Walmart discloses an extensive set of privacy notices across its corporate family (Walmart, Sam's Club, Walmart Connect, Walmart Insurance Services, and others) that describe collection of identifiers, device/browsing data, location, and in some contexts biometric information, along with disclosure of that data to affiliates, vendors, and advertising partners. The company is a publicly traded corporation (NYSE: WMT) with ownership and board composition disclosed in detail through SEC filings, though those filings show concentrated voting control by the Walton family. Walmart's track record includes multiple Illinois Biometric Information Privacy Act lawsuits and settlements, a pharmacy-data breach involving a third-party vendor, and pending litigation alleging undisclosed sharing of customer data with third parties such as Meta and Clearview AI.
TRACK RECORD
1 ENFORCEMENT ACTION
[2026-02-26]
In February 2026, Walmart agreed to a $100 million judgment settling FTC and 11 states' charges that it misrepresented delivery-driver earnings through its Spark Driver program; this settlement centered on pay-practice disclosures rather than data handling.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
Walmart Insurance Services' Privacy Notice, updated May 7, 2025, discloses passive collection of technical device information including IP address, device type, operating system, and browser type when consumers visit its websites or apps.
Walmart's Sam's Club Visitor Privacy Notice, last updated February 19, 2026, lists biometric information as a collected category, including voice prints, iris imagery, face geometry, and palm or fingerprints.
Walmart's 2017 SEC proxy statement (DEF 14A) discloses that approximately 51% of the company's shares are held by members of the family of founder Sam Walton.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
A Schedule 13G/A filed with the SEC discloses that, as of December 2024, Walton Enterprises LLC held over 3 billion shares and the Walton Family Holdings Trust held over 600 million shares of Walmart common stock.
Walmart's April 2025 proxy statement discloses that the Board has not made an independence determination for two sitting directors who are Walton family members, Greg Penner and Steuart Walton.
Walmart Connect's privacy policy grants California residents the right to opt out of the company's selling or sharing of personal information for cross-context behavioral advertising, indicating such sharing occurs absent an opt-out.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
A July 2024 class action filed in Arkansas federal court alleges Walmart transmitted customers' video-viewing information, including a Facebook identifier, to Meta through the Meta Pixel without consent, in violation of the Video Privacy Protection Act.
A 2025 BIPA lawsuit alleges Walmart's Illinois stores use software to match facial scans captured in stores against Clearview AI's facial recognition database; a Walmart spokesperson has stated the company is not a Clearview client.
Walmart's Sam's Club Privacy Notice, updated December 20, 2025, states that personal information may be disclosed to other retail and non-retail companies within Walmart's corporate family, such as Walmart and One Finance.
In 2021, Walmart agreed to a $10 million settlement resolving Illinois Biometric Information Privacy Act claims brought by employees over fingerprint-scan timekeeping conducted without the alleged required consent.
A February 2021 data breach at third-party vendor CaptureRx exposed the prescription information, names, and dates of birth of more than 2.6 million customers, including Walmart pharmacy patients, leading to a $4.75 million settlement approved in 2024.
In February 2026, Walmart agreed to a $100 million judgment settling FTC and 11 states' charges that it misrepresented delivery-driver earnings through its Spark Driver program; this settlement centered on pay-practice disclosures rather than data handling.
Walmart's Sam's Club Privacy Notice discloses that in-store cameras and automated technologies, including Automated License Plate Readers, may be used on its properties for security, theft deterrence, and store design purposes.
A biometric privacy class action alleges that Illinois Walmart store locations are equipped with facial-recognition-enabled video surveillance systems.
The same Walmart Insurance Services Privacy Notice discloses use of first-party and third-party cookies, web beacons, and mobile device identifiers to collect information about use of its websites and mobile services for a more personalized shopping experience.