"Lucy.co exhibits high-risk privacy practices comparable to advertising-focused platforms like Facebook/TikTok (70-85 range), with aggressive collection of sensitive financial and biometric data, comprehensive cross-site behavioral tracking, and broad sharing with advertising networks. The company explicitly does not honor Do Not Track requests, retains data indefinitely, and transfers user data in business transactions without explicit consent. The collection of full payment card numbers and biometric data for age verification, combined with past data sales and active retargeting pixels, creates significant financial and identity risks."
lucy Privacy Concerns & Scorecard
Cross-site behavioral tracking using cookies, pixels, and web beacons enabling comprehensive profiling across unaffiliated properties with retargeting
Biometric and sensory data collection (photos, videos, recordings) for age verification purposes on age-restricted nicotine products
Data shared with advertising networks and potentially sold to unspecified third parties; device/IP data and web analytics data have been sold in past 12 months
No clear data deletion guarantee after account deletion and 12-month waiting period before reauthorizing data sales opt-outs
Data retention periods are vague with indefinite retention of anonymous/aggregated data and extended retention for business purposes
No recommended actions at this time.
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Account creation, age verification for age-restricted products, customer identification
Age verification for nicotine products
Payment processing and subscription management
Shipping, location-based services, demographic profiling
User profiling and demographic segmentation
System functionality, analytics, device fingerprinting
Analytics, targeted advertising, retargeting, interest profiling
Customer service, support, communication history
Age verification for age-restricted products
Cross-Platform Tracking
Lucy.co extensively tracks users across unaffiliated websites and properties using third-party cookies and web beacons. The company collects 'browsing activity across unaffiliated properties' and 'interest-based behavioral data' to build comprehensive user profiles for retargeting and interest-based advertising. This cross-site tracking is facilitated by ad networks that can 'set their own cookies on user browsers, track activities across time and unaffiliated properties.' Twitter conversion tracking pixels are also active on Lucy.co pages for cross-platform advertising measurement.
Tracking Methods:
Cookies (First-Party & Third-Party)
Both first-party cookies for site functionality and third-party cookies set by ad networks to track users across unaffiliated websites for retargeting and interest-based advertising
Tracking Pixels & Web Beacons
Pixel tags, web beacons, clear GIFs, and JavaScript tracking elements used to collect data on user activity and interests; ad networks can view, edit, or set their own cookies through these mechanisms; Twitter conversion tracking pixels implemented
Device Fingerprinting
Collection of device characteristics (device type, OS, browser type) to create unique device identifiers for tracking purposes
Google Analytics
Used for advertising campaign performance measurement and analytics; enables tracking of user behavior for advertising purposes
AI & Data Training
lucy does not train AI on your content
Based on their public policy, your content is not used to train AI models.
How to Object
No opt-out available
This service does not currently provide a public way to opt out of AI training.
Why We Analyzed lucy
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.