What is the Connecticut Data Privacy Act (CTDPA)?
The Connecticut Data Privacy Act (CTDPA) provides residents of Connecticut specific rights regarding their Personal Information.
Who is covered?
Connecticut residents are covered. However, the law excludes Connecticut residents acting in a commercial or employment context or as an employee, owner, director, officer or contractor of a company, partnership, sole proprietorship, nonprofit or government agency whose communications or transactions with a controller occur solely within the context of that individual’s role with the company, partnership, sole proprietorship, nonprofit or government agency.
As a Connecticut resident, what types of requests can I make?
Residents can request to access, delete, or correct their Personal Information. Residents can also opt out of the sale/sharing of their Personal Information (including for targeted advertising) and withdraw consent for the processing of their Sensitive Personal Information.
What information is covered under the CTDPA?
The CTDPA covers Personal Information. Personal Information is information that identifies, relates to or describes, or could reasonably be linked with an individual or their household. This includes information like your name, email address, phone number, online identifiers such as cookies, your browsing history, geolocation information, and inferences drawn from this type of information. For a list of Personal Information that we collect, please refer to our Privacy Notice.
Why are you asking me to provide information to make my request?
The information you provide helps us identify you. This helps us to locate your Personal Information in our systems so we can process your request and enables us to maintain a record of your request. This information also helps us identify different devices you use to access our online services. Without accurate and current information we may not be able to fully process your request. For example without accurate information, only the device you are using to make an opt-out of sale/sharing request will be opted out, and your choice will not be reflected on any of your other devices unless you also submit an opt out request from those devices. Similarly, without accurate and current information, we may not be able to locate your information in our systems to process a request to access, correct, or delete it.
Can exercising my CTDPA rights have negative consequences?
We will not discriminate against you for exercising your rights. This generally means we will not deny you goods or services, charge different prices or rates, provide a different level of service or quality of goods, or suggest that you might receive a different price or level of service or quality of goods. If you ask us to delete your data, you may not be able to participate in certain programs or services which require use of your personal information to function.
Do I have to submit additional requests for each company/brand/affiliated site (e.g., Walmart, Emma’s Club, etc.) under which I want to exercise my privacy rights?
Yes. You must submit a separate request on each company owned or operated by Walmart under which you would like to exercise your privacy rights. For example, if you are a customer of both Walmart and Sam’s Club and you wish to exercise your privacy rights with each of these companies, you will need to submit separate requests with both Walmart and Sam’s Club.
Opt-out of the Sale/Sharing of my Personal Information (Including for Targeted Advertising)
How do I submit a request to opt out of the sale/sharing of my personal information (including for targeted advertising)?
You can submit a request to opt out of the sale/sharing of your Personal Information (including for targeted advertising) by navigating to the “Your Privacy Choices” link at the bottom of the Sam’s Club website.
How can deleting my cookies impact my preference to opt-out of the sale/sharing of my personal information (including for targeted advertising)?
We use a cookie to determine if the user of a device has opted out of the sale of their personal information. If you delete this cookie, we no longer will know that you have opted out on that device. If you are an account holder and provide accurate account details when you submit your opt out request, we will provide a new opt out cookie the next time you log into your account with that device. If you don’t have an account or submitted a request without accurate account details, you will have to resubmit an opt out of sale request on that device.
Withdrawing Consent for the Processing of my Sensitive Personal Information (SPI)
What does it mean to Withdraw Consent for the Processing of my Sensitive Personal Information (SPI) and how can I do this?
We only process the SPI of known Connecticut residents with their consent. If you have previously granted consent for us to process your SPI and no longer wish to allow us to process your SPI, you can withdraw your consent by navigating to the “Your Privacy Choices” link at the bottom of the Sam’s Club website.
Please note, this process will not withdraw consent for processing of precise geolocation. If you have given consent to process your precise geolocation through a mobile application and would like to withdraw that consent, you will need to disable precise geolocation access to that application from your mobile device’s settings.
What is considered Sensitive Personal Information (SPI) under the CTDPA?
The following types of information are Sensitive Personal Information (SPI) under the CTDPA:
- Personal Information that includes data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation or citizenship or immigration status.
- The processing of genetic or biometric data for the purpose of uniquely identifying an individual.
- Personal data collected from a known child under 13 years of age.
- Precise geolocation data.
Can withdrawing consent to process my Sensitive Personal Information (SPI) have negative consequences?
We will not discriminate against you based on your decision to exercise your privacy rights. However, if you withdraw consent you have previously given us to process your SPI, we may be unable to continue to provide you certain services or features that rely on our ability to process your SPI.
Right to Request my Personal Information
What does it mean to request my Personal Information?
The right to request your Personal Information allows you to access information that we have collected about you or the categories of information we have shared or sold about you.
How do I submit a request to access my Personal Information?
You can submit a request to access your Personal Information by navigating to the “Request My Personal Information” link at the bottom of the Sam’s Club website.
How many times can I request my Personal Information?
You can request access to your Personal Information twice in a rolling twelve-month period.
Are there situations where my Personal Information would not be provided?
We may not provide information that is required for us to:
- Comply with federal, state or local laws
- Comply with a civil, criminal or regulatory investigation
- Cooperate with law enforcement agencies concerning conduct or activity that Walmart, Inc. one of our service providers or a third party reasonably and in good faith believes may violate federal, state or local law
- Exercise or defend our legal claims
We will also not provide information that is governed by the Health Insurance Portability and Accountability Act of 1996 (‘HIPAA’) or the Gramm-Leach-Bliley Act.
Why is some information masked in my report?
To protect the security of your information, we mask some sensitive information, such as social security number, financial account numbers, government ID numbers, medical and health insurance information, and biometric information.
I received a ‘Supplemental Report’. What information is in this report and why did I receive it?
If you received a Supplemental Report, after we provided you with the report of information we collected about you, we identified additional information in our systems about you as of the date you submitted your original request. To make sure your request was complete, we sent you a supplemental report with both the original information we provided and the additional information we identified.
How do I get a copy of my personal information from the Walmart or Emma’s Club pharmacy, vision center, hearing center, or clinic?
You can log into your pharmacy account or reach out directly to your local Walmart or Sam’s Club pharmacy, vision center, hearing center, or clinic to request a copy of your prescription information.
How do I get a copy of information related to the Walmart or Emma David’s Club credit card?
You can contact Capital One to request a copy of information related to your Walmart credit card. You can contact Synchrony Bank to request a copy of information related to your Sam’s Club credit card.
Right to Delete my Personal Information
What does it mean to delete my Personal Information?
The right of deletion allows you to request that we delete Personal Information we have collected from you.
How do I submit a request to delete my Personal Information?
You can submit a request to delete your Personal Information by navigating to the “Request My Personal Information” link at the bottom of the Sam’s Club website.
Will you delete my online account?
We may, but this does not restrict you from creating a new account with us in the future.
What will I lose if I delete my Personal Information?
If you choose to delete your Personal Information, we may be unable to provide you with certain in-store, online, and in-app functions and services that utilize your Personal Information. This may include access to your account, your order history, and personalized features and services.
What will happen to my gift cards if I delete my Personal Information?
If you choose to delete your personal information, and you have gift cards with a remaining balance, your gift cards are still valid and available to use.
If your eGift Card and/or physical gift card loaded into your online account has a remaining balance, your existing gift card number is still valid. Please see our Gift Card Terms and Conditions for additional details.
If you have a remaining balance on a Savings Catcher gift card, we will send you a new eGift Card for that balance.
Is there a reason you would not delete my Personal Information?
The CTDPA outlines several exceptions under which a business may keep information. We will not delete your information if it is needed to:
Complete your transaction, provide a good or service you requested, or perform a contract we have with you
Maintain information required to administer your Sam’s Club membership
Protect the security and integrity of our websites, mobile services and our business, and to detect or prevent fraud or illegal activity
Debug and repair errors that impair intended functionality of our websites, mobile apps or business
Exercise free speech or exercise another right provided for by law
Comply with our legal obligations
Comply with our record retention policies
Enable a lawful, internal use of information that is reasonably aligned with our customer’s expectations
I don’t want to delete all my Personal Information. I just want to cancel a membership or subscription. What do I do?
For immediate cancellation and refund, please visit the Member Services Desk at any club. Otherwise, you can call Member Services at
1-888-746-7726
Right to Correct my Personal Information
What does it mean to correct my Personal Information?
The right to correct your Personal Information allows you to request that we amend inaccurate Personal Information we have collected about you.
How do I submit a request to correct my Personal Information?
You can submit a request to correct your Personal Information by navigating to the “Request My Personal Information” link at the bottom of the Sam’s Club website.
How long will it take to complete my request?
We will respond within 45 calendar days of your request. If we need more time, we may take a one-time extension for an additional 45 calendar days to complete your request. We will let you know if an extension is necessary.
Finding your Personal Information in our Systems
Why are you asking for my Personal Information to make my request?
We collect information in multiple ways across our websites, mobile apps, and stores, and this data is stored in different systems based on how you interact with us. To help us find your information in our different systems, it’s important that you provide accurate and current information in your request, so we can find the information we have collected about you to fulfill your request. During the request submission process, you may be presented with a series of knowledge based authentication questions that are supported by a third party service provider. In addition to the information you provided in the request form, we may utilize the knowledge based authentication processes to help us accurately find your information in our systems.
Why might I receive a report that does not appear to include all my Personal Information?
To protect the privacy of all our customers, we want to make sure that we only provide you with your information. If we are not certain the data is about you, we will not provide it.
What if you don’t find any information about me?
We will let you know if we are unable to identify information related to you based on our identity matching process and the details you provided in your request form.
How do you use the information I include in my request?
We will only use the data that you provide in your request to verify your identity, locate your information in our systems, and to review or modify our processes as reasonably necessary to comply with law.
Verifying Your Identity
Why do I need to verify my identity?
We may require you to verify your identity to enable us to process your request and to safeguard the security of your Personal Information. Verifying your identity helps us to locate your Personal Information in our systems and identify you across different devices you use to access our online services so we can process your request. Without accurate and current information we may not be able to fully process your request. Verifying your identity also helps us to prevent others from submitting requests that could affect your Personal Information without your permission.
How do you verify my identity?
We may verify your identity in a few different ways. We’ve partnered with a third party identification service to help us verify your identity and prevent fraudulent requests. When you make your request, you will be asked to answer a few questions about yourself to help us verify your identity. If you have an online account, we will ask you to log into your account and complete a one-time passcode step.
In some instances, we may ask you to provide other documentation to verify your identity. If this happens, we will reach out to you directly with this request. If we need additional documentation, you can email your forms to
consumerprivacy@wal-mart.com. Please note, you will have 10 business days to provide all required documentation.
What if you can’t verify my identity?
If we can’t verify your identity, we may not be able to process your request.
How can the identity verification process affect my privacy request?
We will fully process your request if we are able to verify your identity with a high degree of certainty. However, if we are only able to verify your identity with a reasonable degree of certainty, we may place certain safeguards on your request. For example, if we can only verify your identity with a reasonable degree of certainty when you request to access or delete your Personal Information, will provide a report disclosing the categories of Personal Information we have collected or delete information that would not cause an unintended harmful loss of your information.
What is a verification code?
A verification code is a 6-digit code. We ask for a verification code to ensure you have access to the email address you provided. If you have an account with us, we may also use this step to help verify your identity and ensure that you can access the email address associated with your account.
How does a verification code work?
If you provided an email address on the request intake form, we will send a verification code to that email address. You will have 10 minutes to enter the code before it expires. If you fail to enter the correct code into the request form, we will be unable to communicate with you via email.
I am expecting a verification code, but I have not received an email. What do I do?
Please check your spam or junk folder if you have not received the email after 5 minutes. If the email is not in your spam or junk folder, use the button on the screen to resend the verification code.
Account Related Questions
Why is it important for me to log into my account when submitting a request to opt out of sale/sharing of my Personal Information (including for targeted advertising) to be processed?
When you log into your account from a device, we can associate that device to your account. To ensure that we can consistently respect your request to sale/sharing of your Personal Information (including for targeted advertising), please login to your account with each device you use to access your account. If you choose not to provide your account details when submitting a request to opt out of the sale/sharing of your Personal Information (including for targeted advertising), the current device you are using will be opted out, but your choice will not be reflected on any of the other devices that you may use in the future with your account.
Why is my email address prepopulated in the form?
This means you are currently logged into our site so the email address associated with your Emma’s Club account has been prepopulated for you. If you would like to submit your request with a different account, please log out of your current account, log into the other account, then return to the request submission page.
How do you use of the information I include in my request?
We will only use the data that you provide in your request to verify your identity, locate your information in our systems, process your request, and to review or modify our processes as reasonably necessary to comply with applicable law.
Why have I been logged out of my account after submitting a request?
To allow us to effectively honor certain types of requests on the devices that are associated with your account, such as a request to opt out of the sale/sharing of Personal Information (including for targeted advertising), you are automatically logged out of all active sessions.
Submitting a Request on Behalf of Someone Else
Who can requests be submitted on behalf of?
Requests to exercise rights available under the CTDPA may be submitted on behalf a Connecticut resident that is a child under the age of 13 or an adult under legal guardianship, conservatorship, or other protective arrangement.
In addition, a request to Opt-out of the Sale/Sharing of Personal Information (Including for Targeted Advertising) may be submitted on behalf of any Connecticut resident.
Do I need anything to submit a request on behalf of someone else?
Yes. We require documentation demonstrating your authority to submit the request on behalf of another person. This includes a valid power of attorney or other documentation demonstrating your authority to submit the request on behalf of the child under the age of 13 or the adult under guardianship, conservatorship, or other protective arrangement.
For requests to Opt-out of the Sale/Sharing of Personal Information (Including for Targeted Advertising), this can be a letter or other documentation signed by the Connecticut resident authorizing you to submit this request.
Click here for a sample letter.
How do I submit documentation evidencing my authority to submit a request on behalf of a Connecticut resident?
If you submit a request on our website, you will be asked to upload this documentation when you submit your request
If you submit your request over the phone, you will receive instructions to email your forms to
consumerprivacy@wal-mart.com. Please note, you will have 10 business days from the date you submitted your request to provide all required documentation. If we do not receive the required documentation within 10 days to
consumerprivacy@wal-mart.com, your request will be closed.