlement agreement names them, with Braze and Branch Metrics, only as released technology providers, so they are not counted. CMX advertiser count not disclosed.

Third parties: 6 disclosed recipient categories. Named: Criteo (alleged recipient named in the Brewer settlement documents). Adobe, Medallia and Quantum Metric per HIPAA Journal's complaint summary; the settlement agreement names them, with Braze and Branch Metrics, only as released technology providers.. Approximate: service providers; business partners and third parties (sale/share); ad networks and measurement services; research partners; government authorities; corporate-transaction parties.

Data brokers linked to CVS Pharmacy

None. The research documents no flow between CVS Pharmacy and a data broker.

Data practices score

11 of 15. Five components, each 0 to 3. How the score works

Sells or shares

2

Enforcement

3

Retail media scale

2

Sensitive data

3

Opt-out friction

1

Estimated emissions for one person

Research gaps

• CMX ad revenue not disclosed; only a low-confidence vendor-blog estimate.
• No CVS-specific email frequency data.