Grocery loyalty programs: what your rewards card really records

The checkout takes a second. The cashier scans the card on your keychain or you key in your account details, the price drops a little, and the receipt shows how much you saved. What the receipt does not show is where the rest of that transaction goes next.

We read the documents that answer that question. Grocery loyalty programs are a data deal many American shoppers make every week, and this article uses Kroger as the example. The company calls itself one of the largest retailers in the United States and says it serves nearly 11 million customers a day in 35 states, including the District of Columbia. Its privacy notice, last updated September 9, 2026, covers Kroger stores as well as banners such as Fred Meyer, King Soopers, Smith’s, Mariano’s and QFC.

None of this is a reason to cut up your card. Loyalty programs are a trade, discounts for data, and plenty of people make that trade on purpose. It just helps to know the terms. Below we go through what the program records and where the data goes. Then come the app and a European program for comparison. At the end there is a list of settings worth changing.

What a grocery rewards card records

The core mechanism is a single sentence in the Kroger notice. If you enter your Rewards number or Alternate ID at checkout, Kroger says it will collect your purchase information “and associate it with you or your household.” Entering the Alternate ID counts just the same as scanning the card.

Note the word household. Kroger’s account category explicitly includes the “household’s unique ID numbers,” so a shared card puts several people’s groceries into one record. Your partner’s late-night ice cream and your teenager’s energy drinks can end up in the same history.

The list of categories in section 3 of the notice runs long. Kroger also writes that it only collects information when needed for particular purposes and that not every category applies to every customer. Still, the table below shows what the program can attach to that record.

The last row is the one to think about. Inferences are not something you typed in. They are conclusions drawn from what you bought, and Kroger says it uses them to personalize offers, coupons and marketing messages.

Some things are deliberately left out. Pharmacy records covered by the federal health privacy law HIPAA fall under a separate notice, as does The Little Clinic. Kroger also says that when it scans a driver’s license to verify age for a restricted purchase, it does not keep the license number afterward.

Retention has no fixed end date. Kroger writes that it keeps personal information associated with your rewards account “for as long as you remain a customer” or as otherwise needed for lawful and disclosed purposes. Compare that with the European example further down, where the program names fixed deadlines in years.

Where grocery loyalty programs send the data

You will not find the name 84.51° on your receipt. It is a wholly owned Kroger subsidiary that the notice describes as a “retail data science, insights, and media company.” It runs Kroger’s rewards programs, and it also serves business clients. In Kroger’s words, those clients are often consumer brands seeking to understand how purchasers of their products behave, or wanting to advertise to existing and prospective customers.

So the food brand whose cereal you buy may learn, in aggregate, how its buyers shop, and it may advertise to people like you through 84.51°. The subsidiary may use machine learning and artificial intelligence for this, according to the notice.

Outside the Kroger family, the sharing section lists several kinds of recipients. They include service providers for things like email and analytics, AdTech companies and, “where permitted by law,” third parties including payment providers, financial institutions, data brokers, social networks and marketing vendors.

The California section is where it gets concrete. It lists the categories of personal information Kroger has sold or shared in the prior 12 months and to whom. Identifiers, commercial information and inferences all appear there. Among the recipients are AdTech companies, social networks, data brokers and identity resolution providers. Those are firms that match records about the same person across different databases.

One footnote limits the inference sharing. Kroger says it makes inferences available to “a single data broker who is permitted to use them for aggregated reporting and insights.” That is narrower than it could be, though identifiers and commercial information are listed for the wider group of recipients.

The co-branded credit card adds another path. Kroger may use your data to include you in opportunities to apply for its card. A business supporting that card may then use automated decision-making technology to evaluate your eligibility, including your creditworthiness. Kroger states that it does not use that technology itself for those decisions. California residents can opt out of this use.

Why does a shopping history matter at all? In general, it can be a stand-in for a life. Baby formula, diabetic test strips, a sudden switch to gluten-free bread or a lot of wine on Fridays all say something about a household. Our piece on the advertising ID and the Databroker Files shows how far a single identifier can travel once it leaves the company that collected it.

The app knows more than the card

A plastic card only speaks at the register. The store app keeps talking. The Kroger notice lists GPS, beacons and “other location-identifying technologies” among the tools it may use to locate your device, for purposes like preparing a pickup order when you arrive or serving location-relevant advertisements. Beacons are small radio transmitters inside the store that a phone can detect. What it takes for a beacon to actually place you, and which settings stop it, is in our guide to Bluetooth beacons in stores.

One line describes what that looks like on your screen. If you have opted in to location-based services in the app, Kroger “may show marketing-related push notifications when you are in one of our stores.” In the California tables, precise geolocation is also listed for helping you navigate through the store and presenting relevant marketing.

The app also carries software development kits, small packages of third-party code. The notice says some of them personalize advertising and that, unlike cookies, they “cannot be controlled through browser settings.” Clearing your browser does nothing about them.

There is one more detail in the cookies section that is easy to miss. Kroger writes that its tracking technologies can record “keystrokes, cursor movements, scrolling activity, and clicks” on its websites and apps. That is how you shop online as well as what you buy.

How a European program handles the same trade

It helps to see the same deal written under different rules. In Germany, one of the best-known programs is Payback, which describes itself as the largest bonus program in everyday life and is used at drugstores, supermarkets and gas stations. Its privacy notice, dated January 2025, also starts with the receipt. Participating stores report your customer number together with goods, price, discount, place and time of each purchase. Without that, no points could be credited.

Everything beyond that requires a separate opt-in. Payback offers a consent for personalized advertising, and its wording is printed in full. With it, Payback and its partners may exchange data and build customer profiles, including purchase data from up to five years before the consent and probability values about what you might be interested in. Without it, you still collect and redeem points, and Payback says that profiling does not take place.

The comparison is not entirely fair. Payback is a points scheme run by one company across many stores, while Kroger is a single retailer with its own data science arm. The difference in default settings is still striking. At Payback, you have to say yes to profiling. Under the Kroger notice, it is part of the program, and opting out of the sale and sharing of your data depends on which state you live in. Not every German program works like Payback, though: Lidl Plus and DeutschlandCard treat personalization as part of the contract.

Are grocery loyalty programs worth it?

That is the question behind most searches on this topic, and the honest answer is that it depends on your receipts. Kroger’s privacy notice does not put a cents-per-dollar value on the program. The notice only names the building blocks, coupons and savings information and Points, and what they add up to depends on what you buy.

Payback, for comparison, is explicit. One point equals one cent, and many partners give one point per 2 euros spent. That is a base discount of about half a percent before coupons. Coupons can multiply it, and they are also the part most closely tied to the profiling.

If you shop at one chain every week, the discounts alone may be worth a lot to you. If you shop there twice a month, the math is thinner. Either way, the data side is the same, and the useful part is that most of it can be dialed down without leaving the program.

How to keep the discounts and share less

The following steps come from the Kroger notice itself. Where the notice names a menu or a center, we use its exact wording. Where it does not, we describe the route.

Turn off marketing preferences. Kroger says you can manage communication preferences by logging into your account on the website or app, under the “Preferences” section. Personalized offers by regular mail are switched off through the customer contact center. Flyers addressed to “Resident” may keep coming anyway.

Unsubscribe from emails and texts. Each marketing email has an unsubscribe option in the footer. For text messages, reply “STOP.” Marketing emails can also report back whether you opened them, which we explain in our piece on email tracking pixels.

Decide about location. The in-store push notifications depend on your opting in to location-based services. If you would rather not be located aisle by aisle, deny the app location access or limit it to while you are using it. Our guide on how to stop sharing location walks through those settings on iPhone and Android.

Use your state rights. Kroger lists extra privacy rights for residents of about 20 states, including California, with Louisiana and Oklahoma following on January 1, 2027. Check the state section of its privacy notice to see whether yours is covered. Nevada residents can opt out of the sale of their data, while the Washington section only covers consumer health data. For California, the notice names two ways to request access, deletion or an opt-out of sale and sharing. One is the Privacy Preference Center, the other the phone line 1-800-KROGERS.

Send a browser signal. Kroger says it treats a qualifying opt-out preference signal such as Global Privacy Control as an opt-out request under the California rules.

Opt out of interest-based ads. The notice points to the Digital Advertising Alliance opt-out page for ad tracking by AdTech companies on its sites. Google Analytics advertising features are controlled in Google’s own Ads Settings. You will still see ads, just ones that are less tied to your history.

Think twice about shared accounts. Everyone who uses the same card or Alternate ID at checkout feeds the same household record. If that matters to you, a separate account is the simple fix.

Ask what they have. Privacy questions go to [email protected] or the toll-free number above. In California, a request to know is possible twice within 12 months, and Kroger will verify your identity first. The answer shows what is actually stored, which is more useful than any settings page.

What stays with you

A grocery rewards card is a business deal, and Kroger’s notice is surprisingly open about it. The purchase record is the price of admission, since there is no member discount without it. Beyond that, the profile grows through choices you can make, from marketing preferences and location access to shared household accounts and the sale of your data.

Most of those switches can be turned off without giving up the savings. The marketing preferences take a minute, unsubscribing from emails and texts another, and location access a third. A Global Privacy Control signal and the ad industry opt-out cut down interest-based ads, and in the states Kroger lists with privacy rights, a single request at the Privacy Preference Center covers the sale and sharing of your data. Sending a request to know is the slowest step and the most revealing one. It shows in plain text what a few dollars off at checkout have cost.

Frequently asked questions

What data do grocery loyalty programs collect?

At minimum, your purchase history tied to your rewards number. The Kroger privacy notice, last updated September 9, 2026, goes much further: contact details, coupons and savings, preferred store, device identifiers, precise geolocation from the app, demographic details such as marital or family status and whether your family includes children, and inferences built from your shopping history combined with other data. Not every category applies to every shopper, but all of them are listed.

Do grocery stores sell your loyalty card data?

Kroger addresses this in its own notice, using the terms of California privacy law. In its California disclosures, Kroger lists the categories of personal information it has sold or shared in the prior 12 months, and the recipients include AdTech companies, social networks and data brokers. Inferences are made available to a single data broker for aggregated reporting and insights. Kroger also states that it does not sell or share the data of consumers it knows to be under 18.

Can I opt out of Kroger selling my data?

In the states Kroger lists with additional rights, yes, and in Louisiana and Oklahoma from January 1, 2027. The notice points to its Privacy Preference Center, where you choose the right you want to exercise, or to 1-800-KROGERS. A browser opt-out signal such as Global Privacy Control is treated as an opt-out of sale and sharing for cross-context behavioral advertising. Nevada residents can opt out of the sale of their data through the same Privacy Preference Center.

Are grocery loyalty programs worth it?

That depends on how much you save and how much you mind the trade. Kroger does not publish a single cents-per-dollar value for its rewards program, so the honest answer requires looking at your own receipts. The data side is easier to judge, because the privacy notice spells it out. If the savings matter to you, you can keep the card and still switch off location access, marketing messages and, depending on your state, the sale of your data.

Does using the store app collect more data than the plastic card?

Yes. A physical card only connects a purchase to your account at checkout. The app adds device identifiers and, if you opt in to location-based services, precise geolocation. Kroger writes that it may then show marketing-related push notifications while you are in one of its stores, and that GPS or beacons may be used to serve location-relevant advertisements. Without location permission, those features stay off.