Terms Unconditional

F500 Retail & Grocery · Specialty Retailers: Apparel · Structural / no discrete incident

Gap

Headline

Gap, Old Navy, Banana Republic and Athleta share one company and one loyalty infrastructure, so a customer shopping across four apparently different brands at four price points is building a single profile that also…

Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.

Gap, Old Navy, Banana Republic and Athleta share one company and one loyalty infrastructure, so a customer shopping across four apparently different brands at four price points is building a single profile that also reveals household composition and income band. Gap's private-label and co-branded credit cards for Old Navy, Gap, Banana Republic and Athleta are issued and serviced by Barclays Bank Delaware (Gap ended its Synchrony program in April 2022), so disputes on a store card go to Barclays rather than the retailer.

  • SeveritySeverity 2 of 5, not independently verified. Gap, Old Navy, Banana Republic and Athleta share one company and one loyalty infrastructure, so a customer shopping across four apparently different brands at four price points is building a single profile that also…
  • Evidence tierUnassigned
  • Claims confirmedNo sourced claims yet
  • Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Last verified 96 days agoverified 96 days ago0180 days
Freshness. Last verified 96 days ago (2026-08-04); stale after 180 days.

Terms

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected.

Data sharing

Not independently confirmed this pass with a specific named data-privacy lawsuit or breach; recommend checking against the general retail-industry vendor-breach patterns (Snowflake, MOVEit, Salesforce/ShinyHunters) documented extensively for peer retailers throughout this tracker.

Fees and billing

Not itemized this pass.

Contacts

Privacy contact. Not recorded.

Legal notice. PUBLIC COMPANY (GAP). Service route: c/o General Counsel / Corporate Secretary, San Francisco, California — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.

Mailing address. Not recorded.

No published channel
Paper trail: none. No published channel.

Evidence

No claims have been itemized for this row yet.

No sources are on file for this row yet.

Source vault

Link status: Candidate - not yet fetched

DocumentLast fetchPDF
Privacy policy
See Gap's own published privacy policy
Not fetched yetNOT CONFIRMED
Terms of service
See Gap's own published terms of service
Not fetched yetNOT CONFIRMED
Website
gapinc.com
Not fetched yet—
Primary source
No URL recorded
Verification: Unverified - heuristic first draft
Not fetched yet—

Enforcement

No enforcement actions are linked to this row.

State statute

Headquarters on file: California. Provisions of CCPA/CPRA on file:

ProvisionTypeSource
Right to Deletion
Cal. Civ. Code § 1798.105
hardsource
Right to Correction
Cal. Civ. Code § 1798.106
hardsource
Right to Know / Access
Cal. Civ. Code § 1798.110
hardsource
Right to Limit Use of Sensitive Personal Information
Cal. Civ. Code § 1798.121; Cal. Code Regs. tit. 11, § 7027
hardsource
Right to Data Portability
Cal. Civ. Code § 1798.130(a)(3)(B)(iii)
hardsource
Privacy Policy / Privacy Notice Requirements
Cal. Civ. Code § 1798.130(a)(5); Cal. Code Regs. tit. 11, § 7011
hardsource
Sensitive Personal Information — Categories
Cal. Civ. Code § 1798.140(ae)
hardsource
Service Provider and Contractor Contract Requirements
Cal. Civ. Code § 1798.140(ag); Cal. Code Regs. tit. 11, § 7051
hardsource
Applicability Threshold (2025 CPI-Adjusted)
Cal. Civ. Code § 1798.140(d)
thresholdsource
Privacy Risk Assessment — Mandatory for High-Risk Processing (Eff. Jan. 1, 2026)
Cal. Civ. Code § 1798.185(a)(15); Cal. Code Regs. tit. 11, §§ 7150-7157
hardsource
Right to Opt Out of Sale or Sharing
Cal. Civ. Code §§ 1798.120, 1798.135
hardsource
Sale vs. Sharing Distinction
Cal. Civ. Code §§ 1798.140(ad), 1798.140(ah)
hardsource
Enforcement — CPPA and AG; Civil Penalties (2025 CPI-Adjusted)
Cal. Civ. Code §§ 1798.155, 1798.199.90; Cal. Bus. & Prof. Code § 17206
hardsource
Notice at Collection
Cal. Code Regs. tit. 11, § 7012
hardsource
Cybersecurity Audit — Annual Independent Audit Requirement (Eff. Jan. 1, 2026)
Cal. Code Regs. tit. 11, §§ 7120-7124
hardsource
Automated Decision-Making Technology (ADMT) — Notice, Opt-Out, and Access Rights
Cal. Code Regs. tit. 11, §§ 7200-7222; Cal. Civ. Code § 1798.185(a)(16)
hardsource