Nordstrom, Inc. is a Seattle-based department-store retailer (Nordstrom, Nordstrom Rack, the Nordy Club loyalty program) that was taken private in May 2025 by the founding Nordstrom family together with Mexican retailer El Puerto de Liverpool, S.A.B. de C.V., a transaction documented in a public SEC Schedule 13E-3 going-private filing. Its privacy policy discloses building loyalty-program profiles (preferred brands, merchandise interests, income range) retained indefinitely while a customer, using SDKs, web beacons and tracking pixels to track users' movements across its websites and apps, and working with 'advertising partners' in activities it says 'may be considered "selling" or "sharing"' personal information under California law; its self-run Nordstrom Media Network additionally monetizes shopper data as an on-site/off-site ad program. Its own App Store privacy label confirms cross-app/cross-site tracking. In November 2018, Nordstrom notified employees (not customers) that a contract worker had improperly handled personal data including Social Security numbers, pay-card and bank account numbers, and salary information; the company found no evidence of misuse. No FTC or state-AG enforcement action was found.
TRACK RECORD
1 ENFORCEMENT ACTION
[2018-11-05]
Nordstrom's own November 2018 data-breach notification letter, filed with the California Attorney General, confirms a contract worker improperly handled employee personal data including Social Security numbers, pay-card and bank account numbers, and salary information, while stating the company found no evidence the data was shared or misused.
Nordstrom's privacy policy discloses that it collects and retains Nordy Club loyalty-program profile data -- including preferred product sizes and brands, merchandise interests, and self-reported income range -- for as long as the person remains a customer, which the policy frames as an indefinite retention window tied to legal or business-interest needs.
Nordstrom's SEC Schedule 13E-3 going-private filing names the controlling parties in the May 2025 take-private transaction: Norse Holdings, Inc. and its merger subsidiary, Mexican retailer El Puerto de Liverpool, S.A.B. de C.V., and named Nordstrom-family trusts including the Anne E. Gittinger Trust u/w Everett W. Nordstrom.
Nordstrom's SEC Form 8-K confirms shareholders approved the Merger Agreement with Norse Holdings' acquisition subsidiary at a May 16, 2025 special meeting, resulting in the company surviving as a wholly owned subsidiary of the acquiring parent.
Nordstrom operates its own retail-media advertising business, the Nordstrom Media Network, which its own site describes as monetizing on-site and off-site customer touchpoints to deliver personalized ads and recommendations for outside brands.
Nordstrom's privacy policy states it works with advertising partners to show targeted ads and explicitly acknowledges these activities may constitute a 'sale' or 'share' of personal information under California privacy law, requiring a separate opt-out.
Nordstrom's own November 2018 data-breach notification letter, filed with the California Attorney General, confirms a contract worker improperly handled employee personal data including Social Security numbers, pay-card and bank account numbers, and salary information, while stating the company found no evidence the data was shared or misused.
Apple's App Store privacy label for the Nordstrom app discloses that Purchases, Location, Contact Info, Identifiers, Usage Data, Diagnostics and Other Data may be used to track users across apps and websites owned by other companies.
Nordstrom's privacy policy discloses using web beacons, tags, software development kits (SDKs) and scripts to analyze trends and track users' movements around its websites and apps.