Ulta Beauty, Inc. (Nasdaq: ULTA) is a publicly traded, Delaware-incorporated beauty retailer operating stores, ulta.com, and the Ulta Beauty app, with its Ultamate Rewards loyalty program as a core data source. Ulta's own privacy policy discloses collecting biometric facial-geometry data through its Virtual Beauty Try-On feature, using persistent cookies and pixels to serve advertising both on and off its sites, and explicitly self-declaring under California law that making IP addresses and other persistent identifiers available to advertising partners may constitute a 'sale' or 'share' of personal information. Apple's App Store privacy label confirms Purchases, Financial Info, Contact Info, Search History, Identifiers, and Usage Data may be used to track users across apps and websites owned by other companies. Corporate ownership is traceable through routine SEC 10-K filings. No FTC or state-AG enforcement action or confirmed data breach was found; a class action lawsuit filed in California federal court in August 2026 alleges Ulta and a Meta tracking pixel intercepted and transmitted website visitors' electronic communications without consent, an unresolved allegation rather than an adjudicated finding.
TRACK RECORD
1 ENFORCEMENT ACTION
[2026-03-26]
Ulta Beauty's own 10-K risk factors acknowledge that failure to protect personal data from unauthorized access, use, or other processing could result in enforcement actions, regulatory investigations, and guest claims for damages — the company discloses this as an ongoing risk rather than reporting a confirmed incident.
Ulta's privacy policy discloses collecting biometric information, specifically facial geometry, when a guest uses the Virtual Beauty Try-On feature or related features on its sites, in stores, or through its products.
Ulta Beauty, Inc.'s SEC Form 10-K cover page identifies it as a Delaware-incorporated public company with a listed IRS Employer Identification Number, filed as part of its annual regulatory disclosures.
Ulta's privacy policy discloses that it makes guests' IP addresses and other persistent online identifiers available to its advertising partners, and explicitly states this may constitute a 'sale' or 'sharing' of personal information under California law.
Ulta Beauty's own 10-K risk factors acknowledge that failure to protect personal data from unauthorized access, use, or other processing could result in enforcement actions, regulatory investigations, and guest claims for damages — the company discloses this as an ongoing risk rather than reporting a confirmed incident.
Apple's App Store privacy label for the Ulta Beauty app discloses that Purchases, Financial Info, Contact Info, Search History, Identifiers, and Usage Data may be used to track users across apps and websites owned by other companies.
Ulta's privacy policy discloses that persistent cookies -- which can be both first-party and third-party managed -- are used to bring guests advertising both on and off Ulta's sites, and that pixels are used in combination with cookies to track browser and device activity.