Online Retailers (Top 10) · Online/Retail (grocery) · Structural / no discrete incident
Kroger
Headline
Two pharmacy-specific class actions is the detail that separates Kroger from other grocers in this tracker: a supermarket that operates pharmacies holds prescription records alongside the loyalty data tracking…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Two pharmacy-specific class actions is the detail that separates Kroger from other grocers in this tracker: a supermarket that operates pharmacies holds prescription records alongside the loyalty data tracking everything else you buy, and the combination is far more revealing than either alone. Grocery purchase history is already sensitive enough to infer pregnancy, chronic illness and religious observance; adding the pharmacy record removes the inference step. Kroger's loyalty programme is also effectively mandatory in practice, since shelf prices are structured so that declining the card means paying materially more.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
MULTIPLE SEPARATE, SERIOUS FINDINGS: (1) TWO pharmacy-specific class actions (Jane Doe v. The Kroger Co., S.D. Ohio) (filed November 2023) allege Kroger installed the Meta/Facebook Pixel and related tracking tools on its pharmacy website; a further allegation that Kroger also used Meta's Conversions API to bypass ad-blockers was not confirmed in coverage reviewed this pass. The pixel allegedly transmitted patients' names, appointment details, prescriptions, and health information to Meta without the 'express written authorization' HIPAA requires, since Kroger has positioned itself as a healthcare provider through its pharmacy operations. (2) A CONFIRMED 2021 THIRD-PARTY VENDOR BREACH (Accellion file-transfer platform, the same category of vendor-breach pattern seen elsewhere in this tracker) exposed pharmacy records of nearly 1.5 million Kroger customers plus employee HR data; Kroger agreed in 2021 to a $5 million class settlement covering about 3.82 million pharmacy patients and employees. (3) SEPARATE PHARMACY OVERCHARGING claims (reported; not independently confirmed this pass) allege Kroger charged cash-pay pharmacy customers MORE than the discounted price available through GoodRx or similar discount programs, without disclosing that cheaper options existed.
Fees and billing
Kroger's proposed ~$25 BILLION MERGER with Albertsons was BLOCKED on Dec. 10, 2024, when a federal court in Oregon granted the FTC's request for a preliminary injunction (FTC v. Kroger Co., No. 3:24-cv-00347-AN (D. Or.)) and a Washington state court permanently enjoined the deal; Albertsons then sued Kroger seeking a $600 million termination fee plus damages, and Kroger counterclaimed (litigation ongoing per Kroger's FY2025 10-K; status after that filing not re-verified as of Oct 2026). Kroger serves over 60 MILLION households as the largest US supermarket chain by revenue, meaning any of the above findings has an unusually large potential customer footprint.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (KR). Service route: c/o General Counsel / Corporate Secretary, Cincinnati, Ohio — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy kroger.com/privacy | Not fetched yet | NO (HTML only) |
| Terms of service kroger.com/terms | Not fetched yet | NO (HTML only) |
| Website thekrogerco.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No comprehensive state privacy statute on file for Ohio