User:Johny2times/CVS Pharmacy
- References are messy, being a mere list of URLs; need real ref structure and in-text citations.
- Some incident information may or may not still be scattered out of place.
- Intro could use a short blurb that describes the company itself to better lead into the article.
Common issues include not following the correct preload outline (incident, company, product), references that don't use <ref></ref> or Cite web, leftover "WIP" markers, or long quotes not wrapped in Quote. You can help by applying the relevant preload sections, converting raw URLs into proper citations, and removing editor notes.
| Basic information | |
|---|---|
| Founded | 1963 |
| Legal Structure | Subsidiary |
| Industry | Retail |
| Also known as | CVS |
| Official website | https://www.cvs.com/ |
CVS Pharmacy, Inc. operates a U.S. retail pharmacy network and related digital services, including CVS.com, the CVS mobile app, prescription-management tools, pharmacy and healthcare-service messaging, photo services, delivery/order functions, and the ExtraCare and ExtraCare Plus loyalty programs. Customers may use these services to shop, manage prescriptions, receive coupons and rewards, obtain receipts, communicate with CVS, and access pharmacy- or health-related services.
Consumer-impact summary
[edit | edit source]User Freedom
[edit | edit source]CVS' digital services depend on customer accounts, online orders, payment processing, communications, and loyalty-program activity. Its Terms of Use state that CVS may change service features or discontinue parts of its services.
User Privacy
[edit | edit source]CVS has faced lawsuits pertaining to its failures to protect the private information of their consumers. They have also broadened the scope of data collection outlined by the Privacy Policy over time.
Incidents
[edit | edit source]FTC Privacy Lawsuit (2009)
[edit | edit source]In 2009, CVS Caremark agreed to settle Federal Trade Commission charges that alleged a failure to take reasonable and appropriate security measures to protect the sensitive financial and medical information of its customers and employees, in violation of federal law.
Forced arbitration clause update to Terms of Use (September 2026)
[edit | edit source]CVS' Retail Terms of Use were marked “Last updated: September 4, 2026.” The terms include an expanded dispute-resolution section requiring most disputes to proceed through individual binding arbitration, a jury-trial waiver, a class-action waiver, a mandatory 60-day informal dispute-resolution process, and special staged procedures for coordinated "mass filings."
2026 Privacy Policy Changes
[edit | edit source]An older CVSHealth.com privacy policy effective December 30, 2025 described a narrower corporate-web-service scope and expressly said that CVS store customers and general CVS.com visitors were covered by a different retail notice. The newer retail-facing policy discusses a wider CVS customer ecosystem, including stores, CVS.com, the CVS app, ExtraCare, ExtraCare Plus, pharmacy and healthcare-service text messages, targeted advertising, AI-supported tools, and in-store Automatic License Plate Recognition disclosures. This difference in scope means the documents may not be direct predecessor versions, even though they illustrate CVS’ evolving privacy disclosures.
CVS' updated retail privacy policy describes broader data collection and more detailed consumer-tracking practices, including shopping activity, searches, keystrokes, mouse movements, form entries, chat recordings, AI-tool inputs, and approximate location. It states that CVS may sell or share certain identifiers, commercial information, internet activity, and non-precise location data for targeted advertising, while offering opt-out, access, correction, and deletion rights depending on state law. The policy also discloses possible Automatic License Plate Recognition near stores and a typical 60-day retention period for that data.
No public response from CVS specifically addressing consumer concerns about expanded disclosures for behavioral tracking, targeted-advertising sharing, AI-supported tools, loyalty-program data practices, or Automatic License Plate Recognition was identified at the time of publication.
2026 Digital Privacy Lawsuit
[edit | edit source]Claims
[edit | edit source]Plaintiffs alleged that CVS and advertising-technology providers used tracking tools on CVS digital services that intercepted or disclosed sensitive health-related and browsing information without proper consent.
Company response
[edit | edit source]CVS and Criteo agreed to a proposed settlement. Public settlement information should not be treated as an admission of wrongdoing unless the settlement agreement or court order expressly states otherwise.
Outcome
[edit | edit source]The proposed settlement created a fund of up to $20.5 million for qualifying U.S. users of CVS digital properties before July 27, 2026, subject to final court approval.
As of September 14, 2026, CVS has not published a specific public statement or change log explaining the differences between the prior CVSHealth.com privacy policy and the newer retail privacy policy and Terms of Use. CVS’s published policies state that it may update the documents by posting revised versions and that it will provide appropriate notice and seek consent where required by applicable privacy law for material privacy-policy changes.