Target Corporation's guest-facing privacy policy discloses broad collection of transactional, browsing, cookie, and device-identifier data that is merged across its websites and apps for advertising and personalization, and the policy identifies specific categories of personal information it 'sells or shares' for cross-context behavioral advertising, along with the categories of third parties that receive it. The company's 2013 payment-card breach, and the resulting multistate attorney general settlement and related class-action and financial-institution settlements, constitute the most significant entries in its public regulatory record, while corporate ownership is transparently disclosed through routine SEC filings as a publicly traded Minnesota corporation. Historically, Target's internal predictive-analytics program, reported by the New York Times in 2012, illustrated the retailer's capacity to infer sensitive life events, such as pregnancy, from ordinary purchase data tied to a persistent Guest ID.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2017-05-23]
Target's 2013 data breach, disclosed that December, exposed payment card data for more than 41 million customer accounts and contact information for more than 60 million customers after attackers used credentials stolen from a third-party vendor to access a customer service database; in May 2017 Target agreed to pay $18.5 million to 47 states and the District of Columbia to resolve the multistate investigation, and to implement encryption, network segmentation, and other security measures.
In 2017, Target Corporation agreed to an $18.5 million settlement with 47 states and the District of Columbia resolving allegations that it failed to provide reasonable data security ahead of its 2013 holiday-season data breach, which the California Attorney General's office described as the largest multistate data breach settlement to that date.
Target's privacy policy states it may combine information collected automatically about visitors with information it already holds in order to identify them as a Target guest, and separately states it collects information about existing and potential guests from other sources to improve record accuracy.
As reported by the New York Times in February 2012, Target assigned shoppers a persistent Guest ID and built a statistical model analyzing roughly 25 products to assign each shopper a 'pregnancy prediction' score and estimate a due date, based on purchase-history data.
According to 2012 reporting, a Target statistician built a model that analyzed customer purchase data to assign shoppers a 'pregnancy prediction' score and estimate due dates, a predictive-analytics practice that inferred a sensitive life event from routine purchase records.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
Target Corporation's SEC Form 10-K filings identify it as a Minnesota corporation whose common stock trades on the New York Stock Exchange under the symbol 'TGT,' with its principal executive offices in Minneapolis, Minnesota.
Target Corporation's SEC Form 10-K filings publicly identify it as 'A Minnesota Corporation' and list its significant subsidiaries by name and jurisdiction as part of its annual regulatory disclosures.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
Target's California Business Privacy Notice names 'Roundel' as a distinct internal business through which cross-context behavioral advertising sharing occurs, providing some visibility into the corporate structure behind its advertising data practices, though the consumer notice does not elaborate on Roundel's corporate relationship to Target Corporation.
Target's California privacy notice lists specific categories of personal information about guests that Target 'sells or shares' for cross-context behavioral advertising, along with the categories of third parties that receive it.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
Target's California Business Privacy Notice discloses that the company does not share business-contact personal information for cross-context behavioral advertising or sell it, except in connection with its Roundel advertising business, and that this Roundel-related sharing may itself be considered a 'sale' under California law.
In 2015, Target Corporation agreed to a $10 million class-action settlement with consumers affected by its 2013 data breach, in a case filed in U.S. District Court in Minneapolis, with the agreement also requiring Target to appoint a chief information security officer and expand employee security training.
Target's 2013 data breach, disclosed that December, exposed payment card data for more than 41 million customer accounts and contact information for more than 60 million customers after attackers used credentials stolen from a third-party vendor to access a customer service database; in May 2017 Target agreed to pay $18.5 million to 47 states and the District of Columbia to resolve the multistate investigation, and to implement encryption, network segmentation, and other security measures.
In 2017, Target Corporation agreed to an $18.5 million settlement with 47 states and the District of Columbia resolving allegations that it failed to provide reasonable data security ahead of its 2013 holiday-season data breach, which the California Attorney General's office described as the largest multistate data breach settlement to that date.
In addition to the 2017 multistate settlement, Target separately settled with financial institutions affected by the 2013 breach for $39 million in 2015, and in the same year settled a consolidated consumer class action by awarding funds to affected customers and covering plaintiffs' attorneys' fees.
Target's privacy policy discloses that the company uses cameras in and around its stores, describing their purpose as measuring traffic patterns and tracking in-stock levels, in addition to fraud detection, theft prevention, and security.