9 Ways Grocery Stores Use Virginians’ Personal Data Without Them Realizing It

Grocery loyalty programs across Virginia save shoppers money every week.

But none of them, Safeway or Kroger or the smaller chains between them, hands out that convenience without taking something back.

These are the ways grocery stores use Virginians’ personal data, often without them realizing it.

In almost all cases, it’s completely legal.

Note: This is general information, not legal advice. Data privacy rules and consent requirements are subject to change, so confirm the current details with the Virginia Attorney General’s office.

1. Your Loyalty Card Keeps a Permanent Record

Kroger scans a Virginia shopper’s loyalty card at checkout, and the store remembers it.

An investigation by The Markup found Kroger’s data practices let it hold a member’s full purchase history with no set time limit, tied to that shopper’s actual name and address.

Kroger runs dozens of stores across Virginia, all feeding that same file.

Milk and eggs are just the beginning of what that file holds.

Kroger uses it to infer a shopper’s age, income, and family status from whatever turns up in their cart week after week.

2. Kroger’s Data Arm Sells Your Habits to 1,400 Companies

Kroger’s data science subsidiary, 84.51°, turns those loyalty files into a product it sells to outside companies.

More than 1,400 companies, including General Mills, Unilever, Coca-Cola, and Kraft Heinz, per that same investigation.

Big brands.

Those companies use the insights to see how a shopper’s habits shift, then adjust which coupons, shelf placement, or ads reach that same shopper next.

Kroger’s marketing engine sorts a shopper in Roanoke stocking up on baby formula into the same kind of category as a shopper in Fairfax buying energy drinks.

3. Your Cart Follows You Onto Facebook and Snapchat

Kroger sells that same shopper data to other companies, but selling is only half of what Kroger does with it.

Kroger Precision Marketing, the company’s own ad network, uses those same purchase signals to follow one shopper with ads on Facebook, Instagram, Pinterest, Snapchat, and TikTok.

Kroger’s network reaches that same shopper on Roku, Paramount, and other streaming and audio apps once the television turns on.

A certain brand of cereal shows up in the cart, and soon a rival brand’s ad shows up on a streaming show that night.

That’s not a coincidence.

It’s the same loyalty number, just moving to a different screen in the same house.

4. Digital Price Tags Can Charge the Shopper Next to You Less

Kroger’s grocery stores have been testing electronic shelf labels that can change prices throughout the day instead of a paper tag that stays put.

Sens. Elizabeth Warren and Bob Casey sent Kroger a formal letter in August 2024 demanding answers about the technology, warning it could let the chain price groceries the way airlines price seats.

That’s surge pricing on milk.

The Federal Trade Commission’s own surveillance-pricing study found the software behind this kind of pricing already serves more than 250 retail clients, grocery chains included, using a shopper’s location, browsing, and purchase history to help set that shopper’s price.

Two Virginians could scan the same box of cereal on the same afternoon and never see the same number.

5. Albertsons Turns Your Own Searches Into Paid Ad Space

Albertsons, the parent company behind Safeway stores in Northern Virginia, runs its own retail-media business called Albertsons Media Collective.

That division sells brands a shortcut to a shopper’s cart: Sponsored products surface inside the store’s own search results, drawing on a shopper network Albertsons says spans more than 51 million loyalty members.

A shopper types “pasta sauce” into the app, and Albertsons decides which jar a paying brand wants to answer that search.

That’s not neutral.

Albertsons expanded the feature in June 2026 through a partnership with the ad-tech company Criteo, layering artificial intelligence (AI) product placement on top of a shopper’s own search terms and shopping history.

6. Parking Lot Cameras Log Your License Plate

Safeway stores across Northern Virginia belong to Albertsons, and Albertsons’ own policy confirms it runs automated license plate readers in some of its lots.

Those cameras capture the plate, plus the date, time, and location of the visit.

Albertsons keeps that file for up to 60 days, or up to a year at locations it flags as higher risk.

It’s filed as security footage.

Albertsons says it doesn’t sell that plate data, but it does hand it to police and swaps details like a vehicle’s make and color with other retailers chasing the same theft rings.

7. Grocery Apps Record Every Tap and Scroll You Make

Instacart handles delivery and pickup for Food Lion and Harris Teeter locations across Virginia, and its own privacy policy admits the app tracks more than an order.

Instacart discloses something it calls a session replay, a recording of every click, scroll, and keystroke a shopper makes inside the app.

That recording can show every word typed into the search bar and how long a shopper’s cursor lingers on a product page before it lands in the cart, per that same policy.

That’s not customer service.

That’s the app equivalent of someone reading over a shopper’s shoulder.

Instacart shares that behavioral data, along with a shopper’s precise location whenever the phone allows it, with marketing and advertising partners for targeted ads on other sites.

8. Walmart’s Bluetooth Beacons Track Which Aisle You’re In

Walmart mounts Bluetooth beacons near the shelves in many of its stores, and those beacons can sense exactly where a shopper’s phone is standing, aisle by aisle, whenever the Walmart app is open.

That’s not the parking lot.

Walmart’s own privacy notice says it can use that in-store signal to show a shopper nearby products and help that shopper navigate the store.

Virginia’s privacy law treats a shopper’s precise location as sensitive data, in the same category as a health diagnosis or citizenship status.

That category requires a shopper’s opt-in consent before a company can process it, not just a buried line in a privacy policy.

Tapping “Allow” on the location prompt the first time the Walmart app opens is what supplies that consent.

9. “Anonymized” Data Sold to Outsiders Isn’t Anonymous

Grocery chains strip names off purchase files before selling them to outside data brokers and analytics firms, and they call the result anonymized.

Researchers at the Massachusetts Institute of Technology (MIT) Media Lab ran a comparable test on three months of credit-card transaction records from 1.1 million people.

The study found that just four purchases, including the rough date and location of each one, were enough to re-identify 90% of the people in the file.

That’s almost everyone.

The same math applies to a grocery loyalty file: A shopper’s name already removed can still point straight back to a single household once it’s matched against other data floating around online.

Data brokers that buy these “anonymized” files rarely need a shopper’s name at all.

A home address, a rough birth year, and a running list of what showed up in the cart last month already narrow the field down to one Virginia household.