Best Buy (NYSE: BBY) is an electronics retailer whose privacy policy (effective 9/1/2024) and State Privacy Rights statement describe broad collection: Social Security and driver's license numbers, purchase and browsing history, geolocation, health information, in-store cameras including facial recognition data in certain stores, and profile inferences, plus data-broker sourcing. Its Best Buy Ads retail-media arm monetizes first-party data across Google, Roku CTV, and social platforms, and says it can link 93% of transactional revenue to a customer ID. State disclosures say it may have sold online identifiers, commercial information, and inferences, while honoring Global Privacy Control at scale and publishing annual CCPA metrics. Track record includes the 2018 [24]7.ai chat-vendor payment-card breach and EFF records showing the FBI paid Geek Squad informants.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
14 ON FILE
COLLECTION
Best Buy's Trade-In Program FAQ makes customers responsible for removing data and accounts from devices before trade-in and directs them to Geek Squad appointments for help removing personal data and wiping hard drives — documented device data-hygiene guidance for its trade-in and recycling programs.
As assessed by PrivacySpy on 2021-03-27 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
The Best Buy Privacy Policy (effective 9/1/2024) states that certain stores may collect biometric information such as facial recognition data from security cameras — adding that it does not collect this data in states where consent is required — and that Best Buy may also receive information about customers from data brokers.
Best Buy's State Privacy Rights statement (last updated 7/23/26) states it may have collected identifiers including Social Security and driver's license numbers, financial/medical/health information, biometric information, geolocation data, browsing and search history, and profile inferences about preferences and psychological trends; a Connecticut provision adds that personal information may be used to train and evaluate LLMs.
As assessed by PrivacySpy on 2021-03-27 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
Best Buy Co., Inc.'s Form 10-K for fiscal 2026 (filed 3/18/2026) discloses it was incorporated in Minnesota in 1966, trades on the New York Stock Exchange as BBY, and operates Domestic and International segments with enumerated brands including Best Buy Ads, Geek Squad, Best Buy Health, My Best Buy Memberships, Lively, and Jitterbug — a fully SEC-documented ownership structure.
Best Buy publishes annual consumer-privacy request metrics on its State Privacy Rights page: for 2025 (as of 12/31/2025) it reported 477,392 Do Not Sell requests fulfilled and 1,543,611 Do Not Sell requests received and fulfilled via the Global Privacy Control browser signal, alongside access, deletion, and correction request counts and response times.
As assessed by PrivacySpy on 2021-03-27 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
At its September 2025 Best Buy Ads showcase, the president of Best Buy Ads said the company can connect 93% of its transactional revenue back to a customer ID, positioning its first-party purchase data as the basis for advertiser targeting, measurement, and sales attribution across partner platforms.
Best Buy's State Privacy Rights statement (last updated 7/23/26) discloses that it may have sold — as defined under California, Colorado, Connecticut and other state laws — commercial information, online identifiers, internet activity data, and profile inferences, and that it shares personal information for cross-context behavioral advertising; it also states it does not sell sensitive personal information or data of consumers known to be under 16.
FBI records obtained by the Electronic Frontier Foundation through a FOIA lawsuit (published March 6, 2018) show the FBI paid a confidential Geek Squad informant $500, that Best Buy hosted an FBI "Cyber Working Group" at its Kentucky repair facility in 2008, and that the bureau maintained close liaison with Geek Squad management for roughly a decade, with technicians flagging content found on customers' devices during repairs.
In an April 5, 2018 statement, Best Buy disclosed that [24]7.ai, its third-party chat-technology vendor, suffered a cyber intrusion between Sept. 27 and Oct. 12, 2017 that may have compromised payment information of a small fraction of Best Buy's online customers, whether or not they used chat; Best Buy notified law enforcement and offered free credit monitoring to affected customers.
Best Buy Ads, the company's retail-media network, states on its insights site that it uses first-party demographic, psychographic, membership, and subscription data from its consumer-electronics customer base to target programmatic advertising off-site, including through Google Performance Max and Roku's CTV platform.
The Best Buy Privacy Policy (effective 9/1/2024) states its digital properties are not designed to respond to browser "do not track" requests, and describes automatic collection of IP address, browsing behavior, referring URLs, IMEI/UDID, MAC address, and the IDFA and AAID advertising identifiers, with cookies, pixels, and tags used by Best Buy and third-party partners.