This Privacy Policy applies to personal data, which we define as data that identifies, relates to, describes, references, is reasonably capable of being associated with, or can reasonably be linked, directly or indirectly, to an individual or household. This includes data such as your name, address, email address, phone number, and data that is linked to such personal data, (such as demographic data, AARP passwords, payment data, device and usage data, and location data). This Privacy Policy does not apply to data that is not personal data or is not linked to personal data, including anonymous, de-identified, or aggregate data, which cannot reasonably be used to identify you – even when such data has been derived from personal data – and publicly available information (i.e., information that is lawfully made available from federal, state, or local government records).
Except as described below, this Privacy Policy applies to all operations of AARP, a non-profit organization, and each of its subsidiaries and affiliates, such as the AARP Foundation and AARP Services, Inc. (together “AARP”). This Privacy Policy applies when you communicate with us by mail, email, phone, social media, or in person, including at AARP events. This Privacy Policy also applies when you use AARP websites or applications designed for smartphones, tablets, computers, and other devices (“apps”), except where an AARP website or app points to a different governing policy (e.g., the AARP MemberAdvantages Privacy Policy) or where a non-AARP policy explicitly applies (e.g., the Deluxe Financial Services, LLC Privacy Policy governing the AARP Rewards for Good rewards catalog and redemption center). You can find the governing privacy policy in our websites’ footers or in our apps’ menus or settings.
By providing us your personal data or by using our websites or apps, you consent to our collection, use, and sharing of personal data as described in this Privacy Policy. Accordingly, we urge you to read it carefully and contact us with any questions as follows:
The collection and use of personal data (along with other kinds of data) is critical to the successful operation of most modern organizations – including AARP. We collect and use personal data from or about you to support our non-profit mission and serve our membership, including to:
We collect your personal data when you choose to provide it as you interact with us in person, through correspondence, by phone, by social media, or through our websites or apps. For instance, when you join AARP or register for an account on our websites or apps, you will be asked to provide basic personal data as part of your enrollment. Similarly, you may be asked to provide certain personal data when you participate in AARP events or meetings, submit a contest or sweepstakes entry, respond to a survey, volunteer, request a program service, or apply for employment.For example, the personal data you provide might include:
Data We Collect by Automated Means
We collect data (some of which may be personal data) by automated means when you interact with us through our websites and apps, and when we communicate with you by email or text message. We use standard technologies, including browser cookies, Web beacons, and third-party analytics services to collect this behavioral and operational data, which may be recorded and retained in web logs and other AARP systems.
The collection of such data is a common practice that supports digital services,and is used to provide customized digital experiences, as well as for market research, marketing, analytics, and system administration purposes. For example, we may use this data to determine whether you’ve previously visited our website, to store your preferences and settings, and to provide authentication processes so you can more easily access your account. We also may use this data to target custom content and ads to you on our websites, in our apps, and through other digital communications, as well as on third-party websites and apps as described in the Targeted Advertising section below.
Examples of the data we may automatically collect as part of our website, app, and digital communication experiences include:
We may also collect data (some of which may be personal data) by automated means when you call our customer service center. For instance, we may record audio of these calls for quality control, training, security, and analytics purposes.
You have choices to limit the collection and use of some of this data as described in the Your Personal Data Choices section of this Privacy Policy.
Data We Collect From Other Sources
We may collect personal data about you from unaffiliated sources with whom we contract, such as product and service providers and data aggregators, as well as from public sources or databases. We may obtain data such as your name, postal address, telephone number, demographic data (such as age, gender, income level, and purchasing profiles), and publicly observed data (such as activity on blogs, videos, and other online postings). We generally use such data to identify potential members or other individuals we try to reach as part of our non-profit mission, to update personal data we already have about current members and other individuals (such as an address update), or to enhance our data models.
We may also purchase or license personal data lists from unaffiliated sources and provide access to those lists to other entities. Although we may enhance such lists by applying our data models (e.g., to predict behaviors or interests of 50+ consumers), we do not contribute personal data related to AARP members, volunteers, etc., to such lists.
We may also work with unaffiliated websites that allow you to sign up for an AARP membership or AARP emails directly from the third-party’s website. The personal data you provide on such sites is governed by that site’s privacy policy. But some or all the personal data you submit on such sites may also be shared with AARP and will be treated by AARP under the terms of this Privacy Policy when we receive it.
We sometimes offer opportunities for our website or app users to forward information about or from AARP to a family member or friend through “refer a friend” mechanisms. When an individual uses such a mechanism, we may ask that they provide us the friend’s name and email address – as well as the individual’s own name and email address. We will only use the friend’s personal data to send the requested email or other information, and we may identify that we are doing so at the other individual’s request.
We may combine personal data from various sources, and may combine non-personal data with personal data. When we do so, the combined information is treated as personal data under this policy unless it is later de-identified or otherwise disassociated from your personal data.
We will not collect additional personal data or use the personal data we have collected for materially different, unrelated, or incompatible purposes without providing you notice.
We may disclose your personal data to a third-party for a business purpose or sell your personal data (subject to your right to opt-out of those sales if you are a California consumer; see below in Your California Privacy Rights. When we disclose personal data for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal data confidential and not use it for any purpose except performance of the contract.
Except as described below, we do not share your personal data with unaffiliated entities (entities that are not owned or controlled by AARP) without your consent. We may, however, share anonymous, de-identified, or aggregate data, which cannot reasonably be used to identify you – even where it has been derived from personal data. Similarly, we may share personal data lists that we purchase or rent from unaffiliated sources after we apply our data models as previously described. You may limit certain sharing of your personal data as described below in Your Personal Data Choices. We share your personal data with the following categories of third-parties for the following purposes:
AARP may also share your personal data with other third parties as follows:
We use commercially reasonable administrative, technical, and physical security measures designed to protect personal data against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or use. Despite our safeguards, however, no website, app, or information system can ever be completely secure so we cannot guarantee that the use of our systems, websites, or apps will be completely safe or secure. For additional information on privacy, identity theft, and online security, please visit the U.S. Federal Trade Commission's website.
If we learn of a security systems breach we may attempt to notify you electronically so that you can take appropriate protective steps. By using our websites and/or apps, or otherwise providing personal data to us, you agree that we can communicate with you electronically regarding security, privacy and administrative issues relating to your use of our websites and apps. We may post a notice via our websites if a security breach occurs. We may also send an email to you at the email address you have provided to us in these circumstances. Depending on where you live, you may have a legal right to receive notice of a security breach in writing.
If you wish to review and/or request changes to certain personal data we have collected about you (such as your current contact information, username and password, or date of birth), you may do so by logging into your AARP account on AARP.org or the AARP Now app, or by contacting us as identified above. In some cases, you may also have a right to (i) request deletion of certain personal data or (ii) obtain a copy of such data in an accessible format. We will make reasonable attempts to comply with such requests where applicable, but may refuse requests where we are otherwise legally required to retain the data, or the requests are unreasonably repetitive, require disproportionate technical effort, risk the privacy of others, or are impractical.
If you would like to request that we no longer share personal data with AARP Licensed Service Providers and/or unaffiliated non-profit organizations, you may do so by completing our Privacy Opt-Out Form or by contacting us as identified above. If you make such a request, it will not prevent such third-parties from using any personal data we shared with them prior to completing the opt-out process, or any data they have collected directly from you or others.
You may choose to opt-out of some or all future communications (mail, email, phone) from AARP. You can do so by completing our Privacy Opt-Out Form or by contacting us as identified above. For email, you can also opt-out by clicking on the “unsubscribe” links in the footer of our emails. (Please note that when opting-out of emails, you may still receive “transactional” emails, which contain information you specifically request or information related to your membership purchase or renewal.) For phone or text messages, you can also opt-out by following the contact instructions we provide in the phone call or replying “STOP” to any text message to which you’ve previously consented. We will honor your opt-out requests as soon as practical and as required by applicable law.
Most web browsers can be set to reject cookies or provide notice when cookies are placed on your device. Each browser is different, so check the "Help" menu of your browser to learn how to change your cookie preferences. Although it is up to you whether to accept cookies from our websites, if you reject cookies, certain functions on our sites may not work properly, and your ability to use some areas of the websites may be limited. It is also important to note that the opt-out mechanisms described in the Targeted Advertising section below generally rely on cookies to retain your opt-out preferences. So if you reject or erase cookies, your opt-out choices may not function properly.
Our analytics providers for websites and apps, primarily Adobe and Google Analytics, may collect data points associated with your visits to our websites and use of our apps in order to assist us with analyzing and assessing our digital properties. You can, however, opt-out of certain data collection by these analytics providers. To learn more about Adobe Analytics and how to opt-out of their data collection, click here. To learn more about Google Analytics and how to opt-out of their data collection, click here.
AARP participates in the Adobe Marketing Cloud Device Co-op to better understand how you use our websites and apps across the various devices you use, and to deliver tailored promotions. Although participation in the Co-op does not involve sharing personal data, it does assist all participants in recognizing various devices linked to the same person. You can learn more about how Adobe does this and manage your choices (or opt-out) by visiting Adobe’s Device Co-op Privacy Control website.
We collect data (both directly and through third-parties) about your activities on our websites and apps and may combine it with other personal data we have about you for use in providing more customized experiences, including advertising tailored to your individual interests. We may also share data about activities on our websites with advertising networks administered by third parties, which may use many of the same technologies previously discussed (such as cookies, web beacons, and analytics tools) to track your online activities over time and across websites. This collection and ad targeting takes place both on our websites and apps and on third-party digital properties that participate in those ad networks. As a result, you may see certain ads on other websites based on prior activity on our websites and apps, and vice versa.
The Digital Advertising Alliance (DAA) has created guidance for online advertisers and provided the “AdChoices” mechanism for such advertisers to comply with users’ choices regarding the placement of interest-based ads. By clicking on the AdChoices icon presented in the corner of each ad served by participants in the AdChoices program, you will be directed to a webpage to allow opt-outs from that ad network and/or for all ad networks participating in the AdChoices program.To learn more about ad networks, including how to opt out of interest-based ads, click here.
We have also implemented on many of our websites a targeted ad choice tool provided by Evidon. This tool can help you understand what data is being collected on our websites by third-parties, and how you can control such collection and use. On our sites where the tool has been implemented, such as on AARP.org, you will see a reference to “AdChoices” in the webpage footer – near the link to this Privacy Policy. By clicking on that link you will open a browser window that identifies each entity that AARP uses to direct targeted advertisements to you, both on AARP websites as well as on third-party sites. If you would like to stop targeted advertising from AARP, you can manage these advertisements through the choices presented in the Evidon Tool. You will still see ads from AARP and the ad networks with whom we work, but they will not be based on targeted data.
It is important to note that your choice to stop targeted advertising is specific to the browser you are using. If you make a choice to opt-out from one computer browser and you want your opt-out to apply to a different computer and/or browser, you must also opt-out from that computer. It is also important to note that most of these choices are cookie-based. If you delete cookies after making an opt-out choice, you will need to perform the opt-out again.
You can manage targeted ads in our apps through your device operating system settings. For iOS apps, visit the “advertising” controls in your privacy settings. For Android apps, use the Settings App. Both operating systems allow you to opt-out of targeted ads and/or reset your device advertising ID.
We may also work with certain social media websites or platforms (such as Facebook or Twitter) to serve ads to you as part of a customized social media campaign. You can opt-out of receiving customized ads by changing your ad preferences on those platforms, which we do not control.
We will request your permission before our apps access precise location data for your mobile device, generally when you first launch our apps. If you have previously consented to our app accessing precise location information, you may revoke that permission at any time through your device’s operating system location preference controls. You may also stop our access to precise location data by following the standard uninstall process to remove our apps from your device.
In addition to using the mechanisms described above, you may contact us at any time regarding these choices as follows:
Under California law, we are required to provide the following information. We may have collected the following personal data in the last 12 months:
Category of Personal Data: Identifiers, which may include name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, driver’s license number, or other similar identifiers.
Source(s): From you directly
Automated means (may be using third party service providers)
From data aggregators
Purpose(s): To provide information, programs, products and/or services
Targeted advertising
To identify potential members
To process employment applications
Disclosure to third parties:
Sold to: advertising networks
Shared for a business purpose with: internet service providers and other third party service providers
Category of Personal Data: Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), which may include name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
Source(s): From you directly
Purpose(s): To provide information, programs, products and/or services
To identify potential members
To process employment applications
Disclosure to third parties:
Shared for a business purpose with: third party service providers
Category of Personal Data: Protected classification characteristics under California or federal law, which may include age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).
Source(s): From you directly
Purpose(s): To provide information, programs, products and/or services
To process employment applications
Disclosure to third parties:
Shared for a business purpose with: third party service providers
Category of Personal Data: Professional or employment-related information, which may include current or past job history or performance evaluations.
Source(s): From you directly
From third party service providers, such as those who provide background checks
Purpose(s): To process employment applications
Disclosure to third parties:
Shared for a business purpose with: third party service providers
Category of Personal Data: Commercial information, which may include records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
Source(s): From you directly
Purpose(s): To provide information, programs, products and/or services
Targeted advertising
Disclosure to third parties:
Shared for a business purpose with: third party service providers
Category of Personal Data: Internet or other similar network activity, which may include browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.
Source(s): Automated means (may be using third party service providers)
From data aggregators
Purpose(s): To provide information, programs, products and/or services
Targeted advertising
Disclosure to third parties:
Sold to: advertising networks
Shared for a business purpose with: internet service providers and other third party service providers
Category of Personal Data: Geolocation data, which may include physical location or movements.
Source(s): From you directly
Purpose(s): To provide information, programs, products and/or services
Targeted advertising
Disclosure to third parties:
Sold to: advertising networks
Category of Personal Data: Inferences drawn from other personal information, which may include a profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
Source(s): Automated means (may be using third party service providers)
From data aggregators
Purpose(s): To provide information, programs, products and/or services
Targeted advertising
Disclosure to third parties:
Sold to: advertising networks
We do not sell the personal data of minors under the age of 16.
From January 1, 2020, in addition to the rights listed under Your Personal Data Choices, California consumers have the following additional rights:
• Right to know
You have the right to request information about the categories and specific pieces of personal data we have collected about you, as well as the categories of sources from which such information is collected, the purpose for collecting such information, and the categories of third parties with whom we share such information.
You have the right to request information about our sale or disclosure for business purposes of your personal data to third parties in the preceding 12 months.
• Right to delete
You have the right to request the deletion of your personal data.
• Right to opt-out of sale
You have the right to opt out of the sale of your personal data to third parties. You can exercise this right through the “Do Not Sell My Personal Information” link in the footers of our websites, when such link becomes available on January 1, 2020.
• Right to non-discrimination
You have the right to not be discriminated against for exercising any of these rights.
Additionally, California Civil Code Section 1798.83 permits users of the websites and/or apps who are California residents to request, once a year, certain information regarding our disclosure of personal data to third-parties for their direct marketing purposes. To make such a request, please contact us at the contact information provided below. Please be sure to put “Shine the Light Request” in the subject line.
If you would like to exercise one or more of the rights above, please contact us using the contact information provided above or submit your request through our Privacy Opt-Out Form. You may designate an authorized agent to make a request on your behalf. Such authorized agent must be registered with the California Secretary of State. We may deny a request from an agent that does not submit proof that they have been authorized by you to act on your behalf.
We may need to confirm your verifiable consumer request before completing your request, and, for example, may ask for you to confirm data points we already have about you. We will only use personal data provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
We do not currently process or respond to “Do Not Track” signals from your browser. As previously described, we do participate in online advertising networks administered by third parties, which may track your online activities over time and across third-party websites. You may opt-out of interest-based and other targeted advertising as set forth above in the Targeted Advertisingsection. However, even if you opt out of such ads, AARP may continue to collect and use online activity data on our websites and in our apps for other purposes.
Our websites and apps may provide links or automatically redirect you to third-party websites that are not controlled by AARP or governed by this Privacy Policy. For example, if you click on an advertisement or a link for a member benefit offered by a Licensed Service Provider, you may be redirected to a website operated by that provider. These third-party websites may collect personal data and other data from or about you. We are not responsible for the content or privacy practices of any website that we do not control, and your interactions with such websites are governed solely by the privacy policies of the entity operating the websites, not this Privacy Policy.
If you are logged in to your social media account or use your social media credentials to log-in to our websites or apps, and if you use a “like” button or similar social media feature on our website or app, those social media companies may collect certain information about you, such as your IP address and which pages you visit on our websites or apps. These social media features are not operated by AARP. Your interactions with social media companies and the use of their features are governed by the privacy policies of the social media companies that provide those features, not this Privacy Policy.
AARP is headquartered in the United States and all of our data processing activities occur in the United States. Any personal data you provide to us, including through our websites and apps, will be transferred to, processed, and stored in the United States. By providing us your personal data or using our websites and apps, you acknowledge that the United States has standards for the processing and storage of personal data that may not be equivalent to (and may be less comprehensive than) those in the country where you reside and/or are a citizen, and you consent to our collection, transfer, processing, and storage of your personal data in the United States.
Our websites and apps are not intended for use by children under the age of 13 and we do not knowingly collect personal data from such children. If a child under the age of 13 has provided us with personal data, we ask that a parent or guardian contact us so that the personal data can be deleted.
We may update this Privacy Policy at any time and without prior notice by posting an updated Privacy Policy on our websites and in our apps. When we do so, we will revise the “last updated” date at the top of the Privacy Policy. If we make material changes in the way we use and/or share your personal data, we will attempt to notify you directly, such as by sending an email to the email address you most recently provided to us and/or by prominently posting notice of the changes on our websites and in our apps.