What Target does with your data

What it collects and does with your data

• Privacy policy CCPA section lists internet activity, identifiers, demographics, and commercial information as sold or shared (for cross-context behavioral advertising) to advertising networks, merchant partners, and social networks.
• Privacy policy lists data brokers among sources of personal information and 'data enhancement services' among service providers.
• Privacy policy says Target may use Automated License Plate Recognition near stores, retaining data about 30 days.
• 10-K reports advertising revenue of $915M in 2025, up from $649M in 2024. Some Roundel revenue is booked as a reduction of cost of sales or SG&A, so the figure understates the business.
• Privacy policy directs guests to call the privacy line (1-800-831-6880) to opt out of promotional postal mail and telephone calls.

Sensitive data

• license plates (ALPR)
• in-store cameras (alleged facial recognition, pending BIPA suit)
• biometric information such as voiceprints (policy)
• health data
• precise geolocation and in-store location
• payment

Enforcement and litigation

2 matters in the research. Where the research says alleged, pending, or settled without admitting wrongdoing, so does this page.

• Multistate AG settlement (47 states and DC) over 2013 payment card breach affecting 41M+ card accounts. Amount: $18.5 million.
• Illinois BIPA class action (Arnold et al.) alleging in-store cameras captured shoppers' facial geometry without consent. Motion to dismiss denied November 2024; pending as of last report found.

Who else holds your data

Organizations holding a copy of your data, as the research counts them: at least 12. Lower bound: nine sharing categories plus the three sale/share recipient categories that are not already counted (advertising networks, merchant partners, social networks).

Third parties: 9 disclosed recipient categories. Named: TD Bank USA, Pathward, Shipt, Target Plus partners. Sharing categories: subsidiaries and affiliates, card-issuing banks, service providers, registries, other businesses (Target Plus), legal, at your direction, aggregate data, business transfers. Sale/share recipients: advertising networks, merchant partners, social networks.

Data brokers linked to Target

• Gets customer data from data brokers it doesn't name. "Privacy policy lists data brokers among sources of personal information and 'data enhancement services' among service providers."

Confidence: confirmed means the company confirmed it or reported it in a filing. Alleged means a complaint or petition says so, with no ruling found. Reported means journalism or a Senate letter. How brokers are included

Data practices score

13 of 15. Five components, each 0 to 3. How the score works

Sells or shares

3

Enforcement

3

Retail media scale

2

Sensitive data

3

Opt-out friction

2

Estimated emissions for one person

Research gaps

• Target Circle member count is from March 2024.
• Privacy policy read via a Wayback Machine snapshot dated 2026-09-20; the section date (06/15/26) is taken from page metadata.
• BIPA case status after late 2024 not confirmed.
• Email count is an upper bound from 2022 data.