Last Updated: September 9, 2026

Our Privacy Notice is available in PDF form here.
Este Aviso de Privacidad está disponible en español aqui.

At the Kroger Family of Companies your safety and trust are important to us. For that reason, we are committed to handling your information in a way that is transparent, fair, and worthy of your trust.

In this notice, we explain how we collect, use, disclose, retain, and protect the information that we collect about you. We also let you know about your rights. Therefore, we encourage you to read this notice as well as any supplemental or different privacy notices that may be applicable when you access or interact with certain of our brands or service offerings.

We are committed to ensuring that this notice is accessible to people with disabilities. To make accessibility-related requests, please contact us at 1-800-KROGERS (1-800-576-4377).

Headquartered in Cincinnati, Ohio, the Kroger Family of Companies is one of the largest retailers in the United States based on annual sales. We serve nearly 11 million customers a day in 35 states including the District of Columbia. We are committed, through our purpose-driven strategy, to increasing access to high-quality, affordable fresh food for everyone. In fulfilling our Purpose — To Feed the Human Spirit^TM we live by our Values:

Kroger cultivates a customer first relationship and activates multiple touch points to provide the right content and the right products— all when, where and at the value our customers want. We create personalized experiences through relevant communication and meaningful rewards that make our customers’ lives easier.

Depending on where you live, where you shop, what websites and mobile applications you use, or what services you access, one or more of our Kroger Family of Companies will be responsible for the information we collect. An overview of the Kroger Family of Companies can be found here. The responsible companies will be hereafter referred to collectively as “Kroger” or “we” or “our”.

This notice covers information we collect from and about our customers and prospective customers including, for example, when they visit or make a purchase on one of our websites or mobile applications, visit or purchase products in one of our stores, interact with our advertisements, join one of our rewards programs, interact with us through social media, participate in consumer research, promotions, contests, or otherwise access or use one of our service offerings. This notice also applies to information we collect about individuals with whom we have a business relationship. This information is referred to as "personal information" and "personal data" throughout this notice.

Some of our specialized operations and service offerings have specific or different privacy notices. More information is available here.

Additional disclosures apply if you live in the following jurisdictions:

California

Colorado

Connecticut

Delaware

Florida

Indiana

Iowa

Kentucky

Louisiana

Maryland

Minnesota

Montana

Nebraska

New Hampshire

New Jersey

Nevada

Oklahoma

Oregon

Rhode Island

Tennessee

Texas

Utah

Virginia

Washington

We collect information described below to save you time and money and to make your shopping experience better. We have grouped the information we collect into categories, with some of the information listed in multiple categories. Because we only collect information when needed for particular purposes, not all this information will apply to you:

• Personal identifiers such as name, online identifiers like user account names, state and federal government ID numbers, date of birth, signature, and unique identifiers that we associate with you. In some cases, we may scan your driver’s license to verify you are old enough to make a restricted purchase. If we scan your license for this purpose, we do not retain your drivers’ license number after we verify your age.
• Contact information such as your email, postal address, billing address, delivery or shipping address, and phone numbers.
• Health-related information.
• To provide requested services to you or with your prior consent, we may collect health-related information in connection with certain consumer programs and consumer research studies.
• If you are injured in one of our stores, we may collect health-related information from you related to that incident.
• If you are a pharmacy customer or a customer of one of our other health-related operations like The Little Clinic, we may collect “Protected Health Information” (PHI) that is protected by the Health Insurance Portability and Accountability Act. Our collection and use of PHI is not covered by this notice. For information about where you can learn more, see below in the section titled Protected Health Information.
• Financial and payment information such as credit, debit, or other payment card numbers.
• Transaction and commercial information such as your purchase and transaction histories. With respect to individuals who interact with us in a business context, we may have commercial information about our relationship with you.
• Account information including your rewards program membership information, household’s unique ID numbers (including username, Rewards number, and Alternate IDs); username, password, security questions; purchase information, coupons and savings information, Points, address information, and preferred store.
• Online and technical information such as your IP address and device or other persistent identifiers, browser type and version, time zone setting, device characteristics, browsing data, data related to your viewing of (and interactions with) our advertisements, and other information that we collect using cookies, pixels, SDKs, and other similar technologies.
• Location data including precise geolocation information.
• Usage information including information about how you use our websites, mobile applications, your engagement with our AI-powered chatbots and agents, and other service offerings.
• Communication preferences including your preferences in receiving marketing and purchase-based advertising.
• Sensory data such as photos or CCTV recordings from our facilities or premises. Some of our cameras may capture license plate data for
  security purposes, to protect the health and safety of our customers and associates, and to prevent, investigate, and prosecute
  shoplifting, fraud, and other criminal activities. We may record your voice when you contact our customer service centers.
• General demographic information such as age, marital or family status (including whether your family includes children), languages spoken, education information, gender, employment information, or other demographic information. In addition, when permitted by applicable law, we may collect ethnicity or race.
• Biometric information (in select locations only) such as facial recognition data, when you enter our stores for security purposes, to protect the health and safety of our customers and associates, and to prevent, investigate, and prosecute shoplifting, fraud, and other criminal activities. We provide notice at the point of entry in locations where we collect biometric information.
• User content including product reviews and other feedback or content you may provide to us.
• Professional or employment-related information, such as your profession, job title, employer name, professional or licensure status, or other organizations to which you belong or are affiliated.
• Inferences include information derived from other information that we have collected. We create inferred and derived data elements by analyzing your shopping history in combination with other information we have collected about you to personalize product offerings, your shopping experience, marketing messages and to provide you with relevant coupons and promotional offers.

Personal information does not include data where your identity has been removed so that we can no longer identify you or that we aggregate so that you can no longer be identified, which we may use for any purpose.

Children’s Privacy

Our websites are for a general audience and are not geared toward children. We do not knowingly collect personal information from children under the age of 18. If you believe your child may have disclosed personal information to us, please call 1-800-KROGERS (1-800- 576-4377) and we will remove it.

The following are examples of how we may collect your information:

You or a member of your household purchase our products or services

If you enter your Rewards number or Alternate ID when you purchase our products or services, we will collect your purchase information and associate it with you or your household.

You provide it to us directly

You may give us personal information or provide it to us directly, including:

• Information you provide when you register for an account, enroll in one of our rewards or paid membership programs, verify your status (e.g., military, student, teacher) for a discount program, add items to your cart on one of our websites or apps, place an order, post reviews or other content, purchase one of our services, or when you otherwise contact us about our websites, products, or services. We may ask you for information when you enter a promotion or sweepstake offered by us, sign up for an event sponsored by us, or when you report a problem to us.
• Records and copies of your correspondence (including emails and online chats) and voicemail messages.

Information from your store visits

We may collect information using technology in our stores and premises, such as cameras and CCTV. This technology is used for operational and security purposes, to protect the health and safety of our customers and associates and to prevent, investigate, and prosecute shoplifting, fraud, and other criminal activities. In some locations, we may have cameras that collect biometric information. We provide notice at the point of entry in those stores.

Information from your device

We may collect information from a device that we have associated with you or your household. For example, we may collect information automatically when you browse our websites, use our mobile apps or other online services, or view or interact with our advertisements. If you connect to our in-store wireless service, we may collect information about your device so you can automatically connect. If you have opted in to location-based services in our mobile app, we may show marketing-related push notifications when you are in one of our stores.

Information we collect from other companies within The Kroger Family of Companies

We may collect your information from another company in the Kroger Family of Companies. For example, The Kroger Co.’s wholly owned subsidiary 84.51 LLC collects personal information from other Kroger Family of Companies, both to support our own business operations (such as our rewards programs) and to serve our business clients.

We receive it from others

We may receive personal information about you from others including, for example, data analytics providers, data enrichment providers, businesses involved in our co-branded offerings such as financial institutions, and AdTech companies. We may also receive information about you from public databases.

On some of our websites and apps, we may allow you to create an account with us using your Google account or other third-party account. If you create an account with us using this method, we may receive certain information about you from Google or other third party to enable us to create your account.

In some cases, we may receive personal information about you from 84.51 LLC’s clients. When we receive this information, we use it only as necessary to provide the services that our clients have requested that we perform on their behalf.

Finally, from time to time, we receive information from others that has been deidentified so that it is no longer personal information under applicable law. When we receive deidentified data from others, we commit to maintaining and using that data in deidentified form without attempting to reidentify it.

We and our service providers and other third parties may use cookies and other technologies in connection with our websites, mobile applications, advertisements, products, and services. Information collected through these technologies may be collected directly by us, on our behalf by service providers, or by third parties. Depending on the technology and the relationship involved, third parties may collect, receive, use, disclose, or otherwise process information in accordance with their own privacy notices, terms, and policies.

Cookies

A cookie is a small data file that is stored by your browser on your device. We use cookies to remember your preferences and choices, understand how you interact with our websites, improve functionality and performance, conduct analytics activities, detect and prevent fraud and security incidents, and support advertising and personalization activities.

Cookies may remain on your device for an extended period. If you use your browser’s method of blocking or removing cookies, some, but not all, types of cookies may be deleted and/or blocked. If you delete or block cookies, some functionality on our websites may not work properly.

Other Tracking Technologies

In addition to cookies, we may use other tracking technologies in connection with our websites, mobile applications, advertisements, products, services, and other digital offerings for the same purposes.

Examples of other tracking technologies include:

-Web Beacons

Web beacons are embedded images or objects that are used on web pages or emails. Examples of why we may use web beacons include:

• For business analytics purposes, such as understanding the number of people who visit a webpage or view specific content within a webpage
• To support marketing, personalization, and advertising activities
• To improve our websites and services
• To detect and prevent fraud and security incidents
• To verify system and server integrity

-Embedded Scripts

We may use embedded scripts that collect information about your interactions with our websites, mobile applications, and advertisements. These scripts may help support website functionality, analytics, personalization, security, fraud prevention, and advertising activities.

-Location-Identifying Technologies

We may use GPS (Global Positioning Systems), beacons, or other location-identifying technologies to locate your device for purposes disclosed to you when you use the applicable feature, such as preparing your order for pickup when you arrive at a store or serving location-relevant advertisements.

-SDKs/In-App Tracking Technologies

Our mobile applications may use in-app tracking technologies including code from packages referred to as software development kits
(SDKs). SDKs are packages of tools that help our mobile applications function in some way.

For example, we may use code from SDKs in our mobile applications to:

• Develop our applications to work with certain operating systems or platforms
• Provide in-app functionality, such as maps and similar features; and
• Personalize advertising

Unlike cookies, SDKs and other in-app tracking technologies are not browser based and therefore cannot be controlled through browser settings.

-Device, Activity Monitoring, and Interactive Technologies

We and our service providers may use technologies that monitor, analyze, record, and support your interactions with us online. These technologies help us provide and operate our websites, mobile applications, products, and services; troubleshoot issues; improve functionality and performance; personalize your experience; respond to your inquiries and requests; detect and prevent fraud and security incidents; and maintain the integrity and security of our systems. These technologies may also provide features that you choose to use, including AI-powered chatbots and agents that assist with orders, customer service, and other interactions.

Information collected through these technologies may include:

• Information you provide during your interactions, including prompts, messages, questions, and other inputs;
• Responses, recommendations, or other outputs generated during those interactions;
• Information about how you navigate and use our websites and mobile applications, including keystrokes, cursor movements, scrolling activity, and clicks; and
• Information about your device and browser, such as your operating system, plug-ins, browser settings, and system fonts.

If you use certain AI-powered features, we may retain information from your interactions, including preferences or other information you choose to provide, to enable continuity across interactions, personalize your experience, improve our products and services, and for other purposes described in this Privacy Policy. For example, information you choose to provide may be retained so that AI-powered features can remember your preferences and provide a more personalized and consistent experience in future interactions.

Third-Party Analytics

We may use third-party analytics providers to help us analyze how you use or interact with our websites, services, advertisements, and mobile applications.

Many of our websites and apps use Google Analytics. You can learn more about how Google Analytics collects and processes data at “How Google uses information from sites or apps that use our services” and in the Google Privacy Policy. Information about Google Analytics’ current opt-outs for web is available here.

In some cases, we may integrate the analytics services we use with certain advertising services that are also made available by our analytics providers. For example, we integrate Google Analytics with the following Google advertising features:

• Remarketing with Google Analytics
• Cross Device Remarketing & Reporting
• Google Analytics Demographics & Interest Reporting
• Google Display Network Impression Reporting

You can opt-out of Google Analytics advertising features directly with Google through its Ads Settings and Ad Settings for mobile apps functionality.

We use your information to:

• provide you the products and services you purchase, use, or request
• improve your shopping experience
• improve our products and services
• fulfill your requests
• personalize our product offerings, services, and marketing to you and others
• maintain and service your accounts
• support our business operations and functions, including fraud prevention, marketing, merchandising, security, and legal.

We may use technologies, including those that use machine learning and artificial intelligence, to support and improve our services.

This may include using your information to develop, test, and improve models that are designed for specific, limited purposes-such as translating your search queries into relevant results or enhancing features you use.

Below are more specific examples of how we use your information:

• To provide you with products and services you purchase or request including, for example, to securely process your payments, fulfill your orders or requests, verify your age for restricted purchases, and provide customer service.
• To operate our businesses including our retail operations, mobile applications, and websites as well as our wholly owned retail data science, insights, and media company, 84.51 LLC. More information on 84.51° is below.
• To conduct marketing, personalization, and advertising, which may include personalized recipes, offers, coupons, and advertisements. We may also use purchased-based advertising to show you advertisements and offers that are more relevant to you on other websites, mobile apps, and digital channels.
• To provide you discounts that you qualify for, which may be based on your status as a student, teacher, veteran, first responder, or other eligibility requirement.
• To include you in opportunities to apply for our co-branded credit card.
• For Interest-Based Advertising purposes.
• To communicate with you, such as providing account notifications or order status updates, providing product recall notifications, confirming your preferences, engaging with you on social media, or providing you information about relevant programs, contests, sweepstakes or other promotions or offerings.
• For research purposes, such as learning about our customers’ experience with a new store design, product, or service offering.
• To design and develop new product and service offerings
• To conduct business analytics, for such purposes as forecasting and planning, developing statistics on engagement with our websites and applications, and measuring how well marketing and promotional activities perform.
• For safety and security purposes, including to:
• Detect and respond to threats, to both our in-store and online operations,
• Protect the health and safety of our customers, associates, and the public; and
• Prevent, investigate and prosecute shoplifting, fraud, and other criminal activities
• To improve how we do business, improve our products and services, and your shopping experience. For other internal business purposes such as:
• To authenticate users of our websites and applications
• For quality control and training
• For system administration and technology management, including optimizing our websites and applications
• For recordkeeping and auditing purposes
• For risk management, investigations, reporting and other legal and compliance reasons
• Identifying prospective customers, business clients, suppliers, and other vendors.
• Administer our relationships with our customers, business clients, suppliers, and other vendors.
• In connection with mergers, acquisitions, divestitures, or similar corporate transactions
• To fulfill our legal obligations.
• To fulfill or meet the request for which information is provided.
• To fulfill other notified purposes that we describe to you when or before we collect your information.

More about 84.51 LLC

In connection with The Kroger Co.’s wholly owned subsidiary 84.51 LLC (84.51°), we use your information to provide services to other Kroger Family of Companies as well as our business clients. In many cases, our clients are consumer brands seeking to understand how purchasers of their products behave at an aggregate level or to present advertising to existing and prospective customers.

Examples of how 84.51° uses information to serve the Kroger Family of Companies and its clients include the following:

• To operate Kroger’s rewards programs
• To provide aggregated (non-personal) insights
• To conduct consumer research
• To advertise to relevant audiences
• To operate promotions
• To provide analytics services, which includes measurement services relating to advertising campaigns that 84.51° conducts on behalf of the Kroger Family of Companies and its business clients

84.51° may use technologies including those that use machine learning and artificial intelligence to support their business.

We may share your information as follows:

• The Kroger Family of Companies. We may share your information with the Kroger Family of Companies for use as described in this notice.

• Service Providers. We may share personal information with service providers that perform services on our behalf to support our business operations. For example, these services may include communications (e.g., email and mobile messaging), analytics, research, digital marketing, order fulfillment, payment processing, video streaming, customer analytics, and responding to inquiries. Except as permitted by law, we do not allow service providers to retain, use, disclose, or otherwise process personal information for their own purposes, including sending SMS text messages for their own purposes. We do not permit SMS service providers to share or sell text messaging opt-in data to third parties or affiliates for marketing or promotional purposes.

• Advertising and AdTech Companies. We may share personal information with companies that support digital marketing, advertising, analytics and measurement (collectively, “AdTech companies”). This sharing may be subject to legal requirements, including the provision of opt-out rights or other individual rights, where applicable.

• Third Parties. Where permitted by law, we may share your information with third parties, including payment providers, financial institutions, data brokers, social networks, other businesses involved in our co-branded offerings (as described below), and marketing vendors. When we do so, we comply with applicable legal requirements, which may include providing opt-out or other rights. We require these recipients to protect your information and use it only as permitted by law.

• Co-Branded Offerings. We may offer products, services, or promotions with another company (for example, a co-branded credit card). In connection with these offerings, we may share information reasonably necessary to market, administer, operate, or provide the co-branded program. Information shared for these purposes may be used only in connection with the co-branded offering. Information you provide directly to the other company, and information that company collects, may be subject to that company's privacy notice.

• Legal Requirements and Government Authorities. We may share your personal information where required by law or to comply with legal or regulatory requirements, requests from public authorities, or to enforce our agreements or policies, or to protect the rights or property of our customers, the company, other businesses, or the public (including to help prevent, investigate, or address fraud or other unlawful activity).

• Security and Safety Disclosures. Where permitted by law, we may disclose personal information to affiliates and third parties to help protect the rights, safety, security, and property of our customers, associates, and the public. We may also use and disclose this information to prevent, detect, and address fraud, security incidents, and other unlawful activities, and to protect and enforce our rights or assist others in doing so.

• Corporate Transaction. We may disclose personal information in connection with actual or contemplated corporate transactions, such as a merger, sale of assets, acquisition, bankruptcy, or similar event, including for related due diligence, where permitted by law.

• With Notice or Consent. We may also disclose information about you, including personal information to other third parties, where we have provided specific notice to you or asked for your consent, as required by law.

Notwithstanding anything else in this notice, we may share data that has been aggregated or deidentified in such a manner that it is no longer considered personal information for any purpose. When we share deidentified data, we require recipients to refrain from reidentifying the data and to pass this obligation on to downstream recipients.

Interest based advertising (also known as online behavioral advertising) occurs when advertisements are displayed to you based on information collected from your online interactions over time and across multiple websites that you visit, or across multiple devices or online services that you may use. Companies that engage in interest-based advertising use this information to predict your preferences and show you ads that are most likely to be of interest to you.

Some of the content, applications, and tracking technologies on our websites and mobile applications are provided, operated, or supported by third parties, which include AdTech companies (such as Meta or Google). These third parties may provide you with ways to choose not to have your information collected or used in this way.

For example, you can block the collection and use of information related to you by online platforms and AdTech companies for the purpose of serving interest-based advertising by visiting the website of the self-regulatory program of which those companies are members:

• The DAA’s opt-out page is available here.

Even if you opt out of interest-based advertising, you may still see advertisements from us or others. For example, you may see contextual advertisements, which are advertisements selected based on factors such as the content of the webpage you are viewing, your current search terms, general location information, or other information that is not based on your activities across websites, applications, or services over time.

Please also review our State Privacy Rights section in this privacy notice for information about privacy rights that we offer directly.

Some content or links on our websites, mobile applications, or in-store materials may be provided by third parties.

User Content

Our websites, mobile applications, or in-store experiences may allow you to submit content that can be viewed by others. For example, you may choose to post a product review, rating, comment, or other feedback. Any information you include in content that is publicly available may be seen by others. We do not control how others use information that is made public and are not responsible for such use.

Third-Party Links or QR Codes

Our websites, mobile applications, or in-store signage may include links or QR codes to third-party websites that we do not control. Those websites have their own privacy notices and terms, which we encourage you to review.

We implement and maintain reasonable security procedures and practices appropriate to the nature of the information we maintain, including appropriate technical, administrative, and physical measures designed to protect information from unauthorized or illegal access, destruction, use, modification, or disclosure You also play an important role in protecting your information. It is your responsibility to select a strong password, change it regularly, not reuse or share your password, and alert us if you have any concerns about unauthorized use of your account.

We value our relationship with you and the trust you place with us. Keeping your information and your communication
preferences current is an important part of that relationship.

We understand that our customers are individuals, and communication preferences will vary by customer. That is why we offer you the ability to manage what types of communications you receive from us and the ability to manage or change your preferences. Your rights may vary depending on where you are located. We have created mechanisms to provide you with the following options:

Updating your account information
If you have an account with us, you can log in and update, modify, and delete data from within your account.

Managing your marketing and other communication preferences
You can manage your marketing and other communication preferences by logging into your account on the relevant website or mobile app. Your communication preferences can be managed under the “Preferences” section of your account. To opt out of receiving personalized offers and coupons by regular mail from us, please contact the customer contact center as described below. Please note that you may still receive Kroger flyers, circulars, or other promotional mailings addressed to "Resident" or distributed to households within a particular geographic area.

Please allow a reasonable amount of time for any changes to your settings to take effect.

Alternatively, you can unsubscribe from any marketing emails or text messages that we may send you by clicking the unsubscribe option in the footer of an email or texting “STOP” in response to a text message that you receive from us.

Cookies and Tracking Technologies
You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies.

Interest-Based Advertising
Information about interest-based advertising and how to opt-out of it is described in the Interest-Based Advertising section of this notice.

State Privacy Rights
If you live in one of the states listed below, you may have additional rights with respect to your personal information. Please see our additional disclosures below to learn about those rights.

• California
• Colorado
• Connecticut
• Delaware
• Florida
• Indiana
• Iowa
• Kentucky
• Louisiana
• Maryland
• Minnesota
• Montana
• Nebraska
• New Hampshire
• New Jersey
• Nevada
• Oklahoma
• Oregon
• Rhode Island
• Tennessee
• Texas
• Utah
• Virginia
• Washington

We are happy to serve you through the following Kroger Family of Companies:

* These Kroger companies are not part of this notice, please look to their specific notices that can be found on their websites.

Protected Health Information
We understand the importance of securing Protected Health Information (PHI), which we collect in connection with our pharmacy operations, The Little Clinic, and certain other of our health care offerings and services. How we protect information covered by the Health Insurance Portability and Accountability Act (HIPAA) is outside the scope of this notice but can be found in our HIPAA Notice of Privacy Practices.

Financial Products and Services
The Kroger Family of Companies, including through certain third party co-branded offerings, make certain financial products and services available that may be regulated by the federal Gramm-Leach-Bliley Act and/or the Fair Credit Reporting Act.

This notice does not apply to personal information that is collected, processed, sold, or disclosed by the Kroger Family of Companies pursuant to those federal laws.

Please review The Kroger Family of Companies Financial Services Consumer Privacy Notice for additional information.

This notice is subject to change at our discretion. We will indicate changes to the notice by updating the “Last Updated” date at the
beginning of the notice. We will communicate material changes to you in accordance with applicable law, which may include through a
notice on the website home page or a notice to the email address specified in your account (if you have one).

Our customer contact centers are ready to take your questions and comments about this policy or our privacy practices. You can reach us by telephone at 1-800-KROGERS (1-800-576-4377) or via email at KrogerPrivacyOffice@Kroger.com.

If you live in Nevada, you can opt out of the sale of your personal information by going to our privacy preference center here.

Our Washington Consumer Health Data Privacy Policy supplements this Privacy Policy and applies to “consumer health data” subject to Washington’s My Health My Data Act.

1. Introduction and Scope
This Privacy Notice for California residents supplements the information contained in our Kroger Family of Companies Privacy Notice and applies to residents of the State of California (“consumers” or “you”). We adopt this notice to comply with the California Consumer Privacy Act of 2018 (as amended, and together with related regulations the “CCPA”) and any terms defined in the CCPA shall have the same meaning when used in this notice.

This notice does not apply to workforce-related personal information collected from California-based associates, job applicants, contractors, or similar individuals but does apply to personal information collected in the context of business-to-business (B2B) transactions.

This notice applies to “personal information” that we collect, meaning information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, or household ("personal information"). Personal information does not include:

• Publicly available information from government records.
• Deidentified or aggregated consumer information.
• Information excluded from the CCPA's scope, like health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA), clinical trial data, or other qualifying research data;
• Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

2. CCPA Notice at Collection
The tables below identify the categories of personal information and sensitive personal information we may collect, the purposes for which we use that information, and whether we currently sell or share the information for cross-context behavioral advertising.

To exercise your privacy choices, visit our Privacy Preference Center using the link below.

Privacy Preference Center

Retention

Except as otherwise permitted or required by applicable law or regulation, we will keep your personal information for as long as reasonably necessary to fulfill the purposes for which it was collected or for purposes that are compatible with the purposes that we have previously disclosed.

For example:

• We keep personal information associated with your rewards account for as long as you remain a customer or as otherwise needed for lawful and disclosed purposes.
• CCTV footage is retained for a period ranging from 45 to 90 days, depending on the system, unless it is required for safety, security, or legal reasons.

3. Other CCPA Disclosures

The following is a description of our online and offline information practices over the previous 12 months and other disclosures required by the CCPA.

(A) Personal information collected
The categories of personal information and sensitive personal information that we have collected about consumers in the past 12 months are the same as the categories described in our Notice at Collection.

(B) Sources of personal information
Please refer to How we collect your personal information, which describes the sources of personal information.

(C) Purpose for collecting personal information
Please see our Notice at Collection for an explanation of the reasons we collect personal information.

(D) Information about personal information that we have sold or shared

The table below identifies the categories of personal information we have sold or shared and the categories of third parties to whom personal information was sold or shared during the last 12 months. We do not knowingly sell or share the personal information of consumers under the age of 18.

In cases where we have sold or shared personal information, we have done so for the following purposes:

• To operate our business
• To conduct marketing, personalization, and advertising on behalf or on behalf of others
• To include customers in opportunities to apply for our co-branded credit card
• For Interest-Based Advertising including cross-context behavioral advertising purposes
• To conduct business analytics

(E) Personal information that we have disclosed for a business purpose
During the prior 12 months, we have disclosed personal information for the following business purposes:

• To provide you with products and services
• To provide product recall notifications
• To operate our businesses
• To conduct marketing, personalization, and advertising
• To include you in opportunities to apply for a co-branded credit card
• To communicate with you
• For research purposes
• To design and develop new product and service offerings
• To conduct business analytics
• For safety and security purposes
• To improve our products and service offerings
• For other internal business purposes
• To fulfill our legal obligations
• To fulfill or meet the request

The table below describes the categories of service providers (including contractors) to whom information was disclosed for a business purpose during the prior 12 months:

4. Your California Privacy Rights

The CCPA provides California consumers (residents) with specific rights regarding their personal information including:

• The right to know about personal information we collect about you and how it is used and disclosed, including the use of automated decision making technologies

• The right to delete personal information (with some exceptions)

• The right to correct inaccurate personal information

• The right to opt-out of the sale and sharing of your personal information for cross-context behavioral advertising

• In some cases, the right to limit the use or disclosure of sensitive personal information

• The right to opt out of automated decision making technologies

We will not discriminate against you for exercising your privacy rights.

(A) Your Right to Know
You have the right to know what personal information we have collected about you. Once we receive your request and verify your identity (as described below), we will disclose to you:

• The categories of personal information
• The categories of sources from which personal information has been collected
• The business or commercial purpose for collecting or selling personal information
• The categories of third parties with whom we disclose your personal information.
• The specific pieces of personal information we have collected about you
• If we sold your personal information or shared your personal information for cross-context behavioral advertising, the categories of personal information we have sold or shared.

(B) Your Right to Delete
You have the right to request that we delete personal information that we have collected from you and retained, subject to certain exceptions. Once we receive your request and verify your identity, we will review the request to see if an exception applies that allows us to retain some or all your information. If an exception applies, we will provide you information about that exception.

(C) Your Right to Correct
You have the right to correct inaccurate personal information that we maintain about you. In some cases, we may ask that you provide additional documentation to support your request. Once we receive your request and verify your identity, we may deny your request to correct personal information if we believe that the personal information that we maintain is more likely than not accurate based upon the totality of the circumstances.

(D) Your Right to Opt-Out of Sales and Sharing for Cross-Context-Behavioral Advertising
We do not sell or share personal information of consumers who we know are younger than 18 years of age.

You may request that we stop selling and sharing your personal information for cross context behavioral advertising (“opt-out”).

(E) Your Right to Limit Use of Your Sensitive Personal Information
In some cases, you may have the right to limit use of your sensitive personal information such as certain uses involving precise geolocation. We do not provide these rights in cases where we are permitted to use such information for other purposes under the CCPA.

(F) Your Right to Opt Out of Automated Decision Making Technologies.
You have the right to opt out of the use of automated decision making technologies that are used to make a decision that could have a significant impact on you.

5. How to Exercise Your CCPA Rights

How to exercise your privacy rights:

You or your authorized representative may exercise your privacy rights, by either:

• Selecting the privacy right you wish to exercise on our Privacy Preference Center; or
• Calling us at 1-800-KROGERS (1-800-576-4377) and informing the representative that you wish to exercise a privacy right.

We will only use personal information provided in a consumer request to verify the request and to meet our legal obligations. We cannot fulfill your request if we cannot verify your identity or authority to make the request and confirm the personal information that is the subject of the request relates to you.

Opt-Out Preference Signals

To exercise your right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising, you may enable an opt-out preference signal, such as Global Privacy Control (GPC), through your browser or device. When we detect a qualifying signal, we will treat it as if you submitted an opt-out request through the Privacy Preference Center.

6. Who May Submit Requests?

Only you, or someone legally authorized to act on your behalf (an authorized agent), may make a privacy request under the CCPA. Authorized agents will need to demonstrate that you’ve authorized them to act on your behalf. We retain the right to request confirmation directly from you confirming that the agent is authorized to make such a request, or to request additional information to confirm the agent’s identity.

7. How often can you submit requests?
With limited exceptions, you may only make a verifiable consumer request to know your personal information twice within a 12-month period.

8. How do we verify requests?
Before fulfilling your request, we take steps to verify you are who you say you are or that you have authority to act upon someone else’s behalf. One way we verify you is through your account. If you do not provide your account number, we may request additional information that we need to verify you and, if you are submitting a request on behalf of someone else, to verify that you are permitted to act on that person’s behalf.

When we contact you to request verification information, please respond and provide the information that we have requested. Depending on the nature of the request you make, we may require you to verify your identity to either a "reasonable degree of certainty" or "high degree of certainty". This means that we need to match two or three pieces of information that we hold about you with information that you provide to us. In addition, we may ask for knowledge-based qualifiers during the verification process. This data we need to match or ask for you to provide could include, but is not limited to, email address, Rewards number, Alt ID, mailing address, phone number, date of last purchase and purchase amount.

In some cases, we may require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request or that you are authorized to make the request on behalf of someone else.

In addition to providing the information we need to verify you or your authority, you must provide us with enough information so that we can understand, evaluate, and respond to your request. We cannot respond to your request or provide you with personal information if we cannot confirm the personal information relates to you.

We will only use personal information provided in the request to verify your identity or authority to make a request on behalf of someone else.

9. CCPA Metrics Report
We have prepared a report on the status of CCPA privacy requests for the previous year. To view the CCPA metrics report click here. The report is available in Spanish here.

10. Notice of Financial Incentive
Our rewards programs provide you with discounts on eligible products and services and the opportunity to earn points that may be redeemed for fuel discounts at participating fuel centers and for dollars off groceries at participating stores. Your use of your rewards account when you shop in-store and online enables us to select and personalize coupons, promotions, and other discounts or offers, based on what you buy in the stores and on e-commerce portals you may use. Our rewards programs are subject to termination at any time at our sole discretion.

Participation in our rewards programs is voluntary. You can opt-in to our rewards program by signing up online or in store. If you wish to withdraw your consent and opt out of any of our rewards programs, you can contact Kroger’s Customer Connect by telephone at 1-800-KROGERS (1-800-576-4377).

Our rewards programs are valuable to us as they help us to understand what matters to you, our customer. In determining the value of your information to us, we consider the profit generated from our product and service offerings that use personal information, which is reasonably related to the value provided to the consumer through personalized coupons, promotions, and other discounts or offers.

The material terms for each of our rewards programs are as follows:

11. Other California Disclosures
(A) Shine the Light
California’s “Shine the Light” law (Civil Code Section § 1798.83) permits California residents to opt out of our disclosure of your personal information to third parties for their direct marketing purposes. You may do so by submitting an “opt out” of sales and sharing request via our Privacy Preference Center.

(B) Do Not Track
We do not respond to “Do Not Track” (DNT) signals. However, we do honor opt-out preference signals (global privacy control) as described above.

The disclosures in this section supplement our general privacy notice for the following states: Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Louisiana (beginning January 1, 2027), Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma (beginning January 1, 2027), Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.

For the purposes of this section, these laws will be referred to collectively as State Consumer Privacy Laws. References to “personal information” in our general privacy notice describe our practices with respect to “personal data,” as defined under these State Consumer Privacy Laws.

Categories of Personal Data and Purposes of Processing

You can learn more about the categories of personal data and sensitive data that we collect about consumers, the purpose for processing your personal data and sensitive data, and our retention policies by visiting our CCPA Notice at Collection.

In addition to the sensitive data categories listed in our CCPA Notice at Collection, in select stores we may collect biometric information such as facial recognition data, when you enter our stores for security purposes, to protect the health and safety of our customers and associates, and to prevent, investigate, and prosecute shoplifting, fraud, and other criminal activities. We provide notice at the point of entry in locations where we collect biometric information.

Categories of Personal Data Shared with Third Parties

We may disclose or otherwise make available the categories of personal data listed below for targeted advertising purposes or in a manner that may be considered a “sale” under applicable State Consumer Privacy Laws:

• Identifiers

• Customer Records

• Commercial information

• Internet or other electronic network activity information

• Geolocation (non-precise)

• Inferences

Please see our CCPA Notice at Collection for a list of the categories of third parties that we disclose or otherwise make available personal data. For additional information about our disclosure practices, please see the How We Share Your Information section above.

Your Rights Under State Consumer Privacy Laws

If you are a resident of a state that has enacted a State Consumer Privacy Law, you may have the following rights with respect to your personal data, subject to certain conditions, exceptions, and limitations:

1. Right to access. You have the right to request access to and obtain a copy of personal data that we may hold about you.

2. Right to correct. You have the right to request that we correct inaccuracies in your personal data. Although Iowa does not grant its residents this right, we grant Iowa residents the right to request correction of their data.

3. Right to delete. You have the right to request that we delete personal data that we have collected from or obtained about you.

4. Right to opt out of the sale of personal data. You may request that we stop disclosing or making your personal data available in a way that is considered a “sale”.

5. Right to opt out of targeted advertising. You may request that we stop disclosing your personal data for targeted advertising.

6. Right to withdraw consent/opt out of the processing of sensitive data. If you have previously granted us consent to process your sensitive data, you have the right to withdraw consent /opt out of further processing of your sensitive data.

7. Right to opt out of profiling. You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, which may include, for example, the use of your personal data in opportunities to apply for our co-branded credit card.

8. Right to appeal. If you live in Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Louisiana (beginning January 1, 2027), Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma (beginning January 1, 2027), Oregon, Rhode Island, Tennessee, Texas, or Virginia and are unsatisfied with our decision to not take action on your request to exercise one of your privacy rights, you may appeal our decision. Although Utah law does not grant its residents this right, we accept appeals from Utah residents using the same process.

9. Right to Request Third Party List and Categories. If you live in Connecticut, Delaware, Maryland, Minnesota, Oregon, and Rhode Island, you have the right to request and obtain a list of the categories, or specific third parties, to which we have sold, shared, or disclosed your personal data, in accordance with such laws.

We will not discriminate against you for exercising your privacy rights.

How to exercise your privacy rights:

You may exercise your privacy rights, by either:

• Submitting a request through our Privacy Preference Center; or
• Calling us at 1-800-KROGERS (1-800-576-4377) and informing the representative that you wish to exercise a privacy right.

We will use the personal data provided in connection with your request solely to verify your identity or authority to make the request, process your request, and comply with our legal obligations. We may need to verify your identity or authority before fulfilling your request. If we are unable to verify your identity or authority, we may be unable to process your request.

Opt-Out Preference Signals
You may also exercise your right to opt out of the sale of your personal data and targeted advertising through an opt-out preference signal, such as Global Privacy Control (GPC) where your state provides you with this right. To submit a request using an opt-out preference signal, you must use a browser or device that supports the signal. When we detect a qualifying opt-out preference signal, we will process it as a request to opt out of the sale of your personal data and targeted advertising associated with the browser or device on which the signal is enabled.

Authorized Agents
In certain states, you may designate an authorized agent to submit a privacy request on your behalf. Authorized agents will need to demonstrate that you’ve authorized them to act on your behalf. Authorized agents may be required to provide documentation demonstrating their authority to act on your behalf. We may also request that you verify your identity directly with us or otherwise confirm that you have authorized the agent to submit the request. We reserve the right to request additional information necessary to verify the identity and authority of the authorized agent.

Colorado Rewards Program

We offer Colorado customers access to our various rewards programs (i.e., King Soopers or City Market Rewards, and Boost). Participation in our rewards programs is voluntary.

We may disclose your personal data to third parties and our rewards program partners in connection with the operation of our rewards programs and the provision of program benefits. Participation in our rewards programs allows eligible members to receive rewards, discounts, and other program benefits as well as earn points that can be redeemed for various benefits at participating stores. While many rewards program discounts and benefits are generally available to participating members, information about your purchases, preferences, and interactions may be used to help us present coupons, promotions, and other offers that may be relevant to you or to others. These rewards programs may be modified, suspended, or terminated at any time.

The categories of personal data that we may sell (or process for targeted advertising) as well as the categories of third parties that may receive personal data in connection with your participation in our rewards programs are described in our CCPA Notice at Collection.

The following table describes our Bona Fide Loyalty Program Partners and the benefits that they provide.