This Privacy Policy covers the Consumer Reports family of digital services, print publications and our other products, services and programs, and associated online and mobile websites, applications and digital tools (including those related to our consumer policy and mobilization activities) that refer to or provide an authorized link to this Privacy Policy (collectively "CR Products").

Information you give us
You may give us different types of information when you purchase a Consumer Reports product or service or otherwise engage with us, including:

• Identifiers such as contact information, name, email address, mailing address, telephone number, mobile number, user name and password
• Professional or employment-related information, such as the name of the business or organization you’re associated with, your title, and the business or organization's address, telephone number, and email address
• Audio, electronic, visual or similar information such as your photograph, an audio recording or a video of you
• Billing and payment card information where needed for payment
• Information about you and your household, including birthday and demographic information (e.g., age, gender and geographic location)
• Information about your experiences with specific products and services, including product models you own or considered
• Your opinions, actions and experiences regarding various topics and consumer policy issues
• Inferences based on the information we collect from or about you to create a profile reflecting your interests and preferences
• Information, including search and chat query information, relevant to your product research, ownership and/or purchases.

We may match the information we collect from you directly with the information we receive about you from other sources, and use such information along with information from those other sources.

Please note that personal information you submit to a CR publication or elect to post in a public area of a digital service is public. If you don’t want people to know your name, email address, or other information that identifies you personally, do not include that information in your public posts.

Additionally, you may choose to provide us with certain “sensitive personal information” to use in our reporting about consumer matters and in our advocacy work. We request that you not provide us with any Social Security number, financial account information, or similar sensitive personal information data when sharing your experiences with us.

Information collected when you use our products and services

We and our service providers collect certain information automatically about your online activities and your devices through technical means, including through the use of cookies, web beacons, and other technologies. This information may include the following:

• Internet or other electronic network activity information, including your Internet Protocol (IP) address (which is a unique numerical address that identifies your computer or other device when you access the Internet), your browser, device type and operating system, name of your Internet service provider, and your browsing history (including addresses of the websites you access before and after you visit Consumer Reports).
• Geo-location information which includes information about your real-world location at a given time based on latitude and longitude, as well as your general geographic area or more precise information about your street-level location.  Geo-location information may be derived from your IP address, which can be used to identify your general geographic area at a city or postal code level, from our online and mobile websites, applications and digital tools, which may collect precise information about your computer’s or device’s geographic location, and through other means. Information about your interactions with our content, Consumer Reports ads and communications, including the areas you visit on CR digital services and which of our Consumer Reports ads and content you see on other organizations’ websites (such as the Consumer Reports Facebook page) and whether you open email messages from us or click on Consumer Reports ads served by our ad partners when you visit other websites on which our ads appear.
• Device information, including the device type you use to access our digital services, your device’s operating system, and unique device identifier information (which is a unique alphanumeric character string associated with an individual user’s smartphone or similar handheld device).

Information we obtain from other sources

We collect additional information about you from other sources to help us correct and supplement our records, improve the quality of our products or services, and personalize your experience. These sources include service providers who provide us with your IP address in order to customize our service; payment service providers who provide us with information to process your payment; data providers who provide us with demographic, interest based and online advertising related data; organizations with which we have a business relationship to provide products and services to you; and information available through publicly available sources such as open government databases and publicly available posts on social media platforms.

The type of additional information we collect from these sources include your updated mailing address, payment card information, information from social media sources, engagement with our content (for example, comments or shares on our Facebook page), information about products and services you access through our business partners (for example, if you purchase a vehicle through our Car Buying service), information about your interests (e.g., pets, sports, travel, and cars), demographic data (e.g., age, gender, general income bracket, ethnicity, and children in household), and for certain of our consumer policy and mobilization activities, your legislative district information.

Use of Information
The information we collect is used for a variety of purposes. These include:

• Performing our obligations under any agreement between CR and you, including administering your account, processing transactions for CR Products, and communicating with you about your account;
• Supporting consumer policy and mobilization activities, such as running campaigns on consumer policy issues, and informing our efforts to recruit, train and connect our consumer activists;
• Customizing CR Products to provide you with a richer, more relevant experience;
• Conducting research including providing consumer insights and data to manufacturers, regulators, researchers and other third parties to help improve the marketplace;
• Contacting you regarding your use of CR Products and matters that affect you, including to inform our testing, reporting and editorial, and consumer policy and mobilization activities;
• Responding to your requests and comments and providing you with customer support;
• Updating and maintaining the accuracy of your information;
• Operating, optimizing and improving CR Products and their underlying technologies, including by conducting research and analytics;
• Conducting marketing and fundraising activities, including providing information about products and services that may be of interest to you (including services and benefits from our business partners), serving Consumer Reports ads, and managing sweepstakes and other promotional activities;
• Providing others with your information for the limited purposes described in this Privacy Policy, as may be described to you when collecting your personal information, or otherwise with your express consent; and 
• Evaluating or conducting a potential business transaction.

For more details, please see the table below.

The following chart details which categories of Personal Information we disclose, sell and/or share with third parties, as well as the purposes for processing those categories of Personal Information, including within the 12 months preceding the date this Privacy Policy was last updated. Please note that each user’s interaction with Consumer Reports may be different.

Categories of Personal Information	Disclosed to Which Categories of Third Parties for Operational Business Purposes	Sold to Which Categories of Third Parties	Shared with Which Categories of Third Parties for Cross-Context Behavioral or Targeted Advertising	Processing Purposes (See the chart below for a detailed description of each Processing Purpose)
Identifiers, such as: Contact information: name, alias, postal address, email address, telephone number, mobile number, user name and password Unique personal identifiers: IP address (which is a unique numerical address that identifies your computer or other device when you access the Internet), account name, online identifiers Vehicle Identification Number (VIN) when provided as part of the member survey	Affiliates; service providers; ad networks; social networks; business partners; marketing partners; other businesses; legal authorities; other parties in litigation	Ad networks; social media platforms; business partners	Ad networks; social media platforms	Providing CR Products and customer support including administering your account Operations and general business purposes Marketing and promotions (including sweepstakes), fundraising and personalization Cross-context behavioral and targeted advertising Improving and developing products and services Supporting consumer policy and mobilization activities, such as running campaigns on consumer policy issues, and informing our efforts to recruit, train and connect our consumer activists Conducting research including providing consumer insights and data to manufacturers, regulators, researchers and other third parties to help improve the marketplace Informing our testing, reporting and editorial, consumer policy, and mobilization activities If you subscribe to Consumer Reports magazine or any of our other print publications, sharing name and mailing address information with business partners for direct marketing purposes Sharing your information as maybe described to you when collecting your information or otherwise with your express consent Fraud prevention and security Legal and compliance ***Note***: We use government-issued identifiers only for “Legal and compliance” purposes.
Personal information as defined in the California customer records law, such as Contact Information: name, address, telephone number, date of birth Financial Information: financial account number and other financial information when provided to purchase our products or services or to make a donation or when provided as part of a campaign or mobilization effort Insurance Information: insurance policy number and other insurance information when provided as part of a campaign or mobilization effort Education and Employment Information when provided as part of a survey, campaign or mobilization effort	Affiliates; service providers; ad networks; social networks; business partners; marketing partners; other businesses; legal authorities; other parties in litigation	Ad networks; social media platforms; business partners	Ad networks; social media platforms	Providing CR Products and customer support including administering your account Operations and general business purposes Marketing and promotions (including sweepstakes), fundraising and personalization Improving and developing products and services Supporting consumer policy and mobilization activities, such as running campaigns on consumer policy issues, and informing our efforts to recruit, train and connect our consumer activists Conducting research including providing consumer insights and data to manufacturers, regulators, researchers and other third parties to help improve the marketplace Informing our testing, reporting and editorial, consumer policy, and mobilization activities If you subscribe to Consumer Reports magazine or any of our other print publications, sharing name and mailing address information with business partners for direct marketing purposes Sharing your information as maybe described to you when collecting your information or otherwise with your express consent Fraud prevention and security Legal and compliance ***Note***: We use government-issued identifiers only for “Legal and compliance” purposes.
Protected Class Information, such as characteristics of protected classifications under California or federal law, such as sex, age, gender, race.	Affiliates; service providers; other businesses; business partners; legal authorities; other parties in litigation	None	None	Providing our Services and customer support Operations and general business purposes Improving and developing new products and services Informing our testing, reporting and editorial, consumer policy, and mobilization activities Fraud prevention and security Legal and compliance
Commercial Information, such as transaction information and purchase history, including purchases considered, consuming histories or tendencies	Affiliates; service providers; ad networks; social networks; business partners; marketing partners; other businesses; legal authorities; other parties in litigation	Ad networks; social media platforms	Ad networks; social media platforms	Providing our Services and customer support Operations and general business purposes Marketing, promotions, and personalization Cross-context behavioral and targeted advertising Improving and developing new products and services Conducting research including providing consumer insights and data to manufacturers, regulators, researchers and other third parties to help improve the marketplace Informing our testing, reporting and editorial, consumer policy, and mobilization activities Fraud prevention and security Legal and compliance
Device Information and Online Activity, such as device and online identifiers, mobile and web network activity and related information (such as Mac address, cookie ID, browser, device type, operating system, name of Internet service provider, browser activity, search history, and information collected through cookies, web beacons, and other technologies), and social media information	Affiliates; service providers; ad networks; social networks; business partners; marketing partners; other businesses; legal authorities; other parties in litigation	Ad networks; social media platforms	Ad networks; social media platforms	Providing our Services and customer support Operations and general business purposes Marketing, promotions, and personalization Cross-context behavioral and targeted advertising Improving and developing new products and services Conducting research including providing consumer insights and data to manufacturers, regulators, researchers and other third parties to help improve the marketplace Informing our testing, reporting and editorial, consumer policy, and mobilization activities Fraud prevention and security Legal and compliance
Geolocation Data, such as approximate location derived from IP address	Affiliates; service providers; ad networks; social networks; business partners; marketing partners; other businesses; legal authorities; other parties in litigation	Ad networks; social media platforms	Ad networks; social media platforms	Providing our Services and customer support Operations and general business purposes Marketing, promotions, and personalization Cross-context behavioral and targeted advertising Improving and developing new products and services Conducting research including providing consumer insights and data to manufacturers, regulators, researchers and other third parties to help improve the marketplace Informing our testing, reporting and editorial, consumer policy, and mobilization activities Fraud prevention and security Legal and compliance
Audio/Video Data. Audio, electronic, visual, and similar information, such as photographs, audio and video recordings	Affiliates; service providers; business partners; other businesses; legal authorities; other parties in litigation	None	None	Providing our Services and customer support Operations and general business purposes Personalization Improving and developing new products and services Fraud prevention and security Legal and compliance
Education Information such as level of education completed	Affiliates; service providers; business partners; marketing partners; other businesses; legal authorities; other parties in litigation	None	None	Providing our Services and customer support Operations and general business purposes Personalization Improving and developing new products and services Informing our testing, reporting and editorial, consumer policy, and mobilization activities
Employment Information. Professional or employment-related information, such as the name of the business or organization you’re associated with, your title, and the business or organization's address, telephone number, and email address	Affiliates; service providers; business partners; legal authorities; other parties in litigation	None	None	Providing our Services and customer support Operations and general business purposes Improving and developing new products and Services Informing our testing, reporting and editorial, consumer policy, and mobilization activities Fraud prevention and security Legal and compliance
Inferences drawn from any of the Personal Information listed above to create a profile, for example, a profile reflecting your interests and preferences	Affiliates; service providers; ad networks; social networks; business partners; legal authorities; other parties in litigation	Ad networks; social media platforms	Ad networks; social media platforms	Providing our Services and customer support Operations and general business purposes Marketing, promotions, and personalization Cross-context behavioral and targeted advertising Improving and developing new products and services Conducting research including providing consumer insights and data to manufacturers, regulators, researchers and other third parties to help improve the marketplace Informing our testing, reporting and editorial, consumer policy, and mobilization activities Fraud prevention and security Legal and compliance
Sensitive Personal Information Racial or ethnic origin Medical information when provided in connection with a specific advocacy or mobilization campaign or research	Affiliates; service providers; business partners; legal authorities; other parties in litigation	None	None	Please see the section below, entitled “Collection, Processing, and Disclosure of Sensitive Personal Information.”
Information about your experiences with specific products and services, including product models you own or considered	Affiliates; service providers; business partners; legal authorities; other parties in litigation	None	None	Providing our Services and customer support Operations and general business purposes Marketing, promotions, and personalization Cross-context behavioral and targeted advertising Improving and developing new products and services Conducting research including providing consumer insights and data to manufacturers, regulators, researchers and other third parties to help improve the marketplace Informing our testing, reporting and editorial, consumer policy, and mobilization activities Fraud prevention and security Legal and compliance
Your opinions, actions and experiences regarding various topics and consumer policy issues	Affiliates; service providers; business partners; legal authorities; other parties in litigation	None	None	Providing our Services and customer support Operations and general business purposes Marketing, promotions, and personalization Cross-context behavioral and targeted advertising Improving and developing new products and services Conducting research including providing consumer insights and data to manufacturers, regulators, researchers and other third parties to help improve the marketplace Informing our testing, reporting and editorial, consumer policy, and mobilization activities Fraud prevention and security Legal and compliance

To see this table in PDF, click here.

We collect, disclose, sell, share, or otherwise process Personal Information to operate, manage, and maintain our business, and to provide our products and services, including to:

To see this table in PDF, click here.

Collection, Processing, and Disclosure of Sensitive Personal Information

Subject to your consent where required by applicable law, we collect, process, and disclose Sensitive Personal Information for purposes of providing goods or services as requested; conducting analytics; conducting research including providing consumer insights and data to manufacturers, regulators, researchers and other third parties to help improve the marketplace; informing our testing, reporting and editorial, consumer policy, and mobilization activities; activities relating to product improvement; and other collection and processing that is not for the purpose of inferring characteristics about an individual. We do not use Sensitive Personal Information beyond these purposes.

Please note that personal information you submit to a CR publication or elect to post in a public area of a digital service is public. If you don’t want people to know your name, email address, or other information that identifies you personally, do not include that information in your public posts. Additionally, you may choose to provide us with certain “sensitive personal information” to use in our reporting about consumer matters and in our advocacy work. We request that you not provide us with any Social Security number, financial account information, or similar sensitive personal information data when sharing your experiences with us.

Retention Period

We retain each category of Personal Information, including Sensitive Personal Information, for as long as needed or permitted in light of the purpose(s) for which it was collected. The criteria used to determine our retention periods include:

• The amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of the personal data, the purposes for which we process the personal data and whether we can achieve those purposes through other means;
• The length of time we have an ongoing relationship with you and provide services to you, for example, for as long as you have an account with us or keep using our services, and the length of time thereafter during which we may have a legitimate need to reference your Personal Information to address issues that may arise;
• Whether there is a legal obligation to which we are subject, for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them; and
• Whether retention is advisable in light of our legal position, such as in regard to applicable statutes of limitations, litigation or regulatory investigations.

We will endeavor not to keep personal information in a form that allows a Data Subject to be identified for any longer than is reasonably necessary for achieving the permitted purposes. At the end of the applicable retention period, we may destroy, erase from our systems, or anonymize personal information as part of such efforts.

As a non-profit membership organization engaged in consumer product testing, news reporting and consumer advocacy, we often engage with consumers like you online and through other communication channels. Your feedback and involvement are critical to our work on your behalf.

We want to give you control over how we use your information. Here’s how to opt-out of receiving communications from us:

• Opting out of promotional, consumer policy and mobilization communications, newsletters and alerts: 

• Opting out of postal mail promotional communications

We may send you promotional materials about our other products and services by postal mail. If you purchase or subscribe to one of our print publications, we may also share your postal mail contact information with third parties for their marketing purposes as described above under Sharing For Marketing Purposes.

If you do not want us to send you these promotional mailings or to share your contact information with third parties, please click here to manage your postal mail preferences or contact Member Support.

You can also call us at 1-800-333-0663 or write to us at:

• Opting out of fundraising communications

If you wish to opt out of receiving fundraising communications from us, please click here. You may also call us at 1-800-333-0663 or write to us at:

Consumer Reports
Fundraising Solicitations
P. O. Box 96552
Washington, DC 20090-6552

Because we schedule many fundraising communications in advance, it may take up to 8 weeks for an opt out request to become effective.

• Opting out of consumer surveys

We have supplementary policies for information collected through participation in our surveys. You can stop receiving consumer surveys by following the opt out instructions in each survey email invitation. You can also stop receiving future surveys by calling us at 1-800-333-0663 or by writing to us at:

• Opting out of digital advertising

To help maintain our independence and impartiality, we accept no outside advertising. However, we may place ads for our own products and services on our own sites and online properties. You may see ads for Consumer Reports on other websites and online properties you visit. Ads for CR Products may be customized to your interests and preferences based on information collected as you browse online, a practice that is often referred to as interest-based advertising. Tracking technologies like cookies and web beacons are used for these purposes. You can opt out of interest-based advertising, as well as advertising on your mobile device, by visiting TrustARC’s Ad Preference Manager.

Certain third parties that provide us with analytics services employ their own tracking technologies, such as cookies, when you visit our websites and other digital services. Those third parties are able to collect information about your online activities across our digital services and other websites and online services. You can opt out of data collection by some of these data providers by managing your cookies as described in our Cookie Policy and as follows:

• Opting out of Analytics

Some CR Products, including the Consumer Reports website, use Google Analytics Advertising Features and its associated tracking technologies to help display the CR ads you see on other websites, and to help us manage and optimize our online advertising efforts. To opt out of Google Analytics Advertising Features, visit Google’s Ad Settings page. Website users can also access the Google Analytics Opt Out Browser Add-on.

Some CR Products, including the Consumer Reports website, use Adobe Analytics and its associated cookies to help us understand how users engage with our CR Products. To opt out of Adobe Analytics cookies on our websites, click here.

• Opting out of Geo-location Sharing

If your computer or device is equipped with GPS, connects with wireless access points or hot spots, or communicates through cell towers or satellites, then your computer or device is able to use these features to determine its precise geographic location. The geographic location will be transmitted to CR in real time in accordance with the privacy settings you have set on your computer or device, and will continue to transmit the information to us until you have updated your settings to no longer do so.

• Opting out of Texting

We may send you text messages you have consented to receive as part of our text messaging program. You can cancel text messages at any time by texting "STOP". After you send "STOP", we may send you an additional text message to confirm that you have been unsubscribed. You will no longer receive text messages from that short code, but you may receive text messages if you are subscribed to other text lists. If at any time you have questions about the text messages, text "HELP". After you send "HELP" we will respond with instructions on how to use our service as well as how to unsubscribe. Message and data rates may apply.

Do Not Track

Some Internet browsers include the ability to transmit “Do Not Track” signals that give consumers control over the collection and use of web browsing information. CR does not process or respond to such signals in users’ web browsers at this time.

Cookies

We or our service providers may collect tracking information through cookies. You can opt out of accepting cookies or disable them from your browser. The Help function on most browsers contains information on how you can set your browser to notify you before accepting cookies or can disable them entirely. If you opt out of cookies, you will not be able to take advantage of various features of the Consumer Reports website that are available to other users. For example, we use cookies to recognize you by name when you return to this site so you don’t have to login again and provide your password. For more information and to manage cookies, please see the Consumer Reports Cookie Policy.

If you have provided your personal information to us in an online account for a CR Product, you can edit that information by logging in and visiting your account here.

If you registered to receive policy and mobilization-related communications from us, you can access and edit that information here.

For any other requests, please contact us in any of the ways described in our online Member Support portal.

We are committed to protecting your information. We have put in place physical, technical and administrative procedures designed to help safeguard and prevent unauthorized access and misuse of your information. When Consumer Reports transmits information over the Internet, we work to protect the information through the use of data encryption methods.

While we endeavor to protect the security and integrity of information we collect via our websites and other online properties, due to the inherent nature of the Internet as an open global communications vehicle, we cannot guarantee that any information, during transmission through the Internet or while stored on our systems or otherwise in our care, will be absolutely safe from intrusion by others, such as hackers.

Visit the Protection of Information page to learn more about how the information you provide is secured.

If you create an account on a CR website, you are responsible for maintaining the strict confidentiality of your account password and for any activity that occurs using your account credentials. Please notify us of any unauthorized use of your password or account or any other breach of security.

CR Products are intended for general audiences and are not directed to children. If you are the parent or guardian of a child under age 13 and believe your child has provided us with his or her personal information, please contact us. You must be 18 or older to participate in certain activities, such as contests and sweepstakes.

CR’s websites and other properties contain links to websites, applications and services and incorporate social networking features provided by third party sites, products and services (each, an “Other Product”). Such Other Products operate under their own privacy policies and/or terms of use. Similarly, if you purchase a CR Product or communicate with us through an Other Product, then that Other Product’s privacy policy and/or terms of use will control any information you provide to that company. We encourage you to review the Other Product’s privacy policy and terms of use, as applicable, before submitting your personal information.

We believe that consumers should know what information is being collected about them and exercise choice in how it is being used. This section describes how you may exercise your privacy rights and choices.

• Accessing your Information: We may collect information about you in connection with providing you with CR Products and for the other reasons described above. You can request a copy of this information here or by calling us at (800) 333-0663 (Monday-Friday 8 AM - 8 PM and Saturday 9:30 AM - 6 PM). Please limit your requests to twice in a 12 month period.
• Deleting your Information: You may request that we delete personal information collected about you, subject to certain exceptions (such as when we are required to keep the information for legal reasons). You can submit a deletion request here or by calling us at (800) 333-0663 (Monday-Friday 8 AM - 8 PM and Saturday 9:30 AM - 6 PM). Please limit your requests to twice in a 12 month period. Please note that requesting deletion will require the cancellation of your paid Consumer Reports membership(s) prior to submitting your request.
• Correcting Information: You may request that we correct any inaccurate personal information we maintain about you. If you have an online account with Consumer Reports, you can update your information by logging into your account here. Consumer Reports print members or Consumer Reports on Health subscribers can update their information here. For individuals without a Consumer Reports online account or a CR print subscription, we maintain very limited information about you. If you believe we have collected information about you and would like to correct it, you can reach Member Support at +1(800) 333-0663 (Monday-Friday 8 AM - 8 PM and Saturday 9:30 AM - 6 PM).
• Opting Out of Sharing Your Information and from Targeted Ads: We use online technologies (or cookies) to track the pages you visit on the Consumer Reports website and share that information with third parties to serve you offers of Consumer Reports products and services after you leave our website. This is known as cross context behavioral advertising or targeted advertising. If you prefer not to receive these targeted offers which help support our mission, you can turn off these cookies by visiting the “Do Not Sell or Share My Personal Information” link located in the footer of the ConsumerReports.org website.
• Limiting Processing of Personal Information: We may, on occasion and where permitted by law, process your personal information based on your consent. If you would like to object to, or request the restriction of, processing of your personal information, or withdraw your consent in accordance with applicable law, you can email us at privacy@consumer.org. Please (i) provide your first and last name, email address, and address of residency; (ii) indicate that you wish to object to, or limit, the processing of your personal information, or withdraw your consent, and (iii) include the following in the subject line “Request to Limit Processing/Withdraw Consent”. Once we receive your request, we may verify it by requesting information sufficient to confirm your identity. Please note that we reserve the right to deny a request as allowed by applicable law, such as where your identity cannot be confirmed, where we believe that the request may be fraudulent, or otherwise in accordance with law.
• Freedom from Discrimination: Consumers should not be discriminated against for exercising their privacy rights. Consumer Reports will not treat you differently for exercising your rights.

California Privacy Rights

This section provides additional information with respect to personal information that is subject to the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act of 2020 (“CCPA”). This section should be read together with the rest of our Privacy Policy, which includes other important information about our handling of your personal information.CCPA requires that companies covered by the law make certain disclosures and provide certain rights to California residents. As a not-for-profit organization, CR is not covered by the CCPA, but we make the following disclosures consistent with our role as marketplace leader:

• As further described in the “How We Collect Information” section above, we collect, and have collected over the prior 12 months, the following categories of personal information. Please note that we may not have collected all categories of information for every individual.
  • Identifiers/Contact Information
  • Personal information categories listed in the California Customer Records provision such as payment information
  • Information Related to Characteristics Protected Under California or Federal Law
  • Commercial Information including products or services purchased, obtained or considered, or other purchasing histories
  • Internet or other electronic network activity information
  • Geo-location data
  • Electronic, Visual, and Audio Information
  • Professional or employment-related information
  • Educational Information
  • Inferences drawn from the above.

• We use and disclose this information for the business purposes described in this policy, including to audit the CR Products, detect security incidents and prevent fraud, debug and repair errors, maintain your account, provide customer service, process and fulfill orders, verify customer information, conduct research, undertake activities to improve the CR Products, market the CR Products, and understand how users interact with the CR Products.

• We sell (as defined by California law) the following categories of personal information with respect to our online users:
  • Identifiers/Contact Information
  • Internet or other electronic network activity information
  • Inferences drawn from the above.

• Additionally, we sell (as defined by California law) the following categories of personal information with respect to our print members:
  • Identifiers/Contact Information
  • Commercial Information including products or services purchased or obtained
  • Inferences drawn from the above.

• Right to Know: California residents have the right to request that California Covered Businesses disclose to them, twice in a 12 month period, the personal information they have collected, used, shared, or sold about them, including:
  • The categories and specific pieces of personal information collected;
  • The categories of sources from which the business collected the personal information;
  • The purposes for which the business uses the personal information;
  • The categories of third parties with whom the business shares the personal information; and
  • The categories of information that the business sells or discloses to third parties.

California residents can request a copy of this information here or by calling us at (800) 333-0663 (Monday-Friday 8 AM - 8 PM and Saturday 9:30 AM - 6 PM). Please limit your requests to twice in a 12 month period.

• Right to Delete: California residents have the right to request that California Covered Businesses delete personal information collected from them, subject to certain exceptions. California residents can submit a deletion request here or by calling us at (800) 333-0663 (Monday-Friday 8 AM - 8 PM and Saturday 9:30 AM - 6 PM). Please limit your requests to twice in a 12 month period. Please note that requesting deletion will require the cancellation of your paid Consumer Reports membership(s) prior to submitting your request.

• Right to Opt-Out of Sale or Sharing: California residents have the right to request that California Covered Businesses stop selling or sharing their personal information for targeted advertising. Consumer Reports uses online technologies (or cookies) to track the pages you visit on the Consumer Reports website and share that information with third parties to serve you offers of Consumer Reports products and services after you leave our website. If you prefer not to receive these targeted offers which help support our mission, you can turn off these cookies by visiting the “Do Not Sell or Share My Personal Information” link located in the footer of the ConsumerReports.org website.

• Right to Correct: California residents have the right to request that California Covered Businesses correct any inaccurate personal information collected about them. You may request that we correct any inaccurate personal information we maintain about you. If you have an online account with Consumer Reports, you can update your information by logging into your account here. Consumer Reports print members or Consumer Reports on Health subscribers can update their information here. For individuals without a Consumer Reports online account or a CR print subscription, we maintain very limited information about you. If you believe we have collected information about you and would like to correct it, you can reach Member Support at (800) 333-0663 (Monday-Friday 8 AM - 8 PM and Saturday 9:30 AM - 6 PM).

• Right to Limit Use and Disclosure of Sensitive Personal Information: California residents have a right to direct California Covered Businesses to use their sensitive personal information (such as social security number, financial account information, racial or ethnic information, precise geolocation data, and genetic data) only for limited purposes, such as to provide customers with the services requested, detect security incidents and prevent fraud. California residents can request that we limit the use of your sensitive personal information in accordance with applicable law by clicking here. Please note that we may still process your sensitive personal information for certain purposes, such as to provide you with services you have requested, protect the safety and security of services, and comply with our legal obligations.

• Freedom from Discrimination: California residents have the right to be free from discrimination for exercising their privacy rights.

California Shine the Light Law

Under California law, residents of the State of California may request from us once per year and free of charge a list of all third parties to whom your personal information has been disclosed during the preceding year for those third parties' direct marketing purposes. If you are a California resident and want such a list, please submit your request in writing in one of the following two ways:

Email us at: privacy@consumer.org or write to us at:
Consumer Reports
Attn: Legal Department
101 Truman Avenue
Yonkers, NY 10703

For all requests, you must put the statement "Your California Privacy Rights" in the subject line of your request and include your name, street address, city, state, and zip code.

Other States Privacy Rights

Certain states provides rights to residents of the respective states regarding the collection and processing of their personal information by covered companies. As a not for profit organization, Consumer Reports is not subject to many of those state laws, but provides the rights described in the section of this Privacy Policy entitled “Your Privacy Rights and Choices” consistent with CR’s role as a marketplace leader. If you are a resident of any of these states and wish to exercise these rights, you can submit a request using the methods listed below:

• Request to Access Personal Information: You can submit an access request here or by calling us at (800) 333-0663 (Monday-Friday 8 AM - 8 PM and Saturday 9:30 AM - 6 PM). Please limit your requests to twice in a 12 month period.
• Request to Delete Personal Information: You can submit a deletion request here or by calling us at (800) 333-0663 (Monday-Friday 8 AM - 8 PM and Saturday 9:30 AM - 6 PM). Please limit your requests to twice in a 12 month period. Please note that requesting deletion will require the cancellation of your paid Consumer Reports membership(s) prior to submitting your request.
• Request to Correct Personal Information: If you have an online account with Consumer Reports, you can update your information by logging into your account here. Consumer Reports print members or Consumer Reports on Health subscribers can update their information here. For individuals without a Consumer Reports online account or a CR print subscription, we maintain very limited information about you. If you believe we have collected information about you and would like to correct it, you can reach Member Support at (800) 333-0663 (Monday-Friday 8 AM - 8 PM and Saturday 9:30 AM - 6 PM).
• Opt Out of Sale or Processing of Personal Information for Targeted Advertising: You can opt out of the sale of their personal information and the sharing or processing of personal information for targeted advertising purposes. You can exercise these opt-out choices by visiting the “Your Privacy Choices” link located in the footer of the ConsumerReports.org website.

If we decline to take action on one of your rights and you are a resident of any state that provides a right of appeal, you can submit an appeal by contacting us at privacy@consumer.org and provide (i) your first and last name, email address, and address of residency; (ii) the date that you initially submitted the request; (iii) an overview of the decision you are appealing; and (iv) include the following in the subject line “Appeal” followed by the state of your residence (e.g “Appeal - Virginia”).

Nevada Rights

If you are a Nevada resident, you can request that a company not sell your personal information for monetary consideration even if it is not currently being sold. We do not believe that we sell your personal information in this way, but we do offer you the ability to opt out by emailing us at privacy@consumer.org. Please (i) include your first and last name, email address, and address of residency; (ii) indicate that you would like to opt out of any sale of your personal information under Nevada Law; and (iii) include “Opt-out: Nevada” in the subject line.

The following section applies to persons from a country outside of the United States (“Data Subjects”):

Lawful Basis for Processing Personal Information
Under applicable laws in countries other than the United States, entities like CR that act as data controllers in connection with the processing of personal information must have a lawful basis for processing that information. CR needs to collect and process certain types of personal information from Data Subjects in order to provide CR Products and otherwise comply with our legal obligations. The lawful bases that we rely upon to process the personal information held about Data Subjects are as follows:

• To carry out our obligations arising from our agreements with Data Subjects, such as membership, subscriptions and donations, and to take steps at Data Subjects’ request prior to entering into such agreements.
• To send communications to Data Subjects about our activities and offerings to the extent we have Data Subject consent or when doing so is in our legitimate interests (and not overridden by the interests or fundamental rights and freedoms of Data Subjects).
• To comply with our legal obligations.
• For consumer policy and mobilization purposes carried out in CR’s legitimate interests and in compliance with your fundamental rights and freedoms.
• For direct marketing purposes carried out in CR’s legitimate interests and in compliance with your fundamental rights and freedoms.

Retention Period
We retain each category of Personal Information, including Sensitive Personal Information, for as long as needed or permitted in light of the purpose(s) for which it was collected. The criteria used to determine our retention periods include:

• The amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of the personal data, the purposes for which we process the personal data and whether we can achieve those purposes through other means;
• The length of time we have an ongoing relationship with you and provide services to you, for example, for as long as you have an account with us or keep using our services, and the length of time thereafter during which we may have a legitimate need to reference your Personal Information to address issues that may arise;
• Whether there is a legal obligation to which we are subject, for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them; and
• Whether retention is advisable in light of our legal position, such as in regard to applicable statutes of limitations, litigation or regulatory investigations.

We will endeavor not to keep personal information in a form that allows a Data Subject to be identified for any longer than is reasonably necessary for achieving the permitted purposes. At the end of the applicable retention period, we may destroy, erase from our systems, or anonymize personal information as part of such efforts.

Storage and Transfer of Personal Information
We maintain physical, electronic and procedural safeguards designed to protect Data Subjects’ personal information, prevent unlawful or unauthorized processing of personal information, and prevent unauthorized disclosure of, or accidental loss of, or damage to, such information.

We may process personal information in, and transfer personal information to, countries that may not guarantee the same level of protection for personal information as the country in which Data Subjects reside, and which may not have received an adequacy decision from the European Commission.

Personal information will also be processed by staff who work for us and operate outside the European Economic Area. This includes staff engaged in, among other things, the provision of administration and support services. All such staff are subject to appropriate confidentiality and security obligations.

We restrict access to non-public personal information about Data Subjects to those of our employees and agents who need to know the information to enable us to provide services.

For more information about steps we take to protect your personal data, please click here.

Rights in relation to Personal Information
Data Subjects have certain rights in relation to their personal information, including the right to be informed about the collection and use of their personal information, as outlined in this Privacy Policy.
These include, where certain conditions are met:

• the right to request access to the personal information we hold about them
• the right to have inaccurate information about them amended or updated
• the right to object to processing of personal information about them
• the right to withdraw consent at any time (where relevant)
• the right to have personal information about them erased or to restrict processing in certain limited situations
• the right to lodge complaints with applicable data supervisory authorities.

Data Subjects should use the contact information below to get more information and/or to make a formal request.

We will endeavor to keep the personal information we store about Data Subjects reasonably accurate and up-to-date by enabling Data Subjects to correct it by request or by logging into their account and correcting it directly. Data Subjects should notify us if any of their personal information changes or if they become aware of any inaccuracies in the personal information we hold about them.

If you have any questions regarding this Privacy Policy or our privacy practices, please contact us at privacy@consumer.org and we will do our best to address your concern. You may also contact:

• The Direct Marketing Association's Committee on Ethical Business Practices at ethics@the-dma.org
• Your state or local consumer protection office
• The Better Business Bureau (BBB), or
• The Federal Trade Commission (FTC) by phone at (202) 326-2222 or online at http://www.ftc.gov.

Any disputes regarding this Privacy Policy are subject to our User Agreement.

We may change or update this Privacy Policy from time to time. When we do, we will post the revised Privacy Policy on this page with a new “Last Updated” date. If we make a change that affects Personal Information that we collected prior to the change, depending on the nature of the change, we may notify you of the change and may request your consent to the change. If you use the CR Products or other products and services after the “Last Updated” date, you are deemed to have consented to our updated privacy policy, provided that we will obtain your affirmative consent where legally required and otherwise subject to applicable law.