- California Privacy Notice
- Information We Collect
- Use of Personal Information
- Sharing Personal Information
- Disclosures of Personal Information for a Business Purpose
- Opting Out of the Sale and Sharing of Personal Information
- Your Rights and Choices
- Non-Discrimination & Financial Incentives
- California Do Not Track Disclosure
- California Shine the Light
- Changes to this Privacy Notice
- Contact Information
This California Privacy Notice supplements the information contained in Cars.com Inc’s ("Cars.com" "we" "us" or "our") general Privacy Notice (“Privacy Notice”) and applies solely to all visitors, users, and others who reside in the State of California ("consumers" or "you"). If you are a California resident, California law provides you with additional rights regarding our use of your Personal Information. We provide this notice in accordance with the California Consumer Privacy Act of 2018 and California Privacy Rights Act of 2020 (collectively the "CCPA") and any terms defined in the CCPA have the same meaning when used in this Notice. References to “Site” shall mean the Cars.com website located at www.cars.com and “Services” shall refer to the services offered by Cars.com on the Sites, and other services used to service our products and Services.
Information We Collect
Please see our Privacy Notice for a description of the Personal Information we collect.
In particular, we have collected the following categories of Personal Information from or about consumers within the last twelve (12) months:
(Including, but not limited to) or (non-exhaustive list)
(YES or NO)
|A. Identifiers.||Real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.||YES|
|B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).||Name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.||YES|
|C. Protected classification characteristics under California or federal law.||Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).||YES|
|D. Commercial information.||Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.||YES|
|E. Biometric information.||Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.||NO|
|F. Internet or other similar electronic network activity.||Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.||YES|
|G. Geolocation data.||Physical location or movements.||NO|
|H. Sensory data.||Audio, electronic, visual, thermal, olfactory, or similar information.||NO|
|I. Professional or employment-related information.||Current or past job history or performance evaluations.||NO|
|J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).||Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.||NO|
|K. Inferences drawn from other personal information.||Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.||YES|
|L. Sensitive Information||Government identifiers (social security, driver's license, state identification card, or passport number); Complete account access credentials (usernames, account numbers, or card numbers combined with required access/security code or password); Precise geolocation; Racial or ethnic origin; Religious or philosophical beliefs; Union membership; Genetic data; Mail, email, or text messages contents; Unique identifying biometric information; Health, sex life, or sexual orientation information.||NO|
We obtain the categories of Personal Information listed above:
- Directly from you when you provide it to us, including any correspondence or communication with us, such as through e-mail, webforms, or through your use of the Sites and/or Services, including use via mobile cellular devices.
- Automatically as you navigate the Site and/or interact with the Services. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies.
- From third parties, such as our business partners, who have a right to provide us with that information.
Use of Personal Information
Please see our Privacy Notice for a description of how we use your Personal Information. Note that Personal Information does not include the following categories, which are excluded from the CCPA's scope:
- health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; and
- personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.
Sharing Personal Information
We may share the Non-Personal Information we collect and obtain for any lawful business purpose without any duty or obligation of accounting or otherwise to you, provided that the information remains Non-Personal Information. This will include, by way of example, sharing that Non-Personal Information with third parties.
We may share your Personal Information to a third party for a business purpose. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.
We may disclose personal information that we collect or that you provide as described in our Privacy Notice:
- To submit and transmit lead data to Cars.com advertisers.
- To provide targeted advertising both on the Site and on third-party advertising platforms (for example, in connection with our FUEL advertising product).
- To power individualized or targeted user experiences across the Site and to improve those experiences.
- To engage in attribution and analytics modeling such as lead scoring and performance reporting to advertisers.
- To confirm or fulfill a request that you make (e.g., in order to send you a price quote or other information you have requested, Cars.com may share your contact information and content interests with a participating Cars.com dealer and/or manufacturer).
- To deliver marketing communications via text or SMS, which, by providing your mobile number to Cars.com, you have expressly consented to receive.
- To follow up on any request that you have previously made (e.g., Cars.com may contact you to determine whether the dealer and/or manufacturer responded to your original request).
- To communicate with you regarding the Cars.com service (e.g., Cars.com may send you emails or call you to confirm a price quote request or to notify you that you have received a lead regarding a vehicle you have advertised or to request that you participate in a survey).
- To send promotional materials, newsletters or other content via email, text message, or otherwise. If you no longer wish to receive a particular email newsletter or other promotion from Cars.com, you must follow the opt-out instructions included in such email newsletters, text messages, and promotions.
- To permit third-parties (to whom Cars.com may disclose personally identifiable information specifically for direct marketing purposes) to send you promotional or informational messages, but if contact is via phone or SMS only if you have first affirmatively agreed to receive such messages. You agree that the seller or other third-party may use an autodialer to text or call, and that a portion of any call may be prerecorded.
- To manage Cars.com's business and its relationships with affiliates, customers, and other third-parties to which Cars.com may disclose personally identifiable information pursuant to this Policy.
- To assist in Site administration, analysis, research, development, optimization and other internal purposes, including, without limitation, to compile Usage Data.
- To improve user experience.
- To manage Cars.com’s business and its relationships with affiliates, customers, and other third parties to which personal information may be disclosed pursuant to the Terms of Service.
- For any other purpose disclosed by us when you provide the information.
- With your consent.
We may also disclose your personal information:
- To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
- To enforce or apply any agreement we have with you.
- If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Cars.com, our customers, or others.
- If we transfer ownership or control of any portion of Cars.com or the Site and/or Service to a third party, whether or not in the context of an acquisition, merger, or reorganization, we may transfer information to that third party, provided that the use of any of your Personal Information by that third party remains subject to the terms of this Privacy Notice for California Residents.
Disclosures of Personal Information for a Business Purpose
In the preceding twelve (12) months, Cars.com has disclosed the following categories of Personal Information for a business purpose:
Category A: Identifiers.
Category B: California Customer Records personal information categories.
Category D: Commercial information.
Category F: Internet or other similar network activity.
Category G: Geolocation data.
Category I: Professional or employment related evaluations.
Category L: Sensitive Information
We have disclosed your Personal Information for a business purpose to the following categories of third parties:
- Service providers
- Marketing and advertising providers
- Automotive dealers
- Digital retail partners
Opting Out of the Sale and Sharing of Personal Information
California residents may opt out of the “sale” or “sharing” of their Personal Information. While Cars.com does not exchange Personal Information for payment, we share information with businesses who provide cross-platform advertising and related tracking and analytics for our products in a way that falls under the CCPA’s broad definition of “sale” or “share.” Under the CCPA, “sale” is defined such that it may include allowing third parties to receive certain information, such as cookies, IP address, and/or browsing behavior, to deliver targeted advertising related to the services. “Sharing” is defined as any disclosure, transfer, or other communication of Personal Information to third parties for purposes of advertising that is targeted based on a consumer’s activities on third-party and distinctly branded digital platforms, whether or not for monetary gain. Cars.com does not knowingly sell the information of minors under the age of 18 without affirmative consent.
If you would like to opt out of the use of your Personal Information for such purposes that may be considered a “sale” or “sharing” under California law, you may do so by emailing email@example.com.
Your Rights and Choices
The CCPA provides California residents with specific rights regarding their Personal Information. This section describes your CCPA rights and explains how to exercise those rights. Please note that we may limit the information we provide you, or deny your request, if the access request for information is governed by a superseding federal regulation (ie: GLBA, FCRA, etc).
1. Access, Use Limitation, and Data Portability Rights
You have the right to request that we limit the use and disclosure of certain Personal Information, opt-out of the use of certain Personal Information, as well as disclose certain information to you about our collection and use of your Personal Information over the past 12 months. Please note that the rights below are not unqualified, we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply You may request that we:
- Disclose to you the categories of Personal Information we collected about you.
- Disclose to you the categories of sources for the Personal Information we collected about you.
- Disclose to you our business or commercial purpose for collecting or selling that Personal Information.
- Disclose to you the categories of third parties with whom we share that Personal Information.
- Disclose to you the specific pieces of Personal Information we collected about you (also called a data portability request).
- Disclose to you if we sold, shared, or otherwise disclosed your Personal Information for a business purpose, separately disclosing:
- Sales, identifying the Personal Information categories that each category the recipient purchased;
- Sharing, identifying the Personal Information categories that we shared with each category of recipient; and
- Disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained.
- Disclose to you if we used automated decision-making technology to evaluate or create a profile of you and provide information about the logic involved in such decision-making processes, including descriptions of the likely outcome.
- Stop using automated decision-making technology to evaluate you, create a profile of you, and make predictions about your future behavior.
- Limit the use and disclosure of your “sensitive personal information,” as that term is defined in the CCPA. At your request, we will use “sensitive personal information” only for purposes necessary to provide the Service.
2. Deletion Request Rights
You have the right to request that we delete your Personal Information that we have collected from you and retained, subject to certain exceptions. Once we receive and confirm your consumer rights request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.
We may deny your deletion request if retaining the information is necessary for us, or our service provider(s), to:
- Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
- Debug products to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
- Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
- Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
- Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
- Comply with a legal obligation.
- Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
- Comply with applicable federal regulations with different retention, deletion, access, disclosure, or storage requirements which take precedence over state regulations.
3. Correcting Your Personal Information
You have the right to request that we correct any inaccurate Personal Information we hold about you. Upon receipt and verification of your request to correct inaccurate Personal Information, we will use commercially reasonable efforts to correct your Personal Information as directed by you, pursuant to the law and applicable regulations.
4. Exercising Access, Use Limitation, Data Portability, Deletion, and Correction Rights
To exercise the access, use limitation, data portability, and deletion rights described above, please submit a consumer rights request to us by any of the following methods:
- By calling 312.601.5000
- By emailing firstname.lastname@example.org
Only you, or someone legally authorized to act on your behalf, may make a consumer rights request related to your Personal Information. To designate an authorized agent, please contact us through the methods noted above. Only the consumer or authorized agent may make a consumer rights request related to their personal information. An “authorized agent” is a person (or a business entity registered with the California Secretary of State) that consumers have authorized to act on their behalf, or an individual granted authority under a written power of attorney issued pursuant to California Probate Code sections 4000 to 4465.
If you are an authorized agent who wishes to submit a request to know, a request to limit use, a request to delete, or a request to opt-out on behalf of another consumer, please submit to us sufficient information to allow us to verify your identity to a reasonably high degree of certainty and either:
- Proof of authorization to submit the request, written and signed by the consumer; or
- A power of attorney pursuant to Probate Code sections 4000 to 4465.
We may deny a request from an authorized agent who does not submit adequate proof that they have been authorized by the consumer to act on the consumer's behalf. We may also contact the consumer directly to confirm their identity and that they provided you permission to submit the request on the consumer's behalf.
You may only make a consumer rights request for deletion, access, or data portability twice within a 12-month period. The consumer rights request must:
- Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative.
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.
Making a consumer rights request does not require you to create an account with us. However, we do consider requests made through your password protected account sufficiently verified when the request relates to Personal Information associated with that specific account.
We will only use Personal Information provided in a consumer rights request to verify the requestor's identity or authority to make the request.
5. Response Timing and Format
We endeavor to respond to a consumer rights request within thirty (30) days of its receipt. If we require more time (up to 45 days), we will inform you of the reason and extension period in writing.
We will deliver our written response by mail or electronically, at your option.
Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
We do not charge a fee to process or respond to your consumer rights request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
Non-Discrimination & Financial Incentives
We will not discriminate against you for exercising any of your CCPA rights.
However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your Personal Information's value and contain written terms that describe the program's material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.
California Do Not Track Disclosure
Do Not Track (“DNT”) is a privacy preference that you can set in your web browsers, which allows you to opt out of tracking by websites and online services. We do not currently recognize or respond to DNT signals. For more information about DNT, please see https://www.eff.org/issues/do-not-track .
California Shine the Light
California's "Shine the Light" law (Civil Code Section § 1798.83) permits users of our Service who are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please send an email to email@example.com.
Changes to this Privacy Notice
We reserve the right to update and periodically amend this Privacy Notice for California Residents at our discretion and at any time. If we make changes to this Privacy Notice for California Residents, amendments will be posted online, and the date of update will be included. Your continued use of Cars.com and its affiliated sites after any such update indicates your agreement to the same.
If you have any questions or comments about this notice, the ways in which Cars.com collects and uses your information, or your choices and rights regarding such use, please do not hesitate to contact us at:
Effective Date: January 1, 2023