The real price of store loyalty programs

CHARLOTTE — They promise discounts on gas, groceries, and more — but at what cost? Retail loyalty programs offer tempting perks yet often come with a hidden price: your privacy.

A new Consumer Reports investigation reveals one retailer pushing the limits, raising questions about how much personal information consumers are giving up — and who might follow their lead.

Signing up for a store loyalty program can unlock big savings — digital coupons tailored just for you, discounts at the pump, even important safety alerts about product recalls. For many shoppers, it feels like a no-brainer.

“So, there’s a price for those perks and it’s usually your information,” says Derek Kravitz is an investigative reporter with Consumer Reports. “Store chains often collect your name, home address, email address, and phone number, then study what’s in your grocery cart. Many retailers do this, but Kroger, one of the largest grocery chains in the U.S., is doing it in a much bigger, profitable way.”

A Consumer Reports investigation found Kroger collects and analyzes shopper data in highly sophisticated ways by tracking your purchases, building detailed profiles, and turning that data into profit. Kroger not only uses the information internally — it also sells it to third parties for targeted marketing and ads.

Last year alone, its “precision marketing” arm generated an estimated $527 million. The company’s so-called “alternative profit” ventures now make up more than 35% of its net income.

And what about the data Kroger is collecting? How accurate is it? Consumer Reports obtained shopper profiles from Oregon — one of the few states where consumers can legally access that kind of data. CR looked at the profiles. A lot of them were inaccurate about gender, age, how many people are in their household, their income, their education level.

In a statement to Consumer Reports, a Kroger spokesperson said, “demographic data can be helpful to filter our audiences so that Kroger customers are presented with relevant coupons, promotions, and other discounts or offers … Because we don’t rely on demographic data that we source from data enrichment providers, we do not affirmatively correct it.”

Kroger consumers can ask the company to correct their profile. To limit how your data is used, look for the company’s “How We Use Your Data” or “Privacy” policy online. It should say what information is collected and how you can opt out of certain tracking and marketing practices.

There are currently 15 U.S. states that require companies to let their customers opt out of having their data collected, shared, and sold: California, Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia.

Four additional states—Indiana, Kentucky, Maryland, and Rhode Island—have laws set to go into effect between now and Jan. 1, 2026.

Full statement from Kroger: “As disclosed in our privacy policy, we collect information from third-party sources including data enrichment providers. As we stated in our prior response, while purchase data is the most determinative factor, demographic data can be helpful to filter our audiences so that Kroger customers are presented with relevant coupons, promotions, and other discounts or offers that they can and do use to achieve greater savings at our stores. Because we don’t rely on demographic data that we source from data enrichment providers, we do not affirmatively correct it. However, if a customer believes that information on their access report is incorrect, the customer may submit a request to correct such data by following the processes outlined in our privacy policy. We don’t disclose information on how many of Kroger’s loyalty members are deemed “loyal” or the factors we use when creating this group, as this information is Kroger’s proprietary and confidential information.

With respect to online behavior, Kroger returns clipped and redeemed coupons in access reports. As disclosed in our privacy policy, we may collect race, ethnicity, health data, and other sensitive data and, when we do, it is for very limited purposes. However, for most Kroger grocery customers, we do not collect such information at all, which is reflected in their access reports. Separately, if Kroger has deidentified data, it is not linkable to an individual and we have controls in place to prevent reidentification. Because that data is not tied to a specific customer it is not possible to share it.”

Full statement from Harris Teeter: "Thank you for reaching out with your data collection practices questions.

Customer trust is very important at Harris Teeter. We take seriously our commitment to honor customer privacy rights and handle their personal data transparently and with care. Customers who want to better understand what information Harris Teeter collects, and how it uses and discloses such information, can at any time refer to Harris Teeter’s privacy policy, here."

(VIDEO >> What is ‘slow shopping,’ and how can it save you money?)