Privacy Policies

Effective Date: October 29, 2025

This Privacy Notice describes information Subaru of America, Inc. collects, how it uses and retains such information, with whom it shares data, and consumer choices regarding these activities in the United States.

For vehicle information collection and usage, refer to the Vehicle Privacy Notice.

Table of Contents

• Scope
• Personal Information Collection, Use, Retention, and Sharing
• How Personal Information is Shared
• General Information Choices
• Consumer Rights
• Do Not Track
• Security of Personal Information
• Age Restriction
• Changes to Privacy Notice
• U.S. Market Only
• Contact Us

1. Scope

When This Privacy Notice Applies

This policy applies when Subaru collects information through Services, defined as Technology Services, Product Services, and other interactions—both online and offline (such as events) and from third parties including Retailers.

Technology Services encompass Subaru-controlled websites, applications, and mobile services linking to this notice, including the MySubaru app.

Product Services include production, distribution, sale, and maintenance of Subaru vehicles.

When This Privacy Notice Does Not Apply

This policy does not apply to:

• Authorized Retailers (independent companies)
• Retailer Service Providers
• Distributors
• Subaru Gear
• Subaru Motors Finance
• Employee or applicant information
• Vehicle usage information

An Affiliate is a company directly or indirectly controlling, controlled by, or under common control with Subaru.

2. Personal Information Collection, Use, Retention, and Sharing

Subaru retains personal information based on: statutory requirements, actual or threatened litigation, statutes of limitations, and industry best practices regarding safety and security. Information is deleted when no longer reasonably necessary.

A. Technology Services Usage

MySubaru Account Creation

Collected information includes name, email address, mailing address, telephone number, vehicle VIN, and password. Payment information is processed through a third-party processor; Subaru accesses it only for auditing.

Uses include account setup, service center location, service scheduling, service history tracking, 24-hour roadside assistance, and MySubaru Connected Services subscription benefits.

Subaru may communicate via email about vehicles, events, promotions, sweepstakes, and contests. To opt out of marketing communications, visit the privacy preferences page.

Identifiers (excluding passwords) are shared with Promotion Partners for events, sweepstakes, contests, and similar activities. To opt out, visit "Do Not Sell or Share My Personal Information."

SMS Message Consent

Users may consent to receive transactional (service reminders) and promotional SMS messages. By consenting, users agree Subaru and its agents may contact them with recurring marketing offers and promotions via autodialed text messages, even if listed on state or federal Do Not Call lists.

Consent is not required for purchase. Users may opt-out by replying "STOP" or calling 1-800-782-2783. Confirmation messages may arrive during processing. Standard message and data rates apply. Users must agree to SMS Terms of Use.

Badge of Ownership Lifestyle Badges

Ordered information includes name, VIN, email address, and shipping address. Data is used solely to confirm ownership and ship badges.

MySubaru Login

Username and password authenticate users. Only the last login timestamp is retained.

MySubaru Services

Service Center Location: Zipcode or city/state is collected to identify the nearest Subaru Service Center.

Service Scheduling: Account identifiers are shared with selected Retailers and Retailer Service Providers to provide repair or maintenance services.

Roadside Assistance: Collected information includes assistance reason, name, callback number, and location. This is shared with roadside assistance providers.

Remote Commands: Information directly from vehicles is collected to execute Remote Commands, Driver Alerts, and MyTrips settings.

MySubaru Mobile Application

Beyond personal information above, Subaru and third-party providers collect internet and electronic network activity (IP address, ISP, UDID, browser type/version) via trackers like SDKs to provide enhanced functionality and analytics.

Essential SDKs are necessary for application functionality.

Performance SDKs automatically collect device and usage information to test performance and improve the application on an aggregated basis.

Users may uninstall the app to stop collection or reset device settings to limit information use.

Website Chat Functionality

Chat content is collected to improve responses and for quality/customer service purposes. Users should avoid sharing sensitive information like Social Security numbers or medical conditions.

Metadata collected includes time, operating system, IP address, device, and user agent, shared with Liveperson (chat service provider). Information is retained for 45 days or until deletion is requested. This information is not sold.

Subaru-Controlled Websites

Beyond provided personal information, Subaru automatically collects internet and network activity (IP address, device identifiers, mobile device IDs, operating system, browser information) via trackers like pixels, cookies, web beacons, and SDKs to:

• Provide Technology Services
• Track users within Services
• Enhance user experience
• Conduct analytics for improvement
• Prevent fraudulent use and detect unlawful activity
• Diagnose and repair errors
• Track and mitigate abuse
• Provide targeted advertising

Such disclosures to third-party marketing and analytics trackers may constitute a sale, share, or targeted advertising disclosure under applicable data privacy laws. To opt out, change cookie management options.

Multiple devices used by the same person may be linked. Visit Adobe's privacy page or cookie management options to opt-out.

Google Analytics collects usage information via cookies and receives data from partnered applications and services. Google's use is restricted by its Terms of Use and Privacy Policy. Download the Google Analytics opt-out browser add-on, adjust ad settings, or modify "My Activity" if signed into a Google Account. Google's use disclosures may constitute a sale, share, or targeted advertising disclosure under data privacy laws.

To control cookie information, use the Cookie and Ad Preferences link at Subaru.com. Disable cookies via browser settings, though some Services features may not function properly. Opt-out is browser, app, and device-specific; multiple devices/browsers require individual opt-out.

Industry opt-out options:

• Association of National Advertisers: https://dmachoice.org/register.php
• Network Advertising Initiative (NAI): https://www.networkadvertising.org/managing/opt_out.asp
• Digital Advertising Alliance (DAA): https://optout.aboutads.info

Social Media Interaction

When users interact with Subaru's Social Media Pages (Facebook, TikTok, LinkedIn, Instagram, YouTube), basic engagement metrics are collected to tailor content and marketing and improve user experience.

Subaru does not control information posted to social networking websites; these platforms collect and process information for their purposes, including marketing. Refer to each platform's privacy policy for information on their use.

Social Media Pages: Personal identifiers (first/last name) and visual information (profile picture) are collected, along with interaction information (comments, shares, ratings). This information advertises products, promotes events/invitations, and enables user communication.

Social Media Pages are publicly accessible; posted information and profile details can be viewed and used by others. Content can be deleted similarly to other user-created content. For deletion requests, email https://www.subaru.com/contactus.

Community Management: Contact information including likes, shares, messages, and interactions are collected to analyze content perception, contact for customer service needs, and improve public relations efforts. Users with objections and overriding interests may submit objections via https://www.subaru.com/contactus.

Events and Photos: Event registration collects personal identifiers (first/last name, email, phone, physical address, and provided information) for event creation/management (guest lists, accreditation, admission control, room/personnel planning, catering) and invitations/notifications.

Photos and video recordings may be made at events, potentially showing attendees. If attendees are central subjects, photographers request consent before recording/photographing. Photos are used for public relations and marketing across media/digital outlets. Users with objections and overriding interests may submit objections via https://www.subaru.com/contactus.

Page Insights: When visiting Social Media Pages, applicable Social Networks record IP addresses and usage behavior via browser trackers or advertising IDs (IDFA from Apple, GAID from Google) when opening social apps on mobile devices. Social Networks provide Subaru with aggregated, anonymous statistical evaluations including age, gender, city/country, device, fan inquiries, region/language settings, gender proportion, reach numbers, post clicks, likes, reactions, comments, shared content, and total video views.

This information analyzes and improves advertising campaigns. No other personal information is collected or processed for Page Insights. Subaru does not retain this information independently. For data protection and storage information, refer to Social Network privacy policies. Social Networks are contractually responsible for providing users information about Page Insights processing.

Information Processed Solely by Social Networks: Subaru does not know how Social Networks use personal information for their purposes, storage duration, or third-party sharing. If logged into a Social Network, it automatically collects Social Network ID or links between Social Network ID and advertising ID when opening the app, enabling understanding of visited pages and clicked buttons, with content/advertising tailored accordingly.

For Social Network personal information collection, use, and storage information, visit linked privacy policies.

B. General Services Usage

Find a Retailer

Using "Find a Retailer" functionality, users enter search field information (address, ZIP code, city, state) used to identify the closest Retailer.

Buy or Lease a Vehicle

Purchased/leased information includes identifiers (name, address, email, phone) and commercial information (purchase details). Uses include recall/warranty purposes, registration facilitation for related/optional services (MySubaru account, Subaru Connected Services), and marketing/promotional communication.

To stop marketing communications, visit the privacy preferences page. For marketing communication usage information, see the "Subscribe to Subaru Email Newsletter" section.

Information is shared with Sirius XM for free trial services and Liberty Mutual for Subaru Advantage Insurance marketing. To opt out, visit "Do Not Sell or Share My Personal Information."

Shop for Parts and Accessories

Parts.subaru.com collects identifiers (name, mailing address, email, phone, VIN if provided) and commercial information (purchase details). Payment information is processed through third-party processors; Subaru accesses it only for auditing.

Uses include purchase processing, part shipping to users or service centers, inventory planning, and transaction communication. Identifiers are used for promotional offers. To stop marketing communications, visit the privacy preferences page. For marketing communication usage, see the "Subscribe to Subaru Email Newsletter" section.

Information is shared with Retailers (directly or via service providers) to complete purchases and for abandoned cart reminders when users express interest but don't complete orders. Internet and network activity information is collected as on other Subaru digital properties.

Shopping for Subaru Products or Services

Requests better answered by Retailers (price quotes for specific vehicles) result in Subaru providing identifiers (name, email, phone) and requests to selected Retailers for responses.

Added Security Extended Service Plan

Signing up at retailers results in VIN and contact information collection from retailers for eligibility determination and benefit provision. Information may be shared with administrators.

Service and Repairs

Authorized Retailer visits result in repair order information collection (VIN, repair performed, potentially name, address, phone, email) used for quality assurance and inventory planning. Information is shared with Retailer Service Providers. To opt out, visit "Do Not Sell or Share My Personal Information."

C. Contact Us

Email Newsletter Subscription

Subscribers provide personal identifiers (name, email) and contact preferences. Information fulfills newsletter requests and communicates updates, coupons, and special offers (events, sweepstakes, promotions, contests).

Identifiers are shared with email marketing providers and Promotion Partners for marketing emails and event/sweepstakes/promotion/contest information. To opt out, visit "Do Not Sell or Share My Personal Information."

Unsubscribe via "unsubscribe" links in emails or opt out of all communication via the privacy preferences page, MySubaru preferences (if registered), or by calling 1-800-782-2783. Notifications for services/requested products/services continue.

Communications contain tracking technologies (pixels) analyzing predefined actions (opening, timestamps, delivery status, IP address, email forwarding, clicks, sender/recipient addresses) used for additional email communications based on interaction/website visits and communication adaptation/personalization/distribution. Avoid downloading pixels by rejecting email image downloads.

Phone Calls

Phone contact results in identifier collection (name, phone) and audio information (voice sound) from Retailers, plus provided information. With consent, conversations are recorded for training, quality assurance, and legal obligation compliance.

Email Us Form

Completing the "Email Us" form results in identifier collection (name, address, email), topic, subject line, and communication content used to respond to messages.

Event Registration

Event registration collects identifiers (name, email, mailing address, phone) for event signup and email marketing list addition regarding future events, promotions, contests, and sweepstakes. Information is shared with event service providers. To stop marketing communications, visit the privacy preferences page. For marketing communication usage, see the "Subscribe to Subaru Email Newsletter" section.

Information is shared with Promotion Providers for future event/promotion/contest/sweepstakes marketing. To opt out, visit "Do Not Sell or Share My Personal Information."

Participate in Events, Sweepstakes, Promotions, and Contests

Subaru partners with trusted third parties (Promotions Partners) for Promotions, potentially sharing identifiers (name, phone, address, email) for Subaru marketing and Promotions Partners' marketing. To opt out, visit "Do Not Sell or Share My Personal Information."

Promotions Partners' personal information use is subject to their privacy policies. Collected personal information is used per official Promotion rules and potentially for Subaru marketing.

Some Promotions run by Marketing Partners, co-branded with Marketing Partners, or on third-party websites/social media platforms (like Facebook) collect personal information via third parties rather than Subaru. Promotion statements govern collection policy differences or third-party collection.

Share Your Subaru Story

Story submission results in contact information collection (name, address, phone, email) and identified Subaru retailer used to verify and publish stories on Subaru.com, retailer websites, and social media. Additional terms and conditions apply during submission.

D. Third-Party Information

Subaru purchases demographic information from third-party resources (data brokers) about potential purchasers for general marketing decision-making, including store location decisions. This information is not shared.

3. How Personal Information is Shared

A. General Sharing

Within Subaru: Personal information is shared within Subaru and Affiliates for efficient, effective Services provision (accounting, customer service support, safety, quality assurance). Access is limited to those needing it.

With Service Providers: Personal information is shared with service providers assisting in Services provision, described in the personal information collection section.

Corporate Reorganization: Upon entering or intending to enter transactions altering business structure (reorganization, merger, acquisition, sale, joint venture, assignment, consolidation, transfer, control change, business/assets/stock disposition), personal information is shared with third parties (including buyers and their agents/advisors) for transaction facilitation/completion.

Personal information is shared if Subaru undergoes bankruptcy or liquidation proceedings.

Legal Purposes: Personal information is shared when legally required (court orders, law enforcement, legal process, national security); to establish/protect/exercise legal rights; enforce terms of service/contracts; defend legal claims/demands; detect/investigate/prevent illegal activities, fraud, or threats to person rights/property/safety; or comply with applicable law requirements.

Consent: Apart from identified reasons, Subaru requests permission for specific personal information sharing purposes. Notification and consent are requested before providing or sharing personal information. Users may revoke consent anytime.

De-Identified Information (anonymized, aggregated data) may be shared in marketing materials and for benchmarking/internal analytics and commercial collaborations with private companies (market analysis). Once de-identified, data is maintained in de-identified form without re-identification attempts unless necessary for deidentification process compliance verification.

B. Last Twelve (12) Months Business Purpose Disclosure

Service Providers: Identifiers, commercial information (purchase history), and payment information are disclosed for cloud data storage/infrastructure, customer services, auditing, data validation, marketing, website hosting, email communication, and customer relationship management.

IT Support: Internet/electronic network activity information from cookies is disclosed to detect security incidents, protect against malicious/deceptive/fraudulent/illegal activity, and identify/repair Services. Internet/electronic network activity information is disclosed for Services updates/improvements/maintenance.

Payment Processors: Financial information is disclosed to facilitate purchases.

Advertising Providers: Internet/electronic network activity information is disclosed to measure online promotional campaign effectiveness.

Regulatory Agencies: VINs and associated information are shared with NHTSA for recalls/investigations and other regulatory agencies. Information is shared in response to search warrants.

C. Sale/Sharing of Personal Information (Last Twelve Months)

Subaru has sold/shared categories of personal information constituting potential sales under US data privacy law or sharing under CPRA. To opt out, visit "Do Not Sell or Share My Personal Information."

Data Analytics/Ad Networks: Internet/electronic network activity information from cookies, pixels, web beacons, and SDKs is shared for targeted advertisement serving regarding goods/services matching interests based on Services access/use information (including interest/preference inferences from online/offline third-party information).

API Providers: Internet/electronic network activity information is shared with software licensor third parties providing specialized functions/services requiring personal information transmission.

Promotions Partners: Identifiers are shared for Promotions provision.

Retailers/Service Providers: Identifiers and inquiry information related to Product Services are disclosed to Retailers and Service Providers as necessary.

Abandoned Cart Reminders: VINs are shared with Affiliates and Distributors when users express interest but don't complete orders for cart reminders.

Sirius XM/Liberty Mutual: Identifiers are shared with Sirius XM for free trial services and Liberty Mutual for Subaru Advantage Insurance marketing.

4. General Information Choices

Text Messages and Calls: Users opt-out by texting "STOP" to text message responses or contacting Subaru as outlined below, specifying text message/call opt-out. For more information, see SMS Terms and Conditions.

App and Location Technologies: Uninstalling the app stops all collection. Device settings reset may limit collected information use. Precise location data collection stops via app uninstallation or consent withdrawal through device settings.

MySubaru App: Users change communication preferences anytime via the app.

Push Notifications: Opted-in users opt-out via device permission adjustments or app uninstallation.

Opt Out of Marketing Communications: All users opt-out of marketing emails/newsletters by changing MySubaru preferences (if registered), contacting Subaru Customer Service at 1-800-782-2783, or clicking the provided link. Service/account/purchase notifications or requested assistance continue.

Opt Out of Other Cookies: Users opt-out via "Do not sell or share my information" links. Session cookies expire after browser closure. Persistent cookies follow browser directions. https://www.aboutcookies.org/ shows set cookies and deletion procedures. Each browser differs; visit browser developer websites for information.

Browser refusal of all cookies or indication when cookies send may impair website feature functionality. Opting out places an "opt-out cookie" that is browser and device-specific, lasting until cookie clearing. Essential cookies exempt the opt-out. Cookie removal, browser upgrades, or different computer visits require opt-out updates.

"Opt-Out" links direct to third-party websites scanning computers for maintained cookies. Users choose all targeted advertising opt-out or select individual company opt-outs.

• Association of National Advertisers: https://dmachoice.org/register.php
• Network Advertising Initiative (NAI): https://www.networkadvertising.org/managing/opt_out.asp
• Digital Advertising Alliance (DAA): https://optout.aboutads.info

5. Consumer Rights

United States residents receive the following rights, with certain states providing additional rights.

Right to Access/Know: Unless exceptions apply, users receive confirmation of personal information processing, lists of collected/used/disclosed/sold personal information categories, third-party disclosure category lists, and access to such personal information. This is free once or twice yearly (state-dependent). California residents may request access twice within 12 months. Connecticut, Delaware, Minnesota, Oregon, and Rhode Island residents receive specific third-party disclosure/sale lists. Connecticut residents know whether Subaru derived inferences using personal information or processed it for profiling producing legal/similarly significant effects.

Right to Deletion: Users request deletion of collected/maintained personal information, subject to exceptions (legal retention requirements prevent deletion until permitted).

Right to Opt Out of Sale/Sharing: Users opt-out of personal information sale/sharing to third parties or targeted advertising processing. Subaru has no actual knowledge of selling/sharing minors under 16 years without affirmative consent.

Right to Non-Discrimination/Non-Retaliation: Non-discriminatory treatment (no retaliation) applies when exercising privacy rights, including goods/service denial, different pricing/rates, or quality differences.

Right to Correct: Users correct inaccurate collected/maintained personal information.

Right to Limit Sensitive Personal Information Use: Users limit sensitive personal information use beyond Services provision or other permissible purposes (fraud, customer service, quality control). State-dependent sensitive information includes Social Security numbers, driver's license numbers, biometric information, precise geolocation, and racial/ethnic origin.

Right to Data Portability: Users request personal information transfer to other organizations or receipt of data. Organizations provide portable, readily useable format copies enabling transmission to others. Email privacy@subaru.com to exercise.

Right to Opt Out of Profiling: Users opt-out of personal information profiling in automated decision-making producing legal/similarly significant effects.

Right to Appeal: Users appeal refusal to take request action. Submit appeals via https://www.subaru.com/support/consumer-privacy.html, selecting "Right to Appeal." Subaru reviews and notifies of response. Continued refusal allows applicable state regulator complaints:

• Colorado: https://coag.gov/file-a-complaint/data-privacy-data-breach/
• Connecticut: https://www.dir.ct.gov/ag/complaint/
• Delaware: https://attorneygeneral.delaware.gov/fraud/privacy-complaint-form/
• Indiana: https://www.in.gov/attorneygeneral/consumer-protection-division/
• Iowa: https://www.iowaattorneygeneral.gov/for-consumers/file-a-consumer-complaint
• Kentucky: https://www.ag.ky.gov/Resources/Consumer-Resources/Consumers/Pages/Consumer-Complaints.aspx
• Maryland: https://oag.maryland.gov/Pages/oag.aspx
• Minnesota: https://www.ag.state.mn.us/Office/Complaint.asp
• Montana: https://dojmt.gov/office-of-consumer-protection/
• Nebraska: https://protectthegoodlife.nebraska.gov/data-privacy-homepage
• New Hampshire: https://www.doj.nh.gov/data-privacy-enforcement
• New Jersey: https://www.njoag.gov/contact/file-a-complaint/
• Oregon: https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/
• Rhode Island: https://riag.ri.gov/forms/consumer-complaint
• Tennessee: https://www.tn.gov/attorneygeneral/working-for-tennessee/file-a-consumer-complaint.html
• Texas: https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights
• Virginia: https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint

Notice of Financial Incentive

Subaru may offer financial incentives (compensation payments) for personal information collection, sale/sharing, or deletion. Other incentives include different prices, rates, quality levels, or goods/services directly related to provided personal information value. Required notification occurs when incentives are offered.

Subaru enters users into financial incentive programs with prior opt-in consent clearly describing material terms. Consent may be revoked as outlined in programs.

C. Exercising Your Rights

Request exercises via webform completion or toll-free call to 1-800-782-2783. Cookie-based sale/sharing opt-out is available by clicking a provided link. Global Privacy Control (GPC) supporting browsers/extensions may utilize opt-out preference signals instructing non-sale/sharing of online-collected personal information. GPC signals apply to device/platform/browser use; device/browser opt-out is required.

Sufficient information allowing reasonable verification as request person (including name, contact information, VIN if applicable) and sufficient request description details are required. Verification steps match provided information with records. If unverifiable via provided information, additional information may be requested.

Only the person or authorized representatives may request related personal information. Authorized agents require signed documentation of authorization.

D. Nevada Residents

Nevada residents may opt-out of current or future personal information sales. Opt-out requests submit via https://www.subaru.com/support/consumer-privacy.html with "Opt-Out Request Under Nevada Law" in message subject lines.

6. Do Not Track

Browser settings may transmit "Do Not Track" signals to visited online services. No industry consensus exists regarding site/app operator responses. Absent interpretation requiring response, "Do Not Track" signal monitoring/action does not occur. http://www.allaboutdnt.com/ provides "Do Not Track" information.

7. Security of Personal Information

Reasonable security measure implementation and maintenance protect collected/maintained personal information from unauthorized access/destruction/use/modification/disclosure. Secure server software and firewalls protect personal information. No security measure or internet data transmission modality guarantees 100% security; absolute collected information security is unguaranteed.

8. Age Restriction

Services are intended for 18+ year-olds; persons under 16 years personal information is not knowingly collected. Discovered under-16 personal information is deleted. Suspected under-16 personal information contact via https://www.subaru.com/contactus.

California residents under 18 registered on Services may request posted content removal. Submit requests via email/postal address on customer service contact pages, specifying "California Minor" requests. Verification and content location details may be required. Reasonable good-faith removal efforts from prospective public view occur, though complete/comprehensive content removal is unguaranteed, and content may retain for legal obligation compliance, dispute resolution, and agreement enforcement.

9. Changes to This Privacy Notice

Subaru amends Privacy Notice at sole discretion anytime. Changes post to this page with effect date indication. Privacy Notice review for awareness is encouraged. Material privacy rights affecting changes result in prominent website/email notification with required consent requests.

10. U.S. Market Only

Services information is U.S. market intended only. Non-U.S. access awareness includes potential U.S. and jurisdiction data transfer, processing, storage, and use, with differing data protection laws.

11. Contact Us

Privacy Notice questions contact 1-800-782-2783 or Subaru.com/contactus for assistance.

Updated: October 29, 2025