This California Consumer Privacy Act Disclosure (“CCPA Disclosure”) explains how Capital One Financial Corporation and its U.S. affiliates (collectively, “Capital One,” “we,” “us,” or “our”) collect, use, and disclose personal information subject to the California Consumer Privacy Act (“CCPA”). It also describes the privacy rights of California residents under the CCPA and how they can exercise those rights.

This CCPA Disclosure applies solely to California residents and supplements any other privacy policies or notices applicable to the Capital One services that you visit or use.

 

WHAT PERSONAL INFORMATION IS COVERED BY THE CCPA?

 

Under the CCPA, “personal information” is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. It does not include publicly available information or information that has been aggregated or de-identified.

The CCPA does not apply to certain information, such as information subject to the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, and certain other state or federal privacy laws. For example, this CCPA Disclosure does not apply to information that we collect about individuals who seek, apply for, or obtain our financial products and services for personal, family, or household purposes, which is subject to our U.S. Consumer Privacy Notice, or other financial privacy notice applicable to the Capital One services that you visit or use.

This CCPA Disclosure also does not apply to information we collect in the context of a person’s role as a job applicant, employee, associate, contractor, or other member of the Capital One workforce, which is subject to our Capital One Workforce CCPA Disclosure.

 

CATEGORIES OF PERSONAL INFORMATION WE COLLECT

 

Most of the personal information that we maintain has been collected in the context of providing financial products and services for personal, family, or household purposes, and is therefore not subject to the CCPA. However, we also collect personal information relating to California residents in other contexts, including in connection with our marketing activities, our websites and mobile applications, our small business and commercial businesses, and certain Capital One locations (such as when you visit a Capital One Café).

In the past 12 months, we have collected the following categories of personal information, as defined in the CCPA, relating to California residents. The categories of personal information that we collect, use, and disclose about a California resident will depend on our specific relationship or interaction with that individual. The examples provided in each category below are for illustrative purposes only.

PURPOSES FOR WHICH WE USE PERSONAL INFORMATION

 

We may use personal information relating to California residents for one or more of the following business purposes:

• Providing our products and services
• Processing transactions and payments
• Verifying your identity
• Detecting and preventing fraud
• Protecting against security risks
• Advertising and marketing
• Conducting analytics and research
• Improving our products and services
• Carrying out our legal and business purposes, such as complying with federal, state, or local laws, responding to civil, criminal, or regulatory lawsuits, subpoenas, or investigations, exercising our rights or defending against legal claims, resolving complaints and disputes, performing compliance activities, performing institutional risk control, and otherwise operating, managing, and maintaining our business
• Creating aggregated and de-identified information
• As otherwise disclosed to you at or before the point of collecting your personal information

We may also use personal information relating to California residents for one or more of the specific “business purposes” listed in the CCPA:

• Certain auditing and measurement purposes, such as counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with applicable standards
• Helping to ensure our ability to detect security incidents, resist malicious, deceptive, fraudulent, or illegal activity, and prosecute those responsible for that activity; to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information; and to protect the physical safety of natural persons.
• Debugging to identify and repair errors that impair existing intended functionality
• Short-term, transient use
• Performing services on behalf of Capital One, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, providing storage, or providing similar services on behalf of Capital One
• Undertaking internal research for technological development and demonstration
• Undertaking activities to verify or maintain the quality or safety of a service that is owned or controlled by Capital One, and to improve, upgrade, or enhance the service that is owned or controlled by Capital One

Importantly, we may share or allow companies to collect information through our online services in order to provide marketing services to us, including to target advertising to you based on personal information collected across different websites, mobile apps, and devices over time. You have a right to opt out of such cross-context behavioral advertising, as described below. You can also review the Capital One Online Privacy Policy to learn more about how Capital One uses online tracking technology to conduct personalization, analytics, and targeted advertising.

In the past 12 months, we have not disclosed personal information relating to California residents in any other manner that we consider a sale within the meaning of the CCPA.

 

RIGHTS UNDER THE CCPA

 

Rights to Know, Delete, and Correct. If you are a California resident, you may request that we disclose to you the following information:

• The categories of personal information described above that we have collected about you and the categories of sources from which we collected such personal information
• The business or commercial purposes for collecting or sharing such personal information
• The categories of personal information about you that we have disclosed to or shared with third parties for a business purpose and the categories of third parties to whom we have disclosed or shared such personal information
• The specific pieces (e.g., copies) of personal information we have collected about you

California residents also have the right to submit a request for deletion or correction of their personal information under certain circumstances, although in some instances, we may decline to honor your request. For example, we may decline to honor your request if we cannot verify your identity or confirm that the personal information that we maintain relates to you, or if we cannot verify that you have the authority to make a request on behalf of another individual. In other instances, we may decline to honor your request where an exception applies, such as where the disclosure of personal information would adversely affect the rights and freedoms of another consumer or where the personal information that we maintain about you is not subject to the CCPA. Nonetheless, you have the right to be free from unlawful discrimination for exercising your rights under the CCPA.

If you are a California resident and would like to exercise your rights to know, delete, or correct your personal information as described above, please submit your request by:

• Visiting the Manage Your Data page
• Contacting us at 1-888-480-3282 (Mon–Fri from 8 a.m. – 11 p.m. ET)

Once we receive your request, we may verify your identity through your account or by requesting additional information sufficient to confirm your identity, such as photos of your government ID.

If you would like to use an agent to exercise your CCPA rights, or if you are an agent seeking to exercise CCPA rights on behalf of another person, please contact us at 1-888-480-3282.

Right to Opt Out of Sharing Personal Information for Cross-Context Behavioral Advertising. California residents have a right to opt out of sharing personal information for cross-context behavioral advertising purposes. You can exercise your right to opt out by enabling Global Privacy Control (GPC) in your browser. GPC is a setting that allows you to communicate your privacy preferences to websites and online services that you visit. When we detect a GPC signal from a browser, our Online Services are designed to treat the browser as opted out and to stop sharing personal information for certain targeted advertising purposes, in accordance with applicable laws. Please visit the Global Privacy Control website to learn more about the setting and how to enable it on your browser.

You can also opt out of certain targeted advertising by visiting the Digital Advertising Alliance Opt Out Page, Network Advertising Initiative Opt Out Page, and TrustArc Preference Manager and by adjusting the privacy settings on your mobile device (e.g., "Limit Ad Tracking" on iOS or "Opt out of Ads Personalization" on Android).

Please note that your preferences will apply only to the specific browser from which you opt out. You will need to opt out separately on all of your browsers. If you delete cookies, change web browsers, reset your mobile advertising ID, or use a different device, you may need to opt out again. Our online services do not function differently in response to browser "Do Not Track" signals, but you may opt out of certain targeted advertising as described above.

 

TRANSPARENCY REPORT

 

Our annual transparency report shows the number of data requests we receive and how long it takes us to fulfill those requests.

 

CHANGES TO THIS CALIFORNIA CONSUMER PRIVACY ACT DISCLOSURE

 

We may change or update this CCPA Disclosure in the future. When we do, we will post the revised CCPA Disclosure on our website. This CCPA Disclosure was last updated and became effective on the date posted at the top of this page.