CVS Health Corporation is a publicly traded (NYSE: CVS) Rhode Island-headquartered retail pharmacy, health-insurance, and pharmacy-benefits conglomerate whose subsidiaries include CVS Pharmacy, Aetna, and Caremark. Its consumer privacy policy discloses that the ExtraCare and ExtraCare Plus loyalty programs track additional data elements in exchange for rewards, and CVS operates a retail media network (CMX / CVS Media Exchange) that its own marketing materials describe as using "first-party loyalty data" from ExtraCare members to power advertiser targeting across roughly 90 million addressable shoppers. The privacy policy states CVS "may sell or share for targeted advertising" certain categories of personal information with business partners and ad-network providers, and the CVS Pharmacy App Store privacy label discloses tracking data plus sensitive-info and health data linked to identity. Corporate ownership is traceable through SEC 10-K filings naming Aetna Inc. and dozens of other named subsidiaries. Track record includes a 2021 unsecured cloud database exposing over a billion records (no authentication required, per independent researchers; CVS said the database held no customer/member/patient personal information) and Aetna's 2018 $1.15 million settlement with the New York Attorney General over a 2017 mailing whose envelope window revealed members' HIV status to third parties.
TRACK RECORD
1 ENFORCEMENT ACTION
[2018-01-23]
In January 2018, the New York Attorney General announced a settlement in which Aetna agreed to pay a $1.15 million civil penalty and adopt enhanced mailing procedures after a July 2017 mailing's large transparent envelope window revealed approximately 2,460 New York members' HIV status to third parties.
CVS digital privacy settlement ($20.5M) over Criteo tracking; claims due Nov. 16, 2026
You may be eligible if you accessed CVS's digital properties (such as cvs.com, cvshealth.com, or the CVS app) in the United States before July 27, 2026.
CVS's consumer privacy policy states that ExtraCare Plus members have additional data elements tracked in exchange for extra ExtraBucks Rewards and members-only rewards, meaning the scope of loyalty-program data collection scales with program tier.
CVS's own retail-media marketing site states that its 'deep knowledge of our ExtraCare members' shopping behaviors' lets CMX (CVS Media Exchange) do more than serve as a media partner, using that behavioral data to develop targeting for advertisers — showing loyalty/purchase data collected in-store and online is actively mined for advertiser-facing profiling, not just program administration.
CVS Health Corporation's Exhibit 21.1 to its FY2025 Form 10-K (filed with the SEC on 2026-02-10) publicly lists Aetna Inc. and dozens of other named subsidiaries with their jurisdictions of organization, providing a formally verifiable ownership record for the CVS/Aetna/Caremark corporate family.
CVS's privacy policy self-declares that it 'may sell or share for targeted advertising' certain categories of personal information — including online and other identifiers, commercial information, and internet activity — with business partners and third parties, including third-party ad-network providers.
CVS Media Exchange (CMX), CVS's retail media network, is described in its own materials as a data-led, technology-driven platform that enables outside advertising partners to reach CVS Pharmacy and ExtraCare customers through digital platforms including social channels, programmatic display, and CVS.com — meaning CVS-collected shopper data is used to target ads for external partners.
In January 2018, the New York Attorney General announced a settlement in which Aetna agreed to pay a $1.15 million civil penalty and adopt enhanced mailing procedures after a July 2017 mailing's large transparent envelope window revealed approximately 2,460 New York members' HIV status to third parties.
In June 2021, independent security researchers reported discovering an exposed CVS Health cloud database containing over a billion records (including search-query and device data) that was not protected by a password and had no authentication requirements at all.
CVS's privacy policy discloses that CVS and its third-party advertising and analytics partners and service providers use cookies, tags, SDKs and scripts to automatically collect information about visitors' activity across CVS's digital properties.
The CVS Pharmacy app's Apple App Store privacy-nutrition label discloses that usage data may be used to track users across apps and websites owned by other companies, and separately lists Sensitive Info and Health data among categories linked to the user's identity.