This California Consumer Privacy Act Disclosure (“CCPA Disclosure”) explains how Capital One Financial Corporation and its U.S. affiliates (collectively, “Capital One,” “we,” “us,” or “our”) collect, use, and disclose personal information subject to the California Consumer Privacy Act (“CCPA”). It also describes the privacy rights of California residents under the CCPA and how they can exercise those rights. 

This CCPA Disclosure applies solely to California residents and supplements any other privacy policies or notices applicable to the Capital One services that you visit or use. 

If you are a Discover customer (excluding “Discover by Capital One” accounts), please note that this notice does not apply to the practices of Discover. For example, this notice does not apply to PULSE, Diners Club International, and Discover Global Network, as well as Discover.com, the Discover Mobile App, and similar services. Please visit Discover’s Privacy Center to learn more about Discover’s privacy practices.

This CCPA Disclosure also does not apply to:

• information we collect in the context of a person’s role as a job applicant, employee, associate, contractor, or other member of the Capital One workforce, which is subject to our Capital One Workforce CCPA Disclosure.
• non-Capital One companies, such as our co-branded partners, auto dealerships and auto-finance companies, companies that offer data aggregation or similar services to you, or any third-party websites that we link to online. Please review the privacy policies of other websites and services you visit or use to understand their privacy practices.

 

WHAT PERSONAL INFORMATION IS COVERED BY THE CCPA?

 

Under the CCPA, “personal information” is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. It does not include publicly available information or information that has been aggregated or de-identified.

The CCPA does not apply to certain information, such as information subject to the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, and certain other state or federal privacy laws. For example, this CCPA Disclosure does not apply to information that we collect about individuals who seek, apply for, or obtain Capital One financial products and services for personal, family, or household purposes, which is subject to our U.S. Consumer Privacy Notice, or other financial privacy notice applicable to the Capital One services that you visit or use.

 

CATEGORIES OF PERSONAL INFORMATION WE COLLECT

 

Most of the personal information that we maintain has been collected in the context of providing financial products and services for personal, family, or household purposes, and is therefore not subject to the CCPA. However, we also collect personal information relating to California residents in other contexts, including in connection with our marketing activities, our websites and mobile applications, our small business and commercial businesses, and certain Capital One locations (such as when you visit a Capital One Café).

In the past 12 months, we have collected the following categories of personal information, as defined in the CCPA, relating to California residents. The categories of personal information that we collect, use, and disclose about a California resident will depend on our specific relationship or interaction with that individual. The examples provided in each category below are for illustrative purposes only.

PURPOSES FOR WHICH WE USE PERSONAL INFORMATION

 

We may use personal information relating to California residents for one or more of the following business purposes:

• Providing our products and services
• Processing transactions and payments
• Verifying your identity
• Detecting and preventing fraud
• Protecting against security risks
• Communicating with you
• Advertising and marketing
• Conducting analytics and research
• Improving our products and services
• Carrying out our legal and business purposes, such as complying with federal, state, or local laws, responding to civil, criminal, or regulatory lawsuits, subpoenas, or investigations, exercising our rights or defending against legal claims, resolving complaints and disputes, performing compliance activities and audit functions, performing institutional risk control, and otherwise operating, managing, and maintaining our business
• Creating aggregated and de-identified information
• As otherwise disclosed to you at or before the point of collecting your personal information

Additional details about these business purposes are available in our Capital One Online Privacy Policy. 

We may also use personal information relating to California residents for one or more of the specific “business purposes” listed in the CCPA:

• Certain auditing and measurement purposes, such as counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with applicable standards
• Helping to ensure our ability to detect security incidents, resist malicious, deceptive, fraudulent, or illegal activity, and prosecute those responsible for that activity; to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information; and to protect the physical safety of natural persons
• Debugging to identify and repair errors that impair existing intended functionality
• Short-term, transient use
• Performing services on behalf of Capital One, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, providing storage, or providing similar services
• Undertaking internal research for technological development and demonstration
• Undertaking activities to verify or maintain the quality or safety of a service that is owned or controlled by Capital One, and to improve, upgrade, or enhance the service that is owned or controlled by Capital One

Importantly, we may share or allow companies such as our marketing partners to collect information (e.g., Internet or similar network activity information and identifiers) through our online services in order to provide marketing services to us, including to target advertising to you based on personal information collected across different websites, mobile apps, and devices over time. California residents have a right to opt out of such sharing for cross-context behavioral advertising, as described below. You can also review the Capital One Online Privacy Policy to learn more about how Capital One uses online tracking technology to conduct personalization, analytics, and targeted advertising.

In the past 12 months, we have not disclosed personal information relating to California residents in any other manner that we consider a sale within the meaning of the CCPA. We also do not knowingly sell or share for cross-context behavioral advertising the personal information of individuals under the age of 16.

 

RIGHTS UNDER THE CCPA

 

Rights to Know, Delete, and Correct. If you are a California resident, you may have certain rights related to the personal information we process about you. You may request the following:

• Access to the specific pieces (e.g., copies) of personal information we have collected about you. You may also request access to other information about our data processing practices as described in this CCPA Disclosure. Specifically, you may request to know the categories of personal information we have collected about you, categories of sources from which we collected such personal information, business or commercial purposes for collecting or sharing such personal information, categories of personal information disclosed to or shared with service providers, contractors, and third parties, and categories of service providers, contractors, and third parties to whom we have disclosed or shared such personal information
• Deletion of personal information we have collected from you
• Correction of personal information we have collected from you

In some instances, we may decline to honor your request in accordance with the CCPA. For example, we may decline to honor your request if we cannot verify your identity or confirm that the personal information that we maintain relates to you, or if we cannot verify that you have the authority to make a request on behalf of another individual. In other instances, we may decline to honor your request where an exception applies, such as where the disclosure of personal information would adversely affect the rights and freedoms of another consumer or where the personal information that we maintain about you is not subject to the CCPA. Nonetheless, as a California resident, you have the right to be free from unlawful discrimination for exercising your rights under the CCPA.

If you are a California resident and would like to exercise your rights to know, delete, or correct your personal information as described above, please submit your request by:

• Visiting the Manage Your Data page
• Contacting us at 1-888-480-3282 (Mon–Fri from 8 a.m. – 11 p.m. ET)

Once we receive your request, we may verify your identity through your account or by requesting additional information sufficient to confirm your identity.

If you would like to use an agent to exercise your CCPA rights, or if you are an agent seeking to exercise CCPA rights on behalf of another person, please contact us at 1-888-480-3282. For information about rights and choices available through Discover with respect to personal information maintained by Discover, please visit Discover’s Privacy Center. You can also exercise available rights for information maintained by PULSE, Diners Club International, and Discover Global Network by clicking the appropriate link to visit the website and following the instructions for California residents.

Right to Opt Out of Sharing Personal Information for Cross-Context Behavioral Advertising. California residents have a right to opt out of sharing personal information for cross-context behavioral advertising purposes. You can exercise your right to opt out by enabling Global Privacy Control (GPC) in your browser. GPC is a setting that allows you to communicate your privacy preferences to websites and online services that you visit. When we detect a GPC signal from a browser, our Online Services are designed to treat the browser as opted out and to stop sharing personal information for certain targeted advertising purposes, in accordance with applicable laws. Please visit the Global Privacy Control website to learn more about the setting and how to enable it on your browser.

You can also opt out of certain targeted advertising by visiting the Digital Advertising Alliance Opt Out Page and TrustArc Preference Manager or by adjusting the privacy settings on your mobile device (e.g., "Limit Ad Tracking" on iOS or "Opt out of Ads Personalization" on Android).

Please note that your preferences will apply only to the specific browser from which you opt out and will only limit the sharing of personal information for certain targeted advertising purposes in accordance with applicable laws or as disclosed by the organization providing the opt-out. For example, if you opt out, Capital One may still use your personal information to personalize our interactions and advertising to you, and you may still see Capital One advertisements that result from other advertising techniques. You will need to opt out separately on all of your browsers. If you delete cookies, change web browsers, reset your mobile advertising ID, or use a different device, you may need to opt out again. Our online services do not function differently in response to browser "Do Not Track" signals, but you may opt out of certain targeted advertising as described above. 

 

TRANSPARENCY REPORT

 

Our annual transparency report shows the number of data requests we receive and how long it takes us to fulfill those requests.

 

CHANGES TO THIS CALIFORNIA CONSUMER PRIVACY ACT DISCLOSURE

 

We may change or update this CCPA Disclosure in the future. When we do, we will post the revised CCPA Disclosure on our website. This CCPA Disclosure was last updated and became effective on the date posted at the top of this page.