U.S. STATE PRIVACY SUPPLEMENT
Last updated: October 14th, 2026
This U.S. State Privacy Supplement applies when you use our e.l.f. Cosmetics, e.l.f. SKIN or Well People websites, mobile apps, or services. It is designed for residents of certain U.S. states that have privacy laws in effect.
Depending on where you live, you may have certain privacy rights. The information and rights described in this U.S. State Privacy Supplement apply only to the extent those rights are available to you under your state’s law.
This U.S. State Privacy Supplement should be read together with our Privacy Notice, which explains how we collect, use, and share your personal information.
Some terms used in this U.S. State Privacy Supplement have specific meanings under state privacy laws or are defined in our Privacy Notice.
Sources of Personal Information
Sources of Personal Information
During the 12-month period prior to the date this U.S. State Privacy Supplement was last updated, we may have obtained personal information about you from the following categories of sources:
- directly from you, such as when you purchase a product or provide us with information at a pop-up event
- from your devices, such as through your use of the website, mobile app, or services
- our affiliates and subsidiaries
- vendors who provide services on our behalf
- or joint marketing partners
- publicly available social media profiles and social media engagement with our content
- online advertising services
- third parties with whom we run promotions or marketing efforts
- data brokers
Collection, Use, Disclosure and Sale of Personal Information
Collection, Use, Disclosure and Sale of Personal Information
We may collect, use, disclose and sell (and may have collected, used, disclosed, and sold during the 12-month period preceding the Last Updated date of this U.S. State Privacy Supplement) personal information about U.S. consumers as described below.
Categories of Personal Information | Processing Purposes(1) | Categories of Third Parties to Whom Personal Information is Disclosed for a Business Purpose(2) | Categories of Third Parties to Whom Personal Information is Sold/Shared for Targeted Advertising(3) |
|---|---|---|---|
Identifiers: such as real name, alias, address, telephone number, email address, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number, unique pseudonym, or user alias; and other forms of persistent or probabilistic identifiers), account information such as username and password for our websites, online identifiers, IP address | Transactions Managing accounts Authentication Customer service Personalizing your experience, communicating and marketing Promotions and opportunities Product safety and recalls Safety, security and fraud/criminal activity prevention Operating and improving our business Compliance | Our affiliates Vendors who provide services on our behalf, such as order management and shipping processors, customer service providers and loyalty program providers Professional services organizations, such as auditors and law firms Our joint marketing partners Online advertising and marketing service providers, (including for purposes of targeted advertising) Government entities Our business partners Internet service and cloud storage providers Data analytics providers Operating systems and platforms Social networks Product review program providers | Advertising networks Marketing companies Social media companies |
Payment Information: such as billing address and payment card details, including card number, expiration date and security code | Transactions Managing accounts Authentication Customer service Safety, security and fraud/criminal activity prevention Operating and improving our business Compliance | Our affiliates Vendors who provide services on our behalf, such as payment processors Professional services organizations, such as auditors and law firms Government entities Our business partners | Not sold/shared for targeted advertising |
Protected Classifications: such as race, color, age, date of birth, medical condition, sex and gender | Customer service Personalizing your experience, communicating and marketing Promotions and opportunities Product safety and recalls Safety, security and fraud/criminal activity prevention Operating and improving our business Compliance | Our affiliates Vendors who provide services on our behalf Professional services organizations, such as auditors and law firms Our joint marketing partners Online advertising services Government entities Our business partners Internet service providers Data analytics providers Operating systems and platforms | Not sold/shared for targeted advertising |
Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies, payment information, loyalty program participation information | Transactions Managing accounts Authentication Customer service Personalizing your experience, communicating and marketing Promotions and opportunities Product safety and recalls Safety, security and fraud/criminal activity prevention Operating and improving our business Compliance | Our affiliates Vendors who provide services on our behalf Professional services organizations, such as auditors and law firms Our joint marketing partners Online advertising services Government entities Our business partners Internet service providers Data analytics providers Operating systems and platforms Social networks | Advertising networks Marketing companies Social media companies |
Internet or other electronic network activity information: such as data collected by cookies and similar technologies, such as information about your online activities, devices, browsing actions, and usage patterns across the Services and third-party websites that we obtain through the use of cookies, web beacons, and similar technologies (for more information, see the Cookies and Other Automated Technologies section of our Privacy Notice) | Transactions Managing accounts Authentication Customer service Personalizing your experience, communicating and marketing Promotions and opportunities Product safety and recalls Safety, security and fraud/criminal activity prevention Operating and improving our business Compliance | Our affiliates Vendors who provide services on our behalf Professional services organizations, such as auditors and law firms Our joint marketing partners Online advertising services Government entities Our business partners Internet service providers Data analytics providers Operating systems and platforms Social networks | Advertising networks Marketing companies Social media companies |
Sensitive Data: such as location data and precise location data such as physical location information using our services on your mobile phone or device by, for example using satellite, cell phone tower, WiFi signal, beacons, Bluetooth and near field communication protocols; and information about skincare concerns or skin tone. | Transactions Managing accounts Authentication Customer service Personalizing your experience, communicating and marketing Promotions and opportunities Product safety and recalls Safety, security and fraud/criminal activity prevention Operating and improving our business Compliance We do not process sensitive data to infer characteristics about individuals. | Our affiliates Vendors who provide services on our behalf Professional services organizations, such as auditors and law firms Our joint marketing partners Online advertising services Government entities Our business partners Internet service providers Data analytics providers Operating systems and platforms Social networks | Not sold/shared for targeted advertising |
Inferences drawn from the above categories of Personal Information: such as consumer preferences, characteristics, predispositions, and behavior | Customer service Communicating and marketing Promotions and opportunities Operating and improving our business Compliance | Our affiliates Vendors who provide services on our behalf, such as shopping experience and marketing service providers Professional services organizations, such as auditors and law firms Our joint marketing partners Online advertising services Government entities Our business partners Internet service providers Data analytics providers Operating systems and platforms
Social networks Product review program providers | Advertising Networks Marketing Companies Social Media Companies |
Other Information You May Choose to Provide, as described further in our Privacy Notice, such as information about your physical attributes, communication information (such as information we collect when communicating with you including how you engaged with the message and the details of the communications), social media information (such as your social media handle, photos and/or videos, comments, replies or response mentioned in your posts, any information about you that you have made publicly available through your social media profile and any other information that we collect when you publicly mention us on social media platforms), user generated content, and promotional and survey-related information. | Transactions Managing Accounts Authentication Customer Service Communicating and Marketing Promotions and Opportunities Product Safety and Recalls Safety, Security and Fraud/Criminal Activity Prevention Operating and Improving our Business Compliance | Our affiliates Vendors who provide services on our behalf, such as shopping experience and marketing service providers Professional services organizations, such as auditors and law firms Our joint marketing partners Online advertising services Government entities Our business partners Internet service providers Data analytics providers Operating systems and platforms Social networks Product review program providers | Advertising Networks Marketing Companies Social Media Companies |
(1) Processing Purposes
- Transactions: process and fulfill requests, orders, purchases and other transactions and payments, prevent transactional fraud, and keep you informed about the status of your order;
- Managing Accounts: create, operate, maintain and customize your account with us;
- Authentication: identify and authenticate you so you may order our products;
- Customer Service: provide customer and technical support and respond to inquiries;
- Communicating and Marketing: provide personalized product recommendations, communicate with you regarding news updates, notices, special promotional offers, personalized and non-personalized advertisements and marketing materials, our products and services, or other information that may be of interest to you;
- Promotions and Opportunities: communicate about, and administer participation in, special events, programs, promotions, offers, surveys, focus groups and market research;
- Product Safety and Recalls: notify you about product safety and recall information, such as reporting an adverse event or communicating a product recall;
- Safety, Security and Fraud/Criminal Activity Prevention: increase and maintain the safety, integrity and security of our products and the Services and prevent misuse; protect against, identify and prevent fraud and other criminal activity, claims and other liabilities;
- Operating and Improving our Business: operate, administer, evaluate, develop, manage and improve our business (including operating, administering, analyzing and improving our products and services; developing new products and services; conducting internal research for technological development and demonstration; performing analytics (including market research, trend analysis, financial analysis, and anonymization and aggregation of personal information); managing and evaluating the effectiveness of our communications; diagnosing and fixing technical errors; providing, supporting, and developing our websites, products and services; performing accounting, auditing, billing reconciliation and collection activities and other internal functions);
- Compliance: comply with and enforce applicable legal requirements and relevant industry standards and policies, such as this Privacy Notice and our Terms of Use.
(2) Processing Purposes
In addition to the disclosures described above, we may share the personal information described above with third parties in connection with corporate transactions, such as mergers, acquisitions or divestitures. We also may disclose information about you (1) if we are required to do so by law or legal process (such as a court order or subpoena); (2) in response to requests by government agencies, such as law enforcement authorities; (3) to establish, exercise or defend our legal rights; (4) when we believe disclosure is necessary or appropriate to prevent physical or other harm or financial loss; (5) in connection with an investigation of suspected or actual illegal activity; or (6) otherwise with your consent.
(3) Categories of Third Parties to Whom Personal Information is Sold/Shared for Targeted Advertising
We do not sell personal information in exchange for monetary consideration. However, like most online businesses, we may share personal information with advertisers, advertising publishers and marketing service providers for cross-context behavioral advertising or targeted advertising purposes (including cross-device marketing or advertising campaigns (where we can infer that a particular browser, device, or pseudonymous identifier belongs to you). These third parties may collect personal information via automated technologies on our websites for cross-context behavioral advertising purposes. This kind of sharing may be considered a “sale” or sharing for cross-context behavioral advertising/targeted advertising purposes under certain U.S. state privacy laws when the personal information is exchanged for non-monetary consideration. We may sell or share the following categories of personal information with these third parties: email address, phone number, IP address and internet and electronic network activity including information regarding interactions with our website.
Depending on your state of residence, you may have the right to request the list of third parties to whom we sell personal information. If you are permitted this right under applicable law, please email us at privacyrequests@elfbeauty.com with the subject line “Third Party Sale Recipient List” and in the body of the email, please let us know which e.l.f. Beauty brand that you are exercising your privacy rights for.
Depending on your state of residence, you may have the right to opt out of these disclosures of your personal information. If you are a California resident and wish to request that we do not sell or share your personal information, please contact us using the contact information detailed in the “Contact Us” section of our Privacy Notice.
Financial Incentive and Bona Fide Loyalty Programs
Financial Incentive and Bona Fide Loyalty Programs
We offer certain loyalty and rewards programs that may be considered financial incentives under certain U.S. state privacy laws (such as the e.l.f. Beauty Squad Loyalty Program) and exclusive offers and promotions via email. When you sign up for and participate in these programs, we may ask you to provide us with contact information and identifiers such as your name and email address, and commercial information such as your purchase history. Participation in these programs is voluntary and no purchase is required to become a member. While we cannot calculate the precise value of your information, our programs generally reflect the value of the relationships that we have with the individuals who participate in them. You may withdraw from our loyalty programs at any time by contacting us using the designated method set forth in the applicable loyalty program terms and conditions.
The categories of personal information collected through our loyalty programs that may be sold or processed for targeted advertising include identifiers (such as your email address), Internet and other online activity information (such as IP address, browsing history and other information regarding your interactions with our websites), and commercial information (such as your order history and wish lists).
We may disclose personal information we collect through our loyalty programs to third parties such as service providers, data analytics providers, our corporate affiliates, and advertising networks. We do not provide the personal information we collect through our loyalty programs to data brokers, as defined by applicable U.S. state privacy laws.
If you exercise your right to request deletion of your personal information for a particular brand, it may be impossible for us to continue providing loyalty program benefits for that brand to you because we will no longer have the information required to provide you with certain benefits (such as information about qualifying purchases). Please note that requesting deletion of your personal information for one of our brands will not delete your personal information for our other brands.
Children and Minor’s Privacy
Children and Minor’s Privacy
We do not have actual knowledge that we sell or share or share for targeted advertising purposes personal information of minors under 16 years of age.
We do not knowingly process personal information about children under the age of 13. We also do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers.
Deidentified Data
Deidentified Data
To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.
Retention of Personal Information
Retention of Personal Information
We retain personal information for the period reasonably necessary to achieve the purposes described in this U.S. State Privacy Supplement, or any other notice provided at the time of collection, unless a longer retention period is required or permitted by applicable law, considering relevant statutes of limitations and our records retention requirements and policies.
U.S. Privacy Rights
U.S. Privacy Rights
Depending on your state of residence, if you interact with us in an individual or household capacity (and not in a commercial or employment context), you may have certain rights regarding your personal information, as described below.
- Access: You have the right to request (a) confirmation of whether we process your personal information and (b) access to the personal information we maintain about you, including a copy provided in a portable format. Depending on your state of residence, you also may have the right to request information about (i) the categories of personal information we have collected, used, disclosed and sold or shared about you, (ii) the categories of sources from which the personal information is collected, (iii) the business or commercial purpose for collecting, selling or sharing personal information, and (iv) the third parties or categories of third parties to whom we disclose personal information.
- Correction: You have the right to request that we correct the personal information we maintain about you, if that information is inaccurate.
- Deletion: You have the right to request that we delete certain personal information we have collected from you.
- Opt-Out of Sale or Sharing for Cross-Context Behavioral Advertising/Targeted Advertising: You have the right to opt-out of the sale of your personal information or the sharing of your personal information for cross-context behavioral advertising purposes.
- California – Shine the Light Request: If you are a California resident, you also may have the right to request that we provide you with (i) a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year and (ii) the identity of those third parties.
How to Submit an Access, Correction, Deletion Request
How to Submit an Access, Correction, Deletion Request
To submit an access, correction, or deletion request, please refer to the “How to Exercise Your Privacy Rights” section of the Privacy Notice.
To protect your privacy, we may need to verify your identity before we process your request. If you have an account with us, we may ask you to sign in or confirm your request through your email. We may also ask for a few details, such as information about a recent purchase, to make sure it’s really you.
How to Submit a California Shine the Light Request
How to Submit a California Shine the Light Request
To submit a California Shine the Light Request, please email us at privacyrequests@elfbeauty.com with the subject line “California Shine the Light Request” and in the body of the email, please let us know which e.l.f. Beauty brand that you are exercising your privacy rights for.
To protect your privacy, we may need to verify your identity before we process your request. If you have an account with us, we may ask you to sign in or confirm your request through your email. We may also ask for a few details, such as information about a recent purchase, to make sure it’s really you.
How to Submit an Opt-Out of Sale/Targeted Advertising Request
How to Submit an Opt-Out of Sale/Targeted Advertising Request
To opt out of the sale of your personal information or the sharing of your personal information for purposes of cross-context behavioral advertising/targeted advertising, please follow the instructions below.
- e.l.f. Cosmetics/e.l.f. SKIN: please visit the following page and follow the instructions: www.elfcosmetics.com/pages/do-not-sell-or-share-my-personal-information
- Well People: please visit the following page and follow the instructions: www.wellpeople.com/do-not-sell-or-share-my-personal-information
You may also use the Global Privacy Control signal on your browser or device. If you would like to opt-out of the sale or sharing of your personal information associated with a different device or browser, please submit an opt-out request or use the Global Privacy Control signal using that device or browser. Please note that if you clear your cookies on a particular browser or device, you may need to resubmit your opt-out request again from that device or browser. Requests sent using the Global Privacy Control will apply to the device and browser from which they are submitted. For more information about the Global Privacy Control, please visit https://globalprivacycontrol.org.
Online Eraser Law
Online Eraser Law
If you are under 18, live in California, and have an account with us, you can ask us to remove content you have posted publicly on our websites or apps.
To make a request, please email privacyrequests@elfbeauty.com with the subject line “California Online Eraser Law.” In your message, let us know which e.l.f. Beauty brand your request relates to and identify the content you would like removed.
We will make reasonable, good faith efforts to remove the content from public view. Please note that removal may not be complete, such as where the content has been reposted by others or remains in our internal systems.
Authorized Agents
Authorized Agents
If you’re making a request as an authorized agent (where permitted by law), please email privacyrequests@elfbeauty.com with the subject line “Authorized Agent Request” and include the required details listed in this Privacy Notice.
Appeals
Appeals
Depending on your state’s law, you may have the right to appeal our decision on your request. To do so, please email privacyrequests@elfbeauty.com with the subject line “Privacy Request Appeal” and let us know which decision you are appealing.
Additional Information
Additional Information
If you choose to exercise your privacy rights, we will not treat you unfairly or differently or retaliate against you for doing so. In some cases, and where allowed by law, we may charge a reasonable fee to process your request.
If you have any questions or concerns about our privacy practices, please contact us at privacyrequests@elfbeauty.com or as described in the “Contact Us” section of our Privacy Notice.
Updates to This Supplement
Updates to This Supplement
We may update this U.S. State Privacy Supplement from time to time to reflect changes in our privacy practices. If required by law, we will notify you of any significant changes—such as by posting a notice on our websites or mobile apps. We will also update the “Last Updated” date at the top of this Supplement.
