WHAT THE POLICIES SAY

Costco Wholesale Corporation (NASDAQ: COST) is a membership warehouse retailer reporting 81.0 million paid members and 145.2 million total cardholders in its FY2025 10-K. Because shopping requires a membership, purchases are card-linked and identified by design; Costco also collects a member photograph and identity-document information, and uses automated license plate recognition at some warehouses. Its privacy notice (last updated July 1, 2025) permits disclosures to advertisers, social media platforms, and advertising technology providers, and states some disclosures may be "sales" under certain state laws. Costco began building a retail media network on member purchase data in 2024. Five class actions and two Washington AG civil investigative demands concern pixel trackers on costco.com, including pharmacy pages. Its online services honor Global Privacy Control, and a 2021 in-warehouse card-skimmer breach was disclosed with free identity-protection services.

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

10 ON FILE

[2024-03-31] · COLLECTION

Costco's Consumer Health Data Privacy Notice (effective March 31, 2024) states that Costco may collect Consumer Health Data — information that may identify past, present, or future physical or mental health status — when members browse its digital properties or make purchases, including browsing and transaction data related to consumer health products sold through its pharmacies, optical, and hearing aid departments.

web.archive.org ↗

[2025-07-01] · COLLECTION

Costco's Privacy Notice (last updated July 1, 2025) states that Costco collects a photograph of each person when they become a member, may collect identity-document information (e.g., driver's license or passport), collects detailed transaction and purchase information (product details, price, date, tender type, and location), and uses Automated License Plate Recognition (ALPR) technology to collect vehicle information at some warehouses and facilities.

web.archive.org ↗

[2025-10-08] · OWNERSHIP TRANSPARENCY

Costco Wholesale Corporation is a Washington corporation publicly traded on the NASDAQ Global Select Market (ticker COST) and files full SEC reports; its Form 10-K for fiscal year ended August 31, 2025 (filed October 8, 2025) discloses 81.0 million paid members and 145.2 million total cardholders, its co-branded Citibank credit card arrangement, and an Item 1C cybersecurity program assessed by a third party against the NIST Cybersecurity Framework and CIS 18 Critical Security Controls.

sec.gov ↗

[2024-06-06] · SHARING

In June 2024, Costco's AVP of retail media, Mark Williamson, confirmed Costco was building a retail media network that uses member purchase data to target advertising, telling Marketing Brew the company would help brands reach members based on past behavior, with beta tests using audience data to target members on other websites.

marketingbrew.com ↗

[2025-07-01] · SHARING

Costco's Privacy Notice (last updated July 1, 2025) permits disclosure of personal information to advertisers, publishers, social media platforms, advertising technology providers, and analytics vendors for targeted advertising, and acknowledges that some disclosures may be "sales" of personal information under certain state laws; it also states Costco does not sell members' mobile numbers to third parties for marketing and offers a sale/sharing opt-out via its Your Privacy Choices page.

web.archive.org ↗

[2025-08-22] · SHARING

As of August 2025, Costco's retail media network was adopting GrowthLoop's platform to segment member audiences and optimize ad messaging, indicating continued build-out of advertising products based on member data.

digitalcommerce360.com ↗

[2021-11-12] · TRACK RECORD

In November 2021, Costco disclosed a data breach after finding a payment card skimming device in one of its warehouses, sending notification letters warning affected customers that payment card information might have been stolen and offering free identity-protection and monitoring services.

bleepingcomputer.com ↗

[2025-10-08] · TRACK RECORD

Costco's FY2025 Form 10-K discloses that five class action suits were filed between September 25 and October 31, 2023 alleging privacy law violations from pixel trackers on Costco.com; that in November 2024 the court denied Costco's motion to dismiss the consolidated Castillo complaint in substantial part; and that Costco received related civil investigative demands from the Washington Attorney General's Office (January 2 and August 22, 2024) and a pre-litigation letter from the Los Angeles County Counsel. These matters remained pending allegations, not adjudicated findings, as of the filing.

sec.gov ↗

[2023-11-07] · TRACKING TECH

A proposed class action (Castillo et al. v. Costco Wholesale Corporation, No. 2:23-cv-01548, W.D. Wash., filed October 6, 2023) alleges Costco used a Meta Pixel on its website to track and disclose pharmacy customers' protected health information to third parties without their knowledge or consent; these are allegations in live litigation, not adjudicated findings.

classaction.org ↗

[2025-07-01] · TRACKING TECH

Costco's Privacy Notice (last updated July 1, 2025) states that Costco and its vendors, suppliers, and advertising providers use digital trackers — cookies, pixels, web beacons, and mobile advertising identifiers — to collect personal information about online activities over time and across different websites; the same notice states Costco's online services are designed to honor Global Privacy Control opt-out signals.

web.archive.org ↗

LAST REVIEWED 2026-08-04 · METHODOLOGY v1.7