What Ulta Beauty does with your data

What it collects and does with your data

• 10-K describes UB Media as built on the company's understanding of its loyalty members plus investment in data analytics and CRM, reaching audiences on Ulta's owned channels and offsite. No revenue disclosed.
• Q2 FY2026 call: UB Media grew double digits year over year, driven by new products including connected TV and by core and marketplace brand spend.
• Privacy policy says Ulta 'sells' and 'shares' personal information by making IP addresses and other persistent identifiers available to advertising, analytics, and marketing partners, and names 21 advertising services (including Meta, Google, TikTok, Snapchat, Pinterest, Reddit, Criteo, The Trade Desk, Rokt, Spotify), 8 functional services, and 7 performance services.
• Policy collects facial geometry through Virtual Beauty Try-On and related features, shares it with named Virtual Beauty Companies (including Perfect Corp, Haut AI, GlamST), keeps it up to three years after last use, and says users agree to waive any claims relating to that information.
• Policy discloses automated license plate recognition, with data kept on a rolling 30-day basis.
• Policy says session replay technology may record how users interact with the sites.
• Opting out needs the Your Privacy Choices link for online tracking plus a separate Data Request form for other sale/sharing; email preference changes may take up to 6 to 8 weeks to take effect.
• Policy says vendors behind Ulta AI features may use and disclose information for their own purposes, including training their AI models.

Sensitive data

• biometrics/face (virtual try-on facial geometry)
• license plates (ALPR)
• health (skin and scalp conditions; Washington health data notice)
• precise location (if enabled)
• payment
• race, ethnicity, sexual orientation (listed sensitive categories)

Enforcement and litigation

4 matters in the research. Where the research says alleged, pending, or settled without admitting wrongdoing, so does this page.

• Hartigan v. Ulta Salon, Cosmetics & Fragrance Inc., No. 3:26-cv-04007 (S.D. Cal.): class action alleging the Meta Pixel and related trackers intercepted website communications (CIPA, ECPA, invasion of privacy). Pending.
• Shahpur et al. v. Ulta (E.D. Wash.): CEMA class action alleging false time-limited promotion subject lines. Motion to dismiss denied. Pending.
• Repperger et al. v. Ulta, No. 2:25-cv-02398 (Washington): CEMA class action alleging free-gift and discount subject lines omit purchase conditions. Pending.
• Cabiltes v. Ulta (N.D. Ill.): BIPA class action over virtual try-on face scans; voluntarily dismissed with prejudice.

Who else holds your data

Organizations holding a copy of your data, as the research counts them: at least 36. 35 distinct external organizations named in the privacy policy's tracking and virtual beauty tables, plus Ulta. Excludes the credit card issuer, CRM vendors, and UB Media advertisers, which are not named.

Third parties: 11 disclosed recipient categories. Named: 35 distinct named external organizations (17 ad companies, 6 functional, 4 performance, 8 virtual beauty vendors, after merging duplicates such as Google and Microsoft). 11 = disclosure categories in section 4 of the policy. Named count derived from the policy's vendor tables; CDNs such as BootstrapCDN receive only request-level data.

Data brokers linked to Ulta Beauty

None. The research documents no flow between Ulta Beauty and a data broker.

Data practices score

8 of 12 scored. Five components, each 0 to 3. How the score works

Sells or shares

2

Enforcement

1

Retail media scale

unscored

Sensitive data

3

Opt-out friction

2

The researcher ranks Ulta eighth in its sector. If UB Media revenue is at or above $100M, which is unverified, Ulta would score 10.

Estimated emissions for one person

Research gaps

• UB Media revenue undisclosed; retail_media_scale left null, so the total is out of 12.
• Email frequency is the beauty-category average, not Ulta-specific.
• Number of UB Media advertisers not disclosed.