Privacy Policy

Last updated on August 25, 2025.

Bath & Body Works, Inc., Bath & Body Works Direct, Inc., and Bath & Body Works, LLC (“BBW,” “we,” “us,” or “our”) respect your concerns about privacy. This Privacy Policy (“Policy”) explains what personal information/data (“personal information”) we collect, how we use it, to whom we sell or share it, how long we retain it, how we safeguard it, and how you can exercise your privacy rights. Personal information is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a particular consumer or household. Unless indicated otherwise, this Policy applies only to personal information collected through the websites, microsites, mobile applications, in-store transactions, calls or text messages, and other online services of the Bath & Body Works brand and lines of business that expressly adopt or link to this Policy, and then only to the extent indicated (collectively, the “Services”).

1. Collection and Disclosure
1. We may collect the following categories of personal information about you:
  1. Identifiers (personal) (including, for example, name, alias, postal address, unique personal identifier, online and device identifier, IP address, email address, account name and number, telephone number, postal address, and other similar identifiers).
  2. Identifiers (others) (including, for example, insurance policy number, certain financial information, and health insurance information).
  3. Personal characteristics, histories, and associations (including, for example, marital status, gender, age, and characteristics of protected classification under California or federal law).
  4. Commercial Information (including, for example, records of personal property; products or services purchased, obtained, or considered; marketing histories; purchasing histories or tendencies; purchase profiles; shopping and retail browsing channel preferences; online browsing and website interaction histories; and direct marketing histories).
  5. Biometric information (including, for example, signature; and physical characteristics or description).
  6. Computing or mobile-device information and internet or other electronic-network-activity information (including, for example, online advertisement engagements; and cookies, tags, and similar device or user identifying information).
  7. Geolocation information (approximate and precise) (including, for example, through the mobile app).
  8. Audio and visual information (including, for example, videos you upload with a review or in-store security cameras).
  9. Professional or employment-related information (including applications, professional history, and work history).
  10. Education information (including, for example, when applying for an open position).
  11. Inferences (including, for example, predictive information, purchase profiles, shopping profiles and characteristics (e.g., loyalty shopper, cardholder, or online shopper)).
  12. Sensitive personal information (including, for example, social security number; driver’s license number or other state identification card number; login credential; and precise geographic information).
  13. Financial information (including, for example, banking details and income level).
  14. Payment card and transaction information (including, for example, credit card number; debit card number, and other financial information).
  15. Household information (including, for example, family size and composition).
  16. Incident-related information (including, for example, statements; or insurance, or similar claims).
2. We may have collected personal information about you from the following categories of sources:
  - You (for example, through your use of our Services).
  - Your computing or mobile devices.
  - Our technology (for example, through observed consumer interactions with us and through our Services).
  - Our Services and systems.
  - Our vendors.
  - Public records.
  - Our customers’ associations (e.g., through refer-a-friend or -family programs).
  - Social media networks.
  - Advertising networks.
  - Unaffiliated third parties.
3. We may collect, sell, share, or process personal information about you for the purposes described in the “How We Use the Information We Obtain” section of the Policy and for the following business or commercial purposes:
  - Facilitate accounting, auditing, and reporting.
  - Deliver analytics (machine generated through computing/mobile devices for performance, monitoring, personalization, and order processing).
  - Deliver advertising through technology (including, for example, to facilitate personalized content, remarketing, online display ads, and interest-based ads).
  - Deliver advertising through direct or mass media (including, for example, via email, SMS, telephone, post, and broadcasts).
  - Facilitate affiliate marketing.
  - Administer claims management, handling, and insurance.
  - Respond to incidents.
  - Deliver customer service.
  - Pursue legal matters.
  - Deliver and/or optimize website, mobile-app, and e-commerce services.
  - Facilitate information security.
  - Facilitate fraud monitoring and prevention.
  - Deliver logistics (including, for example, order management, shipping, and fulfillment).
  - Develop customer information for personalization.
  - Process, fulfill, and ship orders.
  - Deliver shopping and customer engagement (including events and experiences, such as contests, sweepstakes, previews, and shows).
  - Deliver social media engagement.
  - Conduct surveys.
  - Administer technology and ensure technology integrity (including, for example, by maintaining and improving networks; and identifying and fixing problems).
  - Process transactions and payments.
  - Develop, review, and test products and services.
  - Deliver Wi-Fi and similar online services (including in store-service).
  - Perform miscellaneous services.
4. We may have disclosed, sold, or shared your personal information with certain categories of service provider, contractors, processors, or third-parties as described below.

Categories of Personal Information Collected	Categories of Service Provider, Contractor, or Processor to Whom Information is Disclosed for a Business Purpose (as defined under the CCPA/CPRA, CPA, or VCDPA)	Categories of Third-Party to Whom Information is Sold or Shared (as defined under the CCPA/CPRA, CPA, or VCDPA)
Identifiers (Personal)	Analytics insights providerAdvertising vendorDirect marketing (e.g., email, text, telephone, postal) vendorAffiliated brands and entitiesContextual online experience providerCustomer service providerCustomer information providerData centerEvent or experience providerFocus group serviceFraud monitoring and preventionHuman resources service providerInformation security service providerIn-store Wi-Fi providerLogistics provider, e.g., order management and fulfillmentPayment and transaction processorProcess, services, or technology development or improvement vendorProduct review vendorSocial media platformTechnology administration and integrity provider (including for maintaining and improving networks; identifying problems; and fixing problems)Vendor, performing services in their own name through an independent consumer relationship, e.g., via consentVendor (miscellaneous) services	Advertising technology provider (including for online advertising) affiliated brand or entityAffiliate marketerSocial media platformSurvey company
Identifiers (Other)	Fraud monitoring and preventionHuman resources service providerVendor, performing services in their own name through an independent consumer relationship, e.g., via consent	Not applicable
Personal Characteristics, History, and Associations	Analytics insights providerAdvertising vendorDirect marketing (e.g., email, text, telephone, postal) vendorAffiliated brands and entitiesContextual online experience providerCustomer service providerData centerEvent or experience providerFocus group serviceFraud monitoring and preventionHuman resources service providerInformation security service providerProcess, services, or technology development or improvement vendorProduct and fit testerSocial media platformSolutions (miscellaneous) providerVendor, performing services in their own name through an independent consumer relationship, e.g., via consentVendor (miscellaneous) services	Advertising technology provider (including for online advertising) affiliated brand or entityAffiliate marketerSocial media platformSurvey company
Commercial Information	Analytics insights providerAdvertising vendorDirect marketing (e.g., email, text, telephone, postal) vendorAffiliated brands and entitiesContextual online experience providerCustomer service providerData centerEvent or experience providerFocus group serviceFraud monitoring and preventionHuman resources service providerInformation security service providerProcess, services, or technology development or improvement vendorProduct and fit testerSocial media platformSolutions (miscellaneous) providerVendor, performing services in their own name through an independent consumer relationship, e.g., via consentVendor (miscellaneous) services	Advertising technology provider (including online advertising), or affiliated brand or entityAffiliate marketerSocial media platformSurvey company
Biometrics	Not applicable	Not applicable
Computing or Mobile Device Information, and Internet or Other Electronic Network Activity Information of End Users	Analytics insights providerAdvertising vendorDirect marketing (e.g., email, text, telephone, postal) vendorAffiliated brands and entitiesContextual online experience providerData centerFraud monitoring and preventionInformation security service providerIn-store Wi-Fi providerSolutions (miscellaneous) providerTechnology administration and integrity provider (including for maintaining and improving networks; identifying problems; and fixing problems)Vendor, performing services in their own name through an independent consumer relationship, e.g., via consentSocial media platformVendor (miscellaneous) services	Advertising technology provider (including online advertising), or affiliated brand or entityAffiliate marketerSocial media platformSurvey company
Geolocation (Approximate and Precise)	Analytics insights providerAdvertising vendorAffiliated brands and entitiesContextual online experience providerCustomer service providerData centerFraud monitoring and preventionHuman resources service providerInformation security service providerIn-store Wi-Fi providerLogistics provider, e.g., order management and fulfillmentVendor, performing services in their own name through an independent consumer relationship, e.g., via consentSocial media provider	Advertising technology provider (including online advertising), or affiliated brand or entitySocial media platformAffiliate marketerSurvey company
Audio and Visual Information	Analytics insights providerAdvertising vendorAffiliated brands and entitiesContextual online experience providerCustomer service providerData centerFraud monitoring and preventionVendor, performing services in their own name through an independent consumer relationship, e.g., via consent	Advertising technology provider (including online advertising), or affiliated brand or entityAffiliate marketerSocial media platformSurvey company
Professional or Employment-Related Information	Human resources service providerFocus group serviceVendor, performing services in their own name through an independent consumer relationship, e.g., via consent	Not applicable
Education Information	Human resources service providerFocus group serviceVendor, performing services in their own name through an independent consumer relationship, e.g., via consent	Not applicable
Inferences (Predictive Information)	Analytics insights providerAdvertising vendorDirect marketing (e.g., email, text, telephone, postal) vendorAffiliated brands and entitiesContextual online experience providerCustomer service providerData centerEvent or experience providerFocus group serviceFraud monitoring and preventionHuman resources service providerInformation security service providerProcess, services, or technology development or improvement vendorProduct and fit testerSocial media platformSolutions (miscellaneous) providerVendor, performing services in their own name through an independent consumer relationship, e.g., via consentVendor (miscellaneous) services	Advertising technology provider (including online advertising), or affiliated brand or entityAffiliate marketerSocial media platformSurvey company
Sensitive Personal Information	Customer service providerHuman resources service providerFraud monitoring and preventionInformation security service providerLogistics provider, e.g., order management and fulfillmentPayment and transaction processor	Not applicable
Financial Related Information	Customer service providerHuman resources service providerPayment and transaction processor	Not applicable
Payment Card and Transaction Information	Customer service providerFraud monitoring and preventionInformation security service providerLogistics provider, e.g., order management and fulfillmentPayment and transaction processor	Not applicable
Household Information	Analytics insights providerDirect marketing (e.g., email, text, telephone, postal) vendor	Not applicable
Incident-Related Information	Information security service providerFraud monitoring and preventionVendor, performing services in their own name through an independent consumer relationship, e.g., via consent	Not applicable

We do not have actual knowledge that we sell or share personal information of consumers under the age of 16.

We also do not use or disclose any sensitive personal information for purposes other than those authorized by you or as permitted by law.

We will only process sensitive personal information where it is reasonably necessary for the purposes of carrying out our legal obligations or exercising specific rights as permitted by law. Sensitive personal information is any information that reveals your race, ethnic origin, religious beliefs, mental or physical health condition, treatment, or diagnosis, sex life or sexual orientation, citizenship or citizenship status, genetic or biometric data, personal information of a known child, or precise geographic data. For example, we may share financial or other data to provide customer service, process or fulfill orders and transactions, verify your information, or process payments. For any other use, we will obtain your explicit consent. For example, if you consented to precise geographic location when installing our mobile app, we may use this information to provide you with store locations and distances to such locations. If you did not consent, we will use approximate geographic data or geographic data based on your input (e.g., zip code).

When installing the Bath & Body Works app, you may have given the app permission to access the precise geographic location data from your phone’s operating system. If you wish to change this setting, you may do so through the app. Within the app, go to the More function at the bottom of the screen. Then go to App Settings and find Permissions. Under Location Permission, you can turn off “Use precise location” if you wish to change to approximate location setting. You can also select “Don’t Allow” or “Ask every time.” Your phone specific operating system may also allow you to change the permission settings. Please review your operating system instructions as they may be different for each operating systems and versions.

We retain information as necessary to effectively service our customers; provide relevant product assortments and advertisements; assist you with customer service-related matters; and comply with our legal obligations. The need to retain personal information varies widely with the type of information and the purpose for which it was collected. We strive to ensure that personal information for the period required to fulfill the purposes for which it was collected and is deleted when no longer required per our retention policies.

This policy covers all information, including sensitive personal information, collected by us and stored on our owned or leased systems and media, regardless of location. It applies to both information collected and held electronically (including photographs, video and audio recordings) and information that is collected and held as hard copy or paper files. The need to retain certain information may be mandated by federal, state or local laws or regulations, legitimate business purposes, litigation hold, or any combination thereof.

We retain all categories of consumer personal information to:

service our customers who are actively engaging with us and for a set period thereafter;
comply with applicable labor, tax and immigration laws;
comply with other regulatory requirements;
investigate security incident or other investigation;
preserve Intellectual property rights; and
assist in defense or prosecution of any litigated or threatened matter.

When the retention period for the information as outlined above expires, we will destroy the information covered by this policy.