Privacy Policy

Effective Date: January 23, 2025
A. Introduction

Carvana Operations HC LLC (“Carvana HC”), together with its parents, subsidiaries, and affiliates, including ADESA US AUCTION, LLC (“ADESA”) (collectively, “Carvana”) collects and processes information about you as described in this Consumer Privacy Notice (“Consumer Notice”). We are committed to protecting the privacy of those with whom we interact.

This Consumer Notice contains details about how we collect, use, and share personal information that we obtain from and about you when you interact with us via our website(s), email, mobile application(s), social media accounts, online advertisements, and other digital platforms (collectively, the “Digital Properties”), and in other online and offline interactions. This includes how we handle Personal Information (as defined by applicable data protection laws) that is subject to the California Consumer Privacy Act (CCPA) and the Oregon Consumer Privacy Act (OCPA) for California and Oregon consumers and website visitors.

This Consumer Notice does not apply to the below types of information that are subject to certain laws. Please refer to the applicable link(s) below for more information on how we process such information:

Information we collect in connection with providing individual consumers a financial product or service (or in connection with a consumer seeking such financial products or services), such as by reviewing applications for financing is subject to our Financial Privacy Notice (which can be viewed by clicking HERE) instead of this Consumer Notice because that data is regulated under separate laws, such as the federal Gramm-Leach-Bliley Act (“GLBA”), Fair Credit Reporting Act (“FCRA”), or the California Financial Information Privacy Act (collectively, “Financial Information”).
For California Business Contacts, such as our vendors, service providers, and business partners – click HERE to view our California Business (“B2B”) Privacy Notice
For California Candidates, such as applicants – click HERE to view our California Job Applicant Privacy Notice
For more information regarding Carvana's terms of use, please review our User Agreement, the terms of which are incorporated herein.

Changes: We may update this Consumer Notice from time to time. The current Consumer Notice will be effective when when published on the date indicated above. When required by applicable law, we will notify you of any changes to this Consumer Notice by posting an updated Consumer Notice on this website, and will seek your affirmative consent to use your personal information for a materially different purpose than described at the time the data was collected.

B. Sources of Personal Information

We collect information about you and how you interact with us in several ways, including:

Information you provide to us directly. Our website, mobile site, application, and/or other service, regardless of how distributed, transmitted, published, or broadcast (each, a "Service") may allow you and/or other users to create, post, store, and share content, including but not limited to messages, text, photos, graphics, videos, software, code, and other materials (collectively, "User Content"). We collect the information you provide to us directly, such as when registering and/or set up an account/profile to access the Service or Digital Properties, including by submitting User Content.
Information automatically collected or inferred from your online interaction with us. We automatically collect technical information about your online interactions with us (such as IP address or other unique identifier related to you or your laptop, personal computer, browser, mobile device, tablet, or other device (a "Device" or "Devices"), Device location, characteristics, and capabilities, prior and current web activity, your Carvana or ADESA website activities and related click data, and browsing preferences when you visit or interact with our Service or Digital Properties (“Usage Information”).
Information from public sources, including government entities from which public records are obtained and information you submit in public forums.
Information from third parties. We receive information about you and your interactions with us from third parties, such as identity verification partners, marketing and advertising providers, social media companies, ad networks, lead generators, data brokers, and companies that provide or sell lists of potential purchasers.
We may combine information that we receive from the various sources described in this Consumer Notice, including third party sources and public sources, and use or disclose it for the purposes identified below.

C. Types of Personal Information We Collect

The types of information that we collect about you (“Personal Information”) include:

Identifiers, such as your name, alias, postal address, country of residence, unique personal identifier, online identifier, internet protocol address, email address, account name, phone number, social media identifiers (e.g., X handle, Instagram name, etc.) driver’s license number, passport number, or other similar identifiers.
Customer records, such as signatures.
Protected Class and Demographic information, such as age, race, gender, gender identity, national origin, religion, citizenship, marital status, military or veteran status, or date of birth.
Commercial information and preferences, including records of personal property, products or services purchased, obtained, or considered, information you provide or post using the Service or Digital Properties, or other purchasing or consuming histories or tendencies.
Internet or other electronic network activity information, such as your browsing history, search history, and information regarding your interactions with us (including interacting with us online, through chat/chatbots, by mobile application, and through advertisements).
Geolocation information, such as approximate location based on your IP address.
Audio, electronic, visual, or similar information, such as video recordings of our premises, call center recordings, pictures you may post or submit via the Service or the Digital Properties, web activity recordings, or customer support chat logs and/or recordings.
Professional or employment information, such as job title, employer, business address and contact information, employment history, or other professional information.
Education information, such as education history, including information related to level of education derived from credit reports and related data sources.
Inferences drawn from any of the information we collect to create a profile about you reflecting your preferences, characteristics, and behaviors.
Sensitive personal information, such as social security number, driver’s license number, or passport number; account log-in information; racial or ethnic origin; and precise geolocation (with your express consent).
D. How We Use Your Personal Information

We may use each category of your information described above in the following ways:

To enable interactions between you and us or between you and other users or third parties, such as to facilitate online purchases of our products or those offered by other users or third parties using the Service or Digital Properties; process shipping and returns; register and administer your account, provide you with and support your interactions with us, other users, and/or third parties; diagnose, repair and track service and quality issues; facilitate an order, download, return, or exchange; provide requested product information; communicate with you about your account or our data practices; install and configure changes and updates to programs and technologies related to interactions with us; authenticate those who interact with us; or to respond to your requests, complaints, and inquiries.
For our own internal business purposes, such as to evaluate, audit, debug, or improve the usage, quality, and performance of programs and technologies related to interactions with us or third parties; design new services; process and catalog your responses to surveys or questionnaires (e.g., customer satisfaction reviews); perform internal research for technological development and demonstration; conduct data analysis and testing; and maintain proper business records and other relevant records.
For legal, safety, or security reasons, such as to comply with legal requirements; protect our safety, our property, or rights of those who interact with us, or others; conduct compliance training; investigate and respond to legal claims; respond to law enforcement requests; and detect, prevent, and respond to security incidents or other malicious, deceptive, fraudulent, or illegal activity.
For marketing. We may use your Personal Information to market our products or services or those of third parties, such as our business partners or other users of our Service. We may use your Personal Information to invite you to participate in marketing surveys, questionnaires, promotions, events, or contests. We may audit aspects of our ad impressions and verify positioning and quality of ad impressions. We may use your Personal Information for short-term transient use, including for contextual ad customization. We may use your Personal Information to enhance our content and to deliver advertisements to you, including commercial emails. For more information about online marketing activity, see Section F below.
Plaid Technologies, Inc. (“Plaid”): if you elect to link to Plaid during your use of the Service or Digital Properties, we may use Plaid to gather certain data from financial institutions. By electing to link to Plaid, you grant us and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution. By electing to link to Plaid, you agree to your personal and financial information being transferred, stored, and processed by us and Plaid in accordance with this Consumer Notice and the Plaid Privacy Policy.
For any other purposes for which you provide consent.
E. With Whom We Share Your Personal Information

We may share your Personal Information with the categories of recipients described below:

Affiliates and subsidiaries: We may share your Personal Information within the Carvana or ADESA group of companies, which includes parents, corporate affiliates, subsidiaries, business units, and other companies that share common ownership for the purposes described above.
Service providers: We may share your Personal Information with service providers working on our behalf in order to facilitate our interactions with you or request or support our relationship with you, such as hosting service providers, IT providers, operating systems and platforms, internet service providers, analytics companies, and marketing providers (e.g., we may share your email address with our outbound email marketing provider). We may contract with other companies to provide certain services, including identity verification, email distribution, market research, promotions management, and payment processing. We take reasonable efforts to provide these companies with only the information they need to perform services on our behalf.
Third parties necessary to complete a transaction or request. We may disclose information to third parties to provide you with services or benefits you may request, such as shipping vendors. We may also share information with third parties at your direction, such as if you direct us to send or receive information from third parties using Plaid, or if you interact with other users of the Service or Digital Properties.
Business partners and other third parties: We may also provide your Personal Information or provide access to your Personal Information to our business partners who may use it for their own purposes, such as supplemental product providers, including those who offer vehicle accessories, insurance, and other partners who work with us on promotional or sponsorship opportunities, including co-branded products and services; advertisers, ad platforms and networks, and social media platforms; lead generators; and third parties whose cookies and tracking tools we use as described in Section F (Cookies and Tracking Technologies).
For legal, security, and safety purposes: We may share your Personal Information with third parties such as law enforcement or other government agencies to comply with law or legal requirements; to enforce or apply our User Agreement and other agreements; and to protect our rights, property, and safety, and of our users and third parties.
In connection with a corporate transaction: We may transfer any information we have about you in connection with a change in corporate control, including but not limited to a merger or sale (including transfers made as part of insolvency or bankruptcy proceedings) involving all or part of Carvana or ADESA, or as part of a corporate reorganization or stock sale.
We may also de-identity, anonymize, or aggregate Personal Information to share with third parties for any purpose.

We do not knowingly or purposefully engage in the direct selling of customer phone number or other related short code data for the purposes of direct third party marketing to our customers without customers’ express consent, including for the purpose of direct marketing campaigns banned by carriers, such as Debt Forgiveness, Work and Investment Opportunities, and/or other similar campaigns.

F. How We Use Cookies and Tracking Technologies

We and authorized third parties may also collect information, which may include Personal Information, via cookies, web beacons, tracking pixels, embedded scripts, location-identifying technologies, Device recognition technologies, in-app tracking methods, Device and activity monitoring, session replay technologies, or other manual, passive, or automatic tracking technologies, programs, or platforms (“Tracking Technologies”).

Types of information collected. We and authorized third parties collect data about you and your Devices, including but not limited to Usage Information; your Internet Service Provider; IP address/Internet address from which you accessed our website(s) and/or other unique identifier(s) related to you or your Device(s); cookie ID; Ad ID; Device location (both approximate and precise); Device characteristics (including make, model, operating system/settings, and other specifications); browser type used; the date and time you access our website(s) and/or take certain actions on our website(s); recordings of your interactions with our websites and other Digital Properties; the pages you accessed while visiting our website(s) and related click behavior (such as products or offerings viewed and/or purchased); advertisements viewed; previously visited websites, applications, and services; search history; and preferences.

Types of Tracking Technologies used. We and third parties that we authorize may use the following Tracking Technologies on the Service and Digital Properties:

Cookies
A cookie is a small text file that is stored on a user’s Device. We may place cookies on your Device(s), which may last only during a single session or may be persistent over multiple sessions over time. Session cookies make it easier for you to navigate the Service and Digital Properties and expire when you close your browser. Other cookies remain longer and help in understanding how you use the Service and Digital Properties, for marketing, to personalize and enhance your user experience, and other purposes described below.

Web Beacons (“Tracking Pixels”)
Web beacons are small graphic images, also known as “tracking pixels,” “Internet tags,” or “clear gifs,” embedded in web pages and e-mail messages. Web beacons may be used to count the number of visitors to the Service and Digital Properties, facilitate marketing, to monitor how users navigate the Service and Digital Properties, and to count content views.

Embedded Scripts
An embedded script is programming code designed to collect information about your interactions with the Service and Digital Properties. It is temporarily downloaded onto your computer from our web server, or from a third party with which we work, and is active only while you are connected to the Service or Digital Properties and deleted or deactivated thereafter.

Location-Identifying Technologies
GPS (global positioning systems) software, geo-filtering, and other location-aware technologies locate you (sometimes precisely), or make assumptions about your location, for purposes such as verifying your location and delivering or restricting content based on your location. If you have enabled GPS or use other location-based features on the Service or Digital Properties, your Device location may be tracked by us and third parties. Certain Service or Digital Properties features may access and use information about your Device location (such as based on IP address or GPS, as applicable), or your account information, to suggest certain content, products, or services that may be available to you. Our Service and Digital Property content may be personalized based on various information we may have about you to try to provide you with more location-relevant content.

Device Recognition Technologies
We may use device recognition technologies, including application of statistical probability to data sets, as well as linking a common unique identifier to different device use (e.g., Facebook ID), which attempt to recognize or make assumptions about users and devices (e.g., that a user of multiple devices is the same user or household) (“Cross-device Data”).

In-App Tracking Methods
There are a variety of Tracking Technologies that may be included in mobile applications, and these are not browser-based like cookies and cannot be controlled by browser settings. Some use device identifiers or other identifiers such as “Ad IDs,” or may use “SDKs,” to associate app user activity to a particular app and to track user activity across apps and/or devices. SDKs are blocks of code that may be installed in our mobile application by third party companies with which we work. SDKs help us understand how you interact with our mobile application, to improve marketing, and collect certain information about the Device and network you use to access our application, such as the advertising identifier associated with your Device and information about how you interact with our application.

Device and Activity Monitoring Technologies
We use technologies such as session replay tools that monitor, and may record, your interactions with the Service and Digital Properties, including without limitation, keystrokes and how you move through and engage with the Service and Digital Properties. These technologies may also collect and analyze information from your Device, such as, without limitation, your operating system, plug-ins, system fonts, and other data.

Purposes for using these technologies. We and authorized third parties use these Tracking Technologies for purposes including:

Personalization, such as remembering user preferences, login details and browsing behavior; tracking your activity across online properties and platforms over time to better understand your preferences and interests; and personalizing online content;
Improving performance, such as maintaining and improving the performance of the Service and Digital Properties;
Analytics, such as analyzing how the Service and Digital Properties are used to help us improve the Service’s and Digital Properties’ performance and user experience;
Advertising, such as providing you with offers that may be of interest to you; conducting targeted advertising to you on the Service and Digital Properties, as well as digital properties of third parties; and measuring the effectiveness of our communications with you and advertising campaigns, including identifying how and when you engage with our communications; and
Security, such as user or Device identification and prevention of fraud and malicious behavior.
These Tracking Technologies may be used to track you across Devices and websites over time for purposes above.

Disclosures of your information. We may disclose Personal Information to third parties or permit third parties to place Tracking Technologies on our website(s) to allow these third parties to directly collect Personal Information from you, such as social media companies, advertising networks, companies that provide analytics including ad tracking and reporting, security providers, and others that help us operate our business, including the Service and Digital Properties. These companies use this information to provide you with more relevant advertising tailored to your interest based on your browsing of the Service and Digital Properties and elsewhere on the Internet, sometimes known as “interest-based advertising” and “online behavioral advertising (“Interest-based Advertising”) which may include sending you an ad on another online service after you have left the Service or Digital Properties (i.e., “retargeting”).

Our disclosures of information to third parties may include the following:

Google Analytics. We use Google Analytics to analyze traffic to our website(s) in order to help us understand our customers' and visitors' needs and to continually improve our site(s) for them. The data they collect on our behalf may include, but is not limited to, search engine referral, affiliate referrals, traffic driven by banner ads or other online promotions, how visitors navigate around the site, and the most popular pages. We also collect certain technical information, such as the browser version and operating system. We reserve the right to use, transfer, sell, and share data about our users for any lawful business purpose, such as analyzing usage trends and seeking compatible advertisers, sponsors, clients, and customers. For more information on how Google Analytics collects and processes data, please visit www.google.com/policies/privacy/partners/.
Social media companies. We use social media Tracking Technologies (such as the Meta Pixel and/or related Meta business tools) that may allow third parties, including Meta, to collect or receive information from our Service, Digital Properties, and/or elsewhere on the Internet and use that information to provide measurement services and target ads. In addition, we may serve ads on other online services that are targeted to reach people on those services that are also identified in one or more of our databases (“Matched List Ads”). This is done by using Tracking Technologies or by matching common factors between our databases and the databases of the other online services. For instance, we may use such ad services offered by Meta or X and other third-party services. We are not responsible for these third-party services, including without limitation their security of the data. Most third party social media companies (such as Meta and X) will generally enable you to hover over the box in the right corner of such a Meta ad, or go to your social media account settings, and find out what options you have to control such ads. We are not responsible for such third parties’ failure to comply with your or our opt-out instructions, they may not give us notice of opt-outs to our ads that you give to them, and they may change their options without notice to us or you.
Your choices regarding Tracking Technologies. Some of the companies that perform advertising-related services may participate in the Digital Advertising Alliance’s (“DAA”) Self-Regulatory Program for Online Behavioral Advertising. To learn more about how you can exercise certain choices regarding Interest-based Advertising, visit http://www.aboutads.info/choices/ and http://www.aboutads.info/appchoices for information on the DAA’s opt-out programs. Some of these companies may also be members of the Network Advertising Initiative (“NAI”). For more information about the NAI including how consumers can opt-out from receiving interest-based advertising from some or all of NAI's members, please visit http://www.networkadvertising.org/choices. Opting out of Interest-based Advertising will not opt you out of all advertising, but rather only Interest-based Advertising from us or our agents or representatives. Also, if your browsers are configured to reject cookies when you visit these opt-out webpages, or you subsequently erase your cookies, use a different Device or web browser, or use a non-browser-based method of access (e.g., mobile app), your NAI / DAA browser-based opt-out may not, or may no longer, be effective.

Some browsers have incorporated Do Not Track (“DNT”) preferences. Most of these features, when turned on, send signals to the website you are visiting that you do not wish to have information about your online searching and browsing activities collected and used. As there is not yet a common agreement about how to interpret DNT signals, we do not honor DNT signals from website browsers at this time. However, you may be able to refuse or delete cookies. If you refuse or delete cookies, some of our website(s) functionality may be impaired. If you change Devices or browsers, or use multiple Devices or browsers, and delete your cookies, you may need to repeat this process for each Device or browser. Please refer to your browser’s Help instructions to learn more about how to manage cookies and the use of other tracking technologies.

G. Security

We maintain reasonable security procedures and technical and organizational measures to protect your Personal Information against accidental or unlawful destruction, loss, disclosure, alteration, or use. However, because no data transmission is completely secure, and no system of physical or electronic security is impenetrable, we cannot guarantee the security of the information you send to us or the security of our servers, networks, or databases, and by using our Service or Digital Properties you agree to assume all risk in connection with the information sent to us or collected by us when you access, visit, and/or use our Service or Digital Properties, including without limitation your personally identifiable information, Personal Information, or other registration information, and we are not responsible for any loss of such information, or the consequences thereof.

H. Children’s Privacy

Interactions with us are intended for individuals 16 years of age and older. Our interactions are not directed at, marketed to, nor intended for, children under 16 years of age. We do not knowingly collect any information, including Personal Information, from children under 16 years of age. If you believe that we have inadvertently collected Personal Information from a child under the age of 16, please contact us at the address below and we will use reasonable efforts to delete the child’s information from our databases.

I. External Links

When interacting with us you may encounter links to external sites or other online services, including those embedded in third party advertisements or sponsor information, that we do not control. We are not responsible for the privacy practices and data collection policies for such third party services. You should consult the privacy statements of those third party services for details.

J. User Agreement

The User Agreement for interactions with us is incorporated by reference into this Consumer Notice.

K. Contact Info/Your Choices

If you have questions regarding this Consumer Notice, please contact us at:

EMAIL: privacypolicy@carvana.com
MAIL: Attention: Legal
300 E Rio Salado Pkwy

Building 1

Tempe, AZ 85281

Note: Only inquiries involving this Consumer Notice or Carvana’s collection, use, and/or management of your personal information should be sent to this email and/or mailing address. No other communication will be accepted or addressed.

Updating your information. If you've registered on any part of the Service or Digital Properties, you may change or update your member preferences or information in your account settings, if available, to keep all such data accurate and up to date.

Unsubscribing from promotional email messages. To opt-out of receiving promotional email messages from us, please click on the "Unsubscribe" link contained at the bottom of each email or by contacting us using the information above.

Account Deletion. If you are an Android app user, please click here to submit a request to delete your account.

L. Your California and Oregon Privacy Rights

This section applies to certain California and Oregon residents and supplements (but does not replace) the Consumer Notice above. This section does not apply to the following information:

Information about individuals who are not California or Oregon residents.
Information we collect in connection with providing individual consumers a financial product or service (or in connection with a consumer seeking such financial products or services), such as by reviewing applications for financing. For example, this Consumer Notice does not apply to information we collect that is subject to the federal Gramm-Leach-Bliley Act (“GLBA”), Fair Credit Reporting Act (“FCRA”), or the California Financial Information Privacy Act (collectively, “Financial Information”). Financial Information is subject instead to our Financial Privacy Notice.
Information about job applicants. Such information is subject to a separate Applicant Privacy Notice.
Information about our employees, contractors, and agents. Such information is subject to a separate employee privacy notice that we will make available to those individuals.
Information we collect from individuals with whom we engage in solely business-to-business communications and transactions, including due diligence transactions, such as information about the employees of our business clients. Such information is subject to a separate Business Privacy Notice.
Pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively “CCPA”) and the Oregon Consumer Privacy Act of 2023 (“OCPA”), below is a summary of the personal information we have collected from consumers, the parties with whom we may have disclosed the personal information for business purposes, and the parties to whom we may have sold or shared the personal information over the last twelve (12) months. We do not knowingly sell the personal information of minors under 16 years of age.

Categories of Personal Information We Collect Categories of Third Parties With Whom We Disclose Personal Information for a Business Purpose Categories of Third Parties With Whom We Sell or Share Personal Information
Identifiers, such as real name, alias, postal address, country of residence, unique personal identifier, online identifier, IP address, email address, account name, phone number, social media identifiers, or other similar identifiers.
Service providers, such as identity verification services, technical support, research and analytics providers, etc.
Third party social network services
Our parents, subsidiaries, and affiliates
Marketing and advertising partners or providers
Public or law enforcement officials, as well as private parties involved in other legal process
Consumer credit reporting companies
Companies or other users to whom your data is shared at your direction
Supplemental product providers, such as those who offer vehicle accessories, insurance, etc.
Entities involved in a corporate transaction
Third party social network services
Data analytics providers
Marketing and advertising partners or providers
Companies that create or receive sales leads
Personal information subject to the California Customer Records Act, such as signatures.
Service providers, such as identity verification services, technical support, research and analytics providers, etc.
Third party social network services
Our parents, subsidiaries, and affiliates
Marketing and advertising partners or providers
Public or law enforcement officials, as well as private parties involved in other legal process
Consumer credit reporting companies
Companies or other users to whom your data is shared at your direction
Supplemental product providers, such as vehicle accessories, insurance, etc.
Entities involved in a corporate transaction
Third party social network services
Data analytics providers
Marketing and advertising partners or providers
Companies that create or receive sales leads
Characteristics of protected classifications under California or Federal Law, such as age, sex (including gender, gender identity, gender expression), national origin, citizenship, religion or creed, marital status, education, date of birth, veteran or military status.
Service providers, such as identity verification services, technical support, research and analytics providers, etc.
Third party social network services
Our parents, subsidiaries, and affiliates
Marketing and advertising partners or providers
Public or law enforcement officials, as well as private parties involved in other legal process
Consumer credit reporting companies
Companies to whom your data is shared at your direction
Supplemental product providers, such as vehicle accessories, insurance, etc.
Entities involved in a corporate transaction
Third party social network services
Data analytics providers
Companies that create or receive sales leads
Commercial information, including records of personal property, product or services purchased, obtained or considered, information you provide or post using the Service, or other purchasing or consuming histories or tendencies.
Service providers, such as identity verification services, technical support, research and analytics providers, etc.
Third party social network services
Our parents, subsidiaries, and affiliates
Marketing and advertising partners or providers
Public or law enforcement officials, as well as private parties involved in other legal process
Consumer credit reporting companies
Companies or other users to whom your data is shared at your direction
Supplemental product providers, such as vehicle accessories, insurance, etc.
Entities involved in a corporate transaction
Third party social network services
Data analytics providers
Marketing and advertising partners or providers
Companies that create or receive sales leads
Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website, application or advertisement.
Service providers, such as identity verification services, financial services, technical support, research and analytics providers, etc.
Third party social network services
Our parents, subsidiaries, and affiliates
Marketing and advertising partners or providers
Public or law enforcement officials, as well as private parties involved in other legal process
Consumer credit reporting companies
Companies or other users to whom your data is shared at your direction
Supplemental product providers, such as vehicle accessories, insurance, etc.
Entities involved in a corporate transaction
Third party social network services
Data analytics providers
Marketing and advertising partners or providers
Companies that create or receive sales leads
Geolocation data, such as approximate location of a Device or equipment based on geographical coordinates and measurements,
Service providers, such as identity verification services, financial services, technical support, research and analytics providers, etc.
Third party social network services
Our parents, subsidiaries, and affiliates
Marketing and advertising partners or providers
Public or law enforcement officials, as well as private parties involved in other legal process
Consumer credit reporting companies
Companies or other users to whom your data is shared at your direction
Supplemental product providers, such as vehicle accessories, insurance, etc.
Entities involved in a corporate transaction
Third party social network services
Data analytics providers
Marketing and advertising partners or providers
Companies that create or receive sales leads
Audio, electronic, visual, or similar information such as CCTV footage, call recordings, pictures you post or submit via the Service or Digital Properties, customer support chat recordings, and web activity recordings, etc.
Service providers, such as identity verification services, financial services, technical support, research and analytics providers, etc.
Our parents, subsidiaries, and affiliates
Marketing and advertising partners or providers
Public or law enforcement officials, as well as private parties involved in other legal process
Companies or other users to whom your data is shared at your direction
Supplemental product providers, such as vehicle accessories, insurance, etc.
Entities involved in a corporate transaction
Third party social network services
Data analytics providers
Companies that create or receive sales leads
Professional or employment-related information, such as job title, employer, business address and contact information, employment history, other professional information, or education history.
Service providers, such as identity verification services, financial services, technical support, research and analytics providers, etc.
Third party social network services
Our parents, subsidiaries, and affiliates
Marketing and advertising partners or providers
Public or law enforcement officials, as well as private parties involved in other legal process
Consumer credit reporting companies
Companies or other users to whom your data is shared at your direction
Supplemental product providers, such as vehicle accessories, insurance, etc.
Entities involved in a corporate transaction
Third party social network services
Data analytics providers
Companies that create or receive sales leads
Education information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act.
Service providers, such as identity verification services, financial services, technical support, research and analytics providers, etc.
Third party social network services
Our parents, subsidiaries, and affiliates
Marketing and advertising partners or providers
Public or law enforcement officials, as well as private parties involved in other legal process
Consumer credit reporting companies
Companies or other users to whom your data is shared at your direction
Supplemental product providers, such as vehicle accessories, insurance, etc.
Entities involved in a corporate transaction
Third party social network services
Data analytics providers
Companies that create or receive sales leads
Inferences drawn from any of the information identified above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, and behavior.
Service providers, such as identity verification services, financial services, technical support, research and analytics providers, etc.
Third party social network services
Our parents, subsidiaries, and affiliates
Marketing and advertising partners or providers
Public or law enforcement officials, as well as private parties involved in other legal process
Consumer credit reporting companies
Companies or other users to whom your data is shared at your direction
Supplemental product providers, such as vehicle accessories, insurance, etc.
Entities involved in a corporate transaction
Third party social network services
Data analytics providers
Companies that create or receive sales leads
Sensitive personal information, such as social security number, driver’s license number or passport number; account log-in information; racial or ethnic origin or religious or philosophical beliefs; and precise geolocation
Service providers, such as identity verification services, financial services, technical support, research and analytics providers, etc.
Our parents, subsidiaries, and affiliates
Public or law enforcement officials, as well as private parties involved in other legal process
Consumer credit reporting companies
Companies or other users to whom your data is shared at your direction
Entities involved in a corporate transaction
Not sold or shared
Collection of the categories of personal information identified above may occur through one or more of the following sources:

From you, when you engage in certain activities such as when you register and/or set up an account/profile to access the Service or Digital Properties, including by submitting User Content.
From third party social networking service(s) that you may have accessed, visited, and/or used that may be integrated with or linked to the Service or Digital Properties(s).
From lead generation partners or sources.
From identity verification partners.
From entities that sell or share your personal information, including entities registered in California as data brokers.
From service providers who gather personal information from you or external parties who possess and/or process your personal information, once you grant the requisite right, power, and/or authority to those service providers to act on your behalf and gather and/or provide such data to us.
Through local device storage (placing and/or storing code or other types of information and/or devices (e.g., "cookies") on your Device(s)) or other Tracking Technologies (web beacons, web bugs, clear gifs, and similar technologies), as described in detail in Section B and F of this Consumer Notice.
The business and/or or commercial purpose(s) for which we collect the data identified above may include one or more of the following:

Auditing, such as auditing related to a current interaction with you and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards;
Debugging, such as debugging to identify and repair errors that impair existing intended functionality;
The occurrence of mergers and acquisitions, including in the event Carvana or ADESA undergoes a corporate reorganization such as a merger, acquisition, sale of part or all of its business, or other related event (including transfers made as part of insolvency or bankruptcy proceedings) involving all or part of Carvana or ADESA, or as part of a corporate reorganization or stock sale, in which data may be collected, used, or shared for the purpose of negotiating or completing such transactions;
Performing or improving services, such as maintaining or servicing accounts, providing customer service, facilitating communications between users, providing consumers with requested or personalized content, communicating with you about new features, products, or services, processing or fulfilling orders and transactions, tailoring the services that we offer to your needs; verifying your information, processing payments, providing financing, providing analytic services, or providing similar services on behalf of Carvana or ADESA;
Quality assurance, including undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by Carvana or ADESA, and to improve, upgrade, or enhance the Service and Digital Properties or a device that is owned, manufactured, manufactured for, or controlled by Carvana or ADESA;
Security, such as detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and/or prosecuting those responsible for that activity;
Short-term, transient use;
To communicate, advertise, and/or market Carvana or ADESA’s goods, products, and/or services, to show you content and sponsored messaging, to engage in interest-based advertising, to gauge the effectiveness of marketing campaigns, and/or for other marketing or advertising purposes;
To comply with legal or compliance requirements, such as compliance training, investigating and responding to legal claims, responding to law enforcement requests, or as otherwise required by law;
To conduct internal research, including undertaking internal research for technological development and/or demonstration and analyzing trends;
To help diagnose problems with our servers, to gather broad demographic information, track users' movements around the Service and Digital Properties, and/or to otherwise administer the Service and Digital Properties; and/or
To track geographic location, usage patterns, broad demographic information, and/or the movements of individual users.
We do not collect Sensitive Personal Information for the purpose of inferring characteristics about you. We do not use or disclose Sensitive Personal Information for purposes to which the right to limit use and disclosure or right to revoke applies under the CCPA and OCPA.

Retention. We retain your Personal Information as long as necessary to fulfill the purposes outlined in this Consumer Notice unless we are required to do otherwise by applicable law. This includes retaining your Personal Information to provide you with the products or services you have requested and interact with you; maintain our business relationship with you; improve our business over time; ensure the ongoing legality, safety and security of our services and relationships; or otherwise in accordance with our internal retention procedures. Once you have terminated your relationship with us, we may retain your Personal Information in our systems and records in order to ensure adequate fulfillment of surviving provisions in terminated contracts or for other legitimate business purposes, such as to enable easier future user onboarding, demonstrate our business practices and contractual obligations, or provide you with information about our products and services in case of interest.

Your Rights

California and Oregon residents may exercise the following rights, subject to legal limitations and applicable exceptions, via our Privacy Request Form at https://privacy.carvana.com/privacy or by calling 800-333-4554.

Right to Know. You have the right to request information about the categories of personal information we have collected about you, the categories of sources from which we collected the personal information, the purposes for collecting, selling, or sharing the personal information, and the categories of third parties with whom we have shared or sold your personal information (“Categories Report”). You may also request information about the specific pieces of personal information we have collected about you (“Specific Pieces Report”). You may also have the right to request a list of specific third parties to which we have disclosed any personal information (“Right to Know - Third Parties”).
Right to Delete. You have the right to request that we delete personal information that we have collected from you.
Right to Correct. You have the right to request that we correct inaccurate information that we maintain about you.
Right to Opt Out. You have the right to opt out of the sale or processing of your personal information.
To fully exercise the Right to Opt Out, you must both: (A) submit an Opt-Out of Sale/Sharing request through our Opt-Out Form AND (B) select the “Opt Out” button via the Your Privacy Choices modal. Clicking “Opt Out” within Your Privacy Choices will place a cookie on your browser signaling that you have opted out of such online tracking. Please note:

The opt-out cookie only applies to the Carvana or ADESA website and only to the browser and Device you are using at the time you make the selection. You will also need to select the “Opt Out” button through Your Privacy Choices from each browser on each Device you use, and on each Carvana or ADESA website you access.
If you clear cookies on your browser, you will need to select “Opt Out” through Your Privacy Choices from that browser again.
If you have blocked cookies through your browser settings, we will be unable to comply with your opt out request.
To the extent required by law, we will honor opt-out preference signals sent in a format commonly used and recognized by businesses, such as an HTTP header field or JavaScript object. We will process opt-out preference signals at the browser level.

In accordance with applicable law, we will not discriminate against you for exercising these rights.

Verification: In order to exercise your rights, except your right to Opt-Out, as described above, we may need to obtain information to locate you in our records, verify that you are a California or Oregon resident, and/or verify your identity depending on the nature of the request. We may request some or all of the following information to verify your identity or locate you in our records: name, email address, date of birth, and last four digits of SSN. In some cases, we may require additional or different information in order to verify your identity. Once you submit a request, we will send an email to acknowledge our receipt of your request and verification that you must respond to in order for us to proceed with a Right to Delete, Right to Correct, or Right to Know.

Please be aware there might be circumstances where we will not honor your request, as permitted under the CCPA or OCPA. For example, if we are not able to verify your identity and/or that you are a California or Oregon resident, we may not honor your access, deletion, or correction request. Additionally, we may not honor your request if an exception under the CCPA or OCPA applies.

Oregon Appeal Rights: If you’re an Oregon resident and your privacy rights request is denied or Carvana refuses to take action on your request, you may appeal Carvana’s decision. To exercise your right to appeal, please email privacypolicy@carvana.com within 30 calendar days following the denial of your request with the following information:

Please put "Privacy Request Appeal" in the subject line of the email.
In the body of the email, please provide:
Your name;
Request Type (e.g., "Right to Delete,"; "Right to Correct"); and
A brief statement explaining why you believe your original request was improperly denied.
Carvana will respond to your appeal within 45 days of receipt.

Authorized Agents: Authorized agents may exercise rights on behalf of consumers, but we reserve the right to also verify the consumer directly as described above. Authorized agents must use the Privacy Request Form and upload signed permission from the consumer demonstrating the agent has authority to exercise rights on the consumer’s behalf. We may also require the consumer to directly verify their own identity with us or directly confirm they provided the agent permission to submit the request.

Timing: We will process a Request to Opt Out within 15 business days. We will respond to Requests to Delete, Requests to Correct, and Requests to Know within 45 calendar days, unless we need more time (in which case we will notify you) and may take up to 90 calendar days in total to respond to your request(s).

California Shine the Light: If you are a California resident, you may opt out of sharing your Personal Information with third parties for the third parties’ direct marketing purposes. Please contact us at privacypolicy@carvana.com if you would like to do so.

Total Requests (1/1/2023 - 12/31/2023)
Request Type Number of Requests
Total Do Not Sell Requests Received* 293445
Do Not Sell requests denied 0
Do Not Sell requests complied with in whole
293445

Do Not Sell requests complied with in part
0

Average number of days to complete Do Not Sell requests
1

Total Delete Requests Received
1421

Delete requests denied
754

Delete requests complied with in whole
667

Delete requests complied with in part
0

Average number of days to complete Delete requests
6

Total Right to Know Requests
68

Right to Know requests denied
49

Right to Know requests complied with in whole
19

Right to Know requests complied with in part
0

Average number of days to complete Right to Know requests
17

Total Right to Correct
5

Right to Correct requests denied
5

Right to Correct requests completed
0

Average Days to complete
3

Total Right to Limit Requests
Not Applicable

*Metrics disclosed for this category represent requests for all individuals, including California consumers.