Adobe Inc. operates under a publicly posted, regularly updated privacy policy that identifies distinct regional data controllers (Adobe Inc., Adobe KK, and Adobe Systems Software Ireland Limited) and discloses categories of business partners with whom it shares data for advertising purposes. In 2024 the Federal Trade Commission sued Adobe, charging that the company steered people toward its "annual paid monthly" subscription plan without clearly explaining that canceling in the first year could cost hundreds of dollars, a matter Adobe resolved in 2026 with a $150 million settlement; separately, the company's 2013 data breach exposed approximately 153 million user records and led to a customer class-action settlement. Adobe's own documentation describes consent-based collection of device, usage, and content data, along with cookie-based tracking tied to interest-based advertising programs.
TRACK RECORD
1 BREACH · 1 ENFORCEMENT ACTION
BREACH LEDGER
[2013-10-04] · BREACH
Have I Been Pwned lists a breach record for Adobe Inc.: "Adobe".
Approximately 152,445,165 accounts affected, per HIBP.
Adobe's 2026 settlement with the DOJ and FTC requires the company to clearly disclose any early termination fee and how it is calculated before enrolling customers in subscriptions, to remind customers before converting free trials longer than seven days into paid subscriptions carrying such a fee, and to provide subscribers with easy cancellation options.
Adobe's own FAQ discloses that it may combine information provided by users with information obtained from third-party sources, such as social networks used for sign-in.
Adobe's privacy policy states that, where consent is required, Adobe will obtain permission before accessing information stored on a user's device relating to use of and engagement with services (e.g., Adobe Connect meetings), collecting crash reports, and analyzing user content.
Adobe's privacy-policy overview page discloses that Adobe acquires companies as part of its business expansion, and that acquired companies may continue to operate under their own privacy policies until integration is complete.
Adobe's privacy policy discloses distinct regional data controllers: Adobe Inc. for North American residents, Adobe KK for Japanese residents, and Adobe Systems Software Ireland Limited for residents outside North America and Japan.
Adobe's business-partner disclosure page lists categories of partners with whom it shares data — including advertisers, ad agencies, advertising networks and platforms, and resellers — to show users more relevant ads.
Adobe's privacy policy summary discloses that personal information is shared within the "Adobe family of companies," with service providers supporting business operations, and with third parties as reasonably necessary for fraud prevention or legal compliance.
Adobe's marketing-practices page states Adobe does not share personal information about consumers with third parties for the third parties' own marketing purposes unless the consumer agreed to that sharing.
In October 2013, Adobe disclosed a data breach affecting approximately 153 million accounts, with each record containing an internal ID, username, email, encrypted password, and a plaintext password hint.
In 2015, Adobe resolved a customer class action tied to the 2013 breach, agreeing to pay an undisclosed settlement amount plus $1.2 million in legal fees.
Adobe's 2026 settlement with the DOJ and FTC requires the company to clearly disclose any early termination fee and how it is calculated before enrolling customers in subscriptions, to remind customers before converting free trials longer than seven days into paid subscriptions carrying such a fee, and to provide subscribers with easy cancellation options.
Adobe's cookie documentation states the company participates in the Digital Advertising Alliance's AdChoices program and uses cookies tied to its Experience Cloud products to provide relevant content and advertisements.