That little scan at the register feels harmless. You get points, you save money, everybody wins. Except that’s not really how it works.
When you sign up for a grocery loyalty card or a coffee shop rewards app, the store starts collecting a lot more than just your order. Testimony submitted to the Maryland General Assembly notes that many grocery loyalty programs go way beyond tracking what you buy — some even track your precise movements inside the physical store. Like, where you walked. Which aisle you stood in. How long you lingered.
That information gets bundled into a detailed profile about you. And then, according to that same testimony, it is regularly sold — to other retailers, social media companies, and data brokers, which are basically companies whose entire business model is trafficking in your personal information.
California’s Attorney General said it plainly: these brick-and-mortar stores are finding new ways to profit from your data. The discount on your receipt isn’t the product. You are.
Here’s the part that gets uncomfortable. It’s not just about being shown ads for things you already bought. The Maryland testimony specifically mentions insurers and employers as potential recipients of this data — meaning what’s in your shopping cart — your medications, your food, your habits — could theoretically shape decisions about you that have nothing to do with shopping.
And even when the inferences are accurate, that doesn’t make them okay. As one privacy researcher put it in a Texas Standard report on grocery loyalty programs: “I don’t like people inferring anything about me based on what’s in my shopping cart.”
So what can you actually do?
The most obvious answer is: don’t sign up. If you’re not in the program, they can’t collect on you through it. That’s not always realistic — sometimes the discount is real and you need it — but it’s worth knowing that opting out is always an option.
If you’re already in a program, some states with privacy laws give you rights to request what data a company has on you and ask them to delete it. California is the most prominent example, but protections vary a lot by state — check your state’s attorney general website to find out what rights you actually have where you live. Look for the privacy policy on the app or website and see what options exist.
And if you’re in a state with stronger privacy laws, businesses may be legally required to disclose what they collect and why. The California AG has already put loyalty program operators on notice for violating those rules — so this isn’t a gray area in states like California. Companies are supposed to tell you what they’re doing with your data.
The short version: the free coffee isn’t free. The discount isn’t the deal. And knowing that is the first step to making smarter choices about what you hand over just to save a dollar.