WHAT THE POLICIES SAY

Instacart (Maplebear Inc., NASDAQ: CART) is a grocery delivery marketplace whose ads arm monetizes first-party transaction data — its fiscal 2024 Form 10-K reports $958 million in advertising and other revenue, with Carrot Ads extending the platform to other retailers' storefronts. The privacy policy (January 15, 2026) documents collection of purchase history, precise device location, and session replays capturing keystrokes, and concedes categories of personal information may be sold/shared with advertising partners for targeted advertising, while committing to honor Global Privacy Control signals. In 2020, data from hundreds of thousands of customer accounts appeared for sale on the dark web; Instacart attributed this to credential stuffing, not a breach of its systems. In 2022 it paid $2.54 million to settle a DC Attorney General lawsuit alleging deceptive service fees.

TRACK RECORD

2 ENFORCEMENT ACTIONS

[2025-02-28]

Maplebear Inc.'s fiscal 2024 Form 10-K discloses that the company regularly experiences credential stuffing attacks against customer and shopper accounts using credentials compromised in other companies' breaches; the same filing's Item 1C describes a maintained cybersecurity risk management program integrated with enterprise risk management.

sec.gov ↗

[2022-08-19]

On August 19, 2022, the District of Columbia Attorney General announced a $2.54 million settlement with Instacart resolving a 2020 lawsuit alleging that from 2016 to 2018 the company misled DC consumers into believing 'service fees' were tips that went to delivery workers, and that it failed to pay required sales taxes.

oag.dc.gov ↗

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

11 ON FILE

[2025-02-28] · COLLECTION

Maplebear Inc.'s Form 10-K for fiscal year 2024 describes first-party transaction data as the foundation of its advertising business, and reports advertising and other revenue of $958 million for the year ended December 31, 2024, substantially all of it advertising revenue.

sec.gov ↗

[2026-01-15] · COLLECTION

Instacart's Privacy Policy (last updated January 15, 2026) states that Instacart collects commercial information including products purchased or considered, purchase history, preference and interest profiles, and consuming tendencies, and — where the user grants device permission — the precise location of the user's device.

instacart.com ↗

[2025-02-28] · OWNERSHIP TRANSPARENCY

Instacart's parent is Maplebear Inc., a Delaware corporation headquartered in San Francisco that files audited annual reports with the SEC (Commission File Number 001-41805); its fiscal 2024 Form 10-K states that references to 'Instacart' mean Maplebear Inc. and its consolidated subsidiaries.

sec.gov ↗

[2026-01-15] · OWNERSHIP TRANSPARENCY

Instacart's Privacy Policy (January 15, 2026) plainly identifies the corporate entities responsible for data handling as Maplebear Inc. d/b/a Instacart and Maplebear Canada Inc., and publishes privacy contact addresses.

instacart.com ↗

[2025-02-28] · SHARING

Maplebear Inc.'s fiscal 2024 Form 10-K describes Carrot Ads as an enterprise offering that extends Instacart's advertising platform beyond Instacart's own marketplace onto other retailers' and partners' own websites and apps.

sec.gov ↗

[2026-01-15] · SHARING

Instacart's Privacy Policy (January 15, 2026) includes a state-law summary table listing, per category of personal information, the categories of third parties — including advertising and marketing partners and analytics providers — to whom Instacart may have sold/shared personal information or disclosed it for targeted advertising; the same policy commits to honoring Global Privacy Control opt-out signals as required under applicable laws.

instacart.com ↗

[2020-07-24] · TRACK RECORD

In July 2020, after personal data belonging to hundreds of thousands of Instacart customers was put up for sale on the dark web, Instacart published a statement saying its investigation showed the company 'was not compromised or breached' and attributed the account access to credential stuffing with passwords stolen from other sites; TechCrunch reported that Instacart did not offer two-factor authentication at the time.

techcrunch.com ↗

[2022-08-19] · TRACK RECORD

oag.dc.gov ↗

[2025-02-28] · TRACK RECORD

sec.gov ↗

[2025-02-28] · TRACKING TECH

Maplebear Inc.'s fiscal 2024 Form 10-K markets Instacart Ads to consumer brands as a way to reach customers at the moment of purchase, positioning ad targeting and measurement around the transaction itself.

sec.gov ↗

[2026-01-15] · TRACKING TECH

Instacart's Privacy Policy (January 15, 2026) discloses use of device identifiers, cookies, pixels, tags, APIs, and SDKs for interest-based advertising and measurement, and separately discloses that third-party session-replay services record users' interactions with the Services, including keystrokes.

instacart.com ↗

LAST REVIEWED 2026-08-04 · METHODOLOGY v1.7