User:Johny2times/CVS Pharmacy

Johny2times/CVS Pharmacy

Basic information
Founded	1963
Legal Structure	Subsidiary
Industry	Retail
Also known as	CVS
Official website	https://www.cvs.com/

CVS Pharmacy, Inc., commonly known as CVS, is a United States retail pharmacy company and a subsidiary of CVS Health. Founded in 1963 as Consumer Value Stores, CVS operates a retail pharmacy network and digital services including CVS.com and the CVS mobile app.

CVS's consumer-facing services include prescription-management tools, online shopping and delivery functions, pharmacy and healthcare-service communications, photo services, and the ExtraCare and ExtraCare Plus loyalty programs.

Consumer impact

User freedom

CVS's digital services depend on customer accounts, online orders, payment processing, communications, and loyalty-program activity. CVS's Retail Terms of Use state that CVS may modify, suspend, or discontinue services or features.

The Retail Terms of Use marked “Last updated: September 4, 2026” state that many disputes must be resolved through individual binding arbitration. The terms also include a jury-trial waiver, class-action waiver, informal dispute-resolution requirements, and procedures for certain coordinated arbitration filings.

User privacy

CVS's retail privacy policy describes collection and use of personal information associated with CVS stores, CVS.com, the CVS mobile app, ExtraCare, pharmacy and healthcare-service communications, and related services.

The policy describes collection of identifiers, commercial information, internet and device activity, location-related information, shopping activity, searches, keystrokes, mouse movements, form entries, chat recordings, and information entered into AI-supported tools.

The policy states that CVS may sell or share certain identifiers, commercial information, internet activity, and non-precise location data for targeted advertising, subject to privacy rights and opt-out choices that may vary by state law.

CVS's policy also discusses the use of AI-supported tools and Automatic License Plate Recognition technology at or near certain stores. The policy states that ALPR information is generally retained for approximately 60 days, subject to exceptions described in the policy.

A CVS Health corporate privacy policy effective December 30, 2025 stated that it did not govern CVS store customers or general CVS.com visitors, who were covered by a separate retail privacy notice. Because that corporate policy and the current retail privacy policy describe different scopes, they should not be treated as direct predecessor versions without further evidence.

Incidents

2009 FTC security settlement

In 2009, CVS Caremark settled Federal Trade Commission allegations that it failed to implement reasonable and appropriate security measures to protect sensitive medical and financial information belonging to customers and employees. The settlement required CVS Caremark to implement a comprehensive information-security program and obtain independent assessments every two years for 20 years.

2009 HIPAA disposal settlement

In 2009, CVS entered a resolution agreement with the United States Department of Health and Human Services regarding allegations that protected health information was disposed of in unsecured dumpsters. CVS paid $2.25 million and agreed to corrective-action requirements.

2026 digital privacy proposed settlement

In Brewer, et al. v. CVS Pharmacy, Inc. and Criteo Corp., Case No. CACE-26-008094, CVS Pharmacy and Criteo agreed to a proposed class-action settlement involving allegations that tracking technology used on CVS digital properties disclosed users' health-related and browsing information to third parties without adequate consent. The case is pending in the Circuit Court for the 17th Judicial Circuit in and for Broward County, Florida.

The proposed settlement provides for a fund of up to $20.5 million for qualifying persons who accessed covered CVS digital properties in the United States before July 27, 2026, subject to the settlement terms and court approval. The proposed settlement does not itself establish wrongdoing by CVS or Criteo.