Protection of Information
Last modified: January 21, 2021 (View Archived Versions)
Consumer Reports is an independent, nonprofit member organization that works side by side with consumers for truth, transparency, and fairness in the marketplace. Consumer Reports and its corporate affiliates (which we refer to in this policy as “CR”, “we” or “us”) publish our organization’s privacy principles and apply them to the way in which we treat your information.
Information you give us
When you purchase a subscription from us or otherwise engage with CR, you may give us different types of information including the following:
You may choose to provide us with certain “sensitive information” to use in our reporting about consumer matters and in our advocacy work. We request that you not provide us with any Social Security number, financial account information, or similar sensitive data when sharing your experiences with us.
We may match the information we collect from you directly with the information we receive about you from other sources, and use such information along with information from those other sources.
Information collected when you use our products and services
Information we obtain from other sources
We collect additional information about you from other sources to help us correct and supplement our records, improve the quality of our products or services, and personalize your experience. These sources include service providers who provide us with your IP address in order to customize our service; payment service providers who provide us with information to process your payment; data providers who provide us with demographic, interest based and online advertising related data; organizations with which we have a business relationship to provide products and services to you; and information available through publicly available sources such as open government databases and publicly available posts on social media platforms.
The type of additional information we collect from these sources include your updated mailing address, payment card information, information from social media sources, engagement with our content (for example, comments or shares on our Facebook page), information about products and services you access through our business partners (for example, if you purchase a vehicle through our Car Buying service), information about your interests (e.g., pets, sports, travel, and cars), demographic data (e.g., age, gender, general income bracket, ethnicity, and children in household), and for certain of our consumer policy and mobilization activities, your legislative district information.
Use of Information
The information we collect is used for a variety of purposes. These include:
Personal information you submit to a CR publication or elect to post in a public area of a digital service is public. If you don’t want people to know your name, email address, or other information that identifies you personally, do not include that information in your public posts.
We may share information collected from or about you with others, including business partners, service providers, social networking services, industry experts, and other third parties, for the purposes described below.
Sharing With Business Partners
Sharing With Service Providers
We may share your information with third-party service providers who help us with specialized services such as payment processing, analytics and member support. Additionally, we authorize certain service providers to use aggregated, anonymous information derived from data collected when you use the products and services they support on our behalf.
Sharing with Industry Experts and Other Third Parties
We may share de-identified individual-level or aggregated information with manufacturers, regulators, researchers and other third parties for research purposes to help improve the marketplace. Information shared in this way will not identify you individually.
Sharing For Consumer Policy and Mobilization Purposes
When you participate in a consumer policy campaign such as by signing a petition or sending a message to a policy decision-maker or government entity, it may be necessary to include your name, address and/or other personal information with your submission. Petitions and comments filed with government entities, together with any included personal information, become a matter of public record and may be viewable online after submission. Sometimes CR works with other advocacy organizations to coordinate our shared policy efforts. If you provide your information to us as part of a joint-petition or other coordinated action, it may be shared with these other organizations.
Sharing For Fundraising Purposes
We share certain donor data (such as full name, mailing address and donation information, but not your email address, telephone number(s) or any financial account information) with other organizations.
Sharing For Marketing Purposes
If you subscribe to Consumer Reports magazine or any of our other print publications, we may exchange or rent your name and mailing address (but not your email address) with other companies that offer products or services through direct mail. We screen all such offers and strive to select trustworthy, reputable companies which offer high quality products or services of interest to you. If you prefer not to receive these offers, please go to Choice/Opt Out for instructions.
Promotional Offers, Sweepstakes, or Contests
If you enter a sweepstakes, contest or other promotion, your information may be disclosed to third parties who help administer the promotion, including for winner selection, prize fulfillment and aggregated data analysis. Your information also may be disclosed as required by U.S. law such as on a winners list.
Sharing With Our Affiliates
We may share your information among our corporate affiliates, which are related legal entities.
Substantial Corporate Transactions
We may share your information in connection with a substantial corporate transaction, which may include the sale of one or more of our businesses, a merger, the creation of a separate business to provide certain of our products and services, or in the unlikely event of bankruptcy.
We will notify you if we transfer ownership or control of your personally identifiable information to an unaffiliated third party in connection with a substantial corporate transaction.
We may access, preserve and disclose your information if we believe that we are required to do so by applicable law, such as to comply with a search warrant, court order, subpoena, or request from law enforcement, to enforce our legal rights and agreements (including CR's User Agreement), and to defend against legal claims.
Protect Our Websites and Users
We may disclose your information to investigate, prevent or take action regarding suspected illegal activities, including fraud, to protect the legal rights, safety and property of CR and its employees, agents and contractors, and in connection with any safety or security concerns involving our users or the public.
Information Collected by Third Parties
Certain third parties such as ad networks that serve CR ads, analytics companies and social networking platforms may collect information through cookies, web beacons, mobile ad identifiers, and other technologies that track your online activities across CR and other online services, including information about your interactions with our ads, our content and the websites you visit.
We collect the following personal information about you in the context of our text messaging program: your name, mobile phone number, text message contents and texting preferences (opt-ins and opt-outs). We use this information to manage our text messaging program, including to send you text messages. We may share this information with our corporate affiliates, third parties in the context of the sale of our business or its assets, corporate restructuring or liquidation, and otherwise to the extent permitted or required by applicable law. If fees are charged to your wireless account invoice, we may provide information to your carrier about them. Your wireless carrier may also collect data about your wireless device usage, and its practices are governed by its own policies. We take measures to protect your sensitive personal information but cannot guarantee its security in transit or storage.
Please go to the Choice/Opt Out section to learn more about how you can opt out of our information-sharing practices.
As a non-profit membership organization engaged in ongoing consumer product testing, news reporting and consumer advocacy, we often engage with consumers like you online and through other communication channels. Your feedback and involvement are critical to our work on your behalf.
We want to give you control over how we use your information. Here’s how to opt-out of receiving communications from us:
Opting out of promotional, consumer policy and mobilization communications, newsletters and alerts
We may send you promotional emails about our products and services or ask you about your experience with Consumer Reports.
You can opt out of receiving these email communications by following the instructions and links provided at the bottom of each email. If you use this method, you will stop receiving promotional emails only from the line of business or business unit that sent you the message.
CR Members can also manage your email communication preferences on your personal account page by clicking here.
You may also opt out of receiving email communications by calling us at 1-800-333-0663.
If you wish to change your preferences for policy and mobilization emails, please click here.
Please allow up to 10 business days for changes to your email preferences to take effect. During that time, you may continue to receive email communications from us that were already in process.
Please note that opting out of receiving email or other communications will not affect your receipt of service-related communications such as those relating to your account, order confirmations, renewal/expiration notices, and payment card notifications.
Opting out of postal mail promotional communications
We may send you promotional materials about our other products and services by postal mail. If you purchase or subscribe to one of our print publications, we may also share your postal mail contact information with third parties for their marketing purposes as described above under Sharing For Marketing Purposes.
If you do not want us to send you these promotional mailings or to share your contact information with third parties, please click here to manage your postal mail preferences or contact Member Services.
You can also call us at 1-800-333-0663 or write to us at:
Attn: Opt Out Preference Center
PO Box 2109
Harlan, IA 51593
If you live in the United States, you may also opt out of receiving promotional communications through the Direct Marketing Association (DMA).
Canadian residents may visit the Canadian Marketing Association (CMA) web site to be removed from marketing lists used by Canadian Marketing Association members.
It can take up to 8 weeks for your postal mail opt out request to become effective. During that time, you may continue to receive promotional mailings that were already in process.
Opting out of fundraising communications
If you wish to opt out of receiving fundraising communications from us, please click here. You may also call us at 1-800-333-0663 or write to us at:
P. O. Box 96552
Washington, DC 20090-6552
Because we schedule many fundraising communications in advance, it may take up to 8 weeks for an opt out request to become effective.
Opting out of consumer surveys
We have supplementary policies for information collected through participation in our surveys. You can stop receiving consumer surveys by following the opt out instructions in each survey email invitation. You can also stop receiving future surveys by calling us at 1-800-333-0663 or by writing to us at:
Consumer Reports Customer Relations
Attn: Member Support
101 Truman Avenue
Yonkers, NY 10703
Opting out of digital advertising
To help maintain our independence and impartiality, we accept no outside advertising. However, we may place ads for our own products and services on our own sites and online properties. You may see ads for Consumer Reports on other websites and online properties you visit. Ads for CR Products may be customized to your interests and preferences based on information collected as you browse online, a practice that is often referred to as interest-based advertising. Tracking technologies like cookies and web beacons are used for these purposes. You can opt out of interest-based advertising, as well as advertising on your mobile device, by visiting TrustARC’s Ad Preference Manager.
Opting out of Geo-location Sharing
If your computer or device is equipped with GPS, connects with wireless access points or hot spots, or communicates through cell towers or satellites, then your computer or device is able to use these features to determine its precise geographic location. The geographic location will be transmitted to CR in real time in accordance with the privacy settings you have set on your computer or device, and will continue to transmit the information to us until you have updated your settings to no longer do so.
Do Not Track
Some Internet browsers include the ability to transmit “Do Not Track” signals that give consumers control over the collection and use of web browsing information. CR does not process or respond to such signals in users’ web browsers at this time.
If you have provided your personal information to us in an online account for a CR Product, you can edit that information by logging in and visiting your account here.
If you registered to receive policy and mobilization-related communications from us, you can access and edit that information here.
For any other requests, please contact us in any of the ways described in our online Member Support portal.
We are committed to protecting your information. We have put in place physical, technical and administrative procedures designed to help safeguard and prevent unauthorized access and misuse of your information. When Consumer Reports transmits information over the Internet, we work to protect the information through the use of data encryption methods.
While we endeavor to protect the security and integrity of information we collect via our websites and other online properties, due to the inherent nature of the Internet as an open global communications vehicle, we cannot guarantee that any information, during transmission through the Internet or while stored on our systems or otherwise in our care, will be absolutely safe from intrusion by others, such as hackers.
Visit the Protection of Information page to learn more about how the information you provide is secured.
If you create an account on a CR website, you are responsible for maintaining the strict confidentiality of your account password and for any activity that occurs using your account credentials. Please notify us of any unauthorized use of your password or account or any other breach of security.
CR Products are intended for general audiences and are not directed to children. If you are the parent or guardian of a child under age 13 and believe your child has provided us with his or her personal information, please contact us. You must be 18 or older to participate in certain activities, such as contests and sweepstakes.
We believe that consumers should know what information is being collected about them and how that information is being used. We also believe that consumers should be able to access their information and delete it whenever possible. Please go here if you would like to access or delete your information.
California Consumer Privacy Act
The California Consumer Privacy Act (“CCPA”) requires that companies covered by the law make certain disclosures regarding the personal information they collect, sell and disclose with respect to California residents. For purposes of this “California Consumer Privacy Act” section, we will refer to companies that are covered by the CCPA as “California Covered Companies”. As a not-for-profit organization, CR is not covered by the CCPA, but we make the following disclosures consistent with our role as marketplace leader:
California Shine the Light Law
Under California law, residents of the State of California may request from us once per year and free of charge a list of all third parties to whom your personal information has been disclosed during the preceding year for those third parties' direct marketing purposes. If you are a California resident and want such a list, please submit your request in writing in one of the following two ways:
Email us at: firstname.lastname@example.org or write to us at:
Attn: Legal Department
101 Truman Avenue
Yonkers, NY 10703
For all requests, you must put the statement "Your California Privacy Rights" in the subject line of your request and include your name, street address, city, state, and zip code.
The following section applies to persons in the European Economic Area, the United Kingdom and Switzerland (“Data Subjects”):
Lawful Basis for Processing Personal Information
Under the General Data Protection Regulation (GDPR), entities like CR that act as data controllers – meaning those entities that determine the purpose and means of processing of personal information -- must have a lawful basis for processing that information. In order to provide Data Subjects with CR Products and otherwise comply with our legal obligations, CR needs to collect and process certain types of personal information from Data Subjects. The lawful bases that we rely upon to process the personal information held about Data Subjects are as follows:
Personal Information Retention
We shall retain your personal information for so long as is required for the purposes of the relevant agreement between you and CR (see our User Agreement) and/or in accordance with legal and regulatory requirements and tax and accounting rules. We will endeavor not to keep personal information in a form that allows a Data Subject to be identified for any longer than is reasonably necessary for achieving the permitted purposes. At the end of the applicable retention period, we may destroy, erase from our systems, or anonymize personal information as part of such efforts. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of the personal data, the purposes for which we process the personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Storage and Transfer of Personal Information
We maintain physical, electronic and procedural safeguards designed to protect Data Subjects’ personal information, prevent unlawful or unauthorized processing of personal information, and prevent unauthorized disclosure of, or accidental loss of, or damage to, such information.
We may process personal information in, and transfer personal information to, countries that may not guarantee the same level of protection for personal information as the country in which Data Subjects reside, and which may not have received an adequacy decision from the European Commission.
Personal information will also be processed by staff who work for us and operate outside the European Economic Area. This includes staff engaged in, among other things, the provision of administration and support services. All such staff are subject to appropriate confidentiality and security obligations.
We restrict access to non-public personal information about Data Subjects to those of our employees and agents who need to know the information to enable us to provide services.
For more information about steps we take to protect your personal data, please click here.
Rights in relation to Personal Information
These include, where certain conditions are met:
Data Subjects should use the contact information below to get more information and/or to make a formal request.
We will endeavor to keep the personal information we store about Data Subjects reasonably accurate and up-to-date by enabling Data Subjects to correct it by request or by logging into My Account and correcting it directly. Data Subjects should notify us if any of their personal information changes or if they become aware of any inaccuracies in the personal information we hold about them.
© 2022 Consumer Reports, Inc.