"The Ordinary's privacy practices present significant risk across multiple dimensions. The company collects extensive sensitive personal data including health information, physical characteristics, and demographic identifiers (ethnic origin, race, allergies, skin reactions), shares this data with advertising networks and multiple subsidiaries for behavioral targeting, and transfers data internationally to jurisdictions with weaker privacy protections. Critical gaps include indefinite retention periods, third-party cookie tracking across sites acknowledged as potentially constituting data 'sales' under CCPA, unspecified account suspension policies, and policy changes without advance notice."
theordinary Privacy Concerns & Scorecard
Data shared with multiple advertising networks and third parties for behavioral targeting. Company acknowledges that third-party cookie-based data collection for targeted advertising may constitute a 'sale' under CCPA despite claiming not to sell data.
Extensive collection of sensitive personal data including health information, physical characteristics, and demographic identifiers. The Ordinary collects ethnic origin, allergies, skin reaction information, race, color, national origin, and gender alongside standard identity and device data.
Third-party cookies and web beacons collect behavioral data across first and third-party websites for targeted advertising. Cross-site behavioral tracking enables retargeting based on browsing history across multiple sites.
Multiple account creation monitoring and account suspension without clear criteria. The Ordinary explicitly reserves right to cancel benefits and suspend accounts for 'individuals creating multiple user accounts' based on unspecified evaluation.
Vague retention periods with no specified deletion timeline. Data retained indefinitely with ambiguous language: 'as long as necessary' and 'as required by applicable laws or regulation' without specific duration limits.
No recommended actions at this time.
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Account creation, order fulfillment, communication, and account verification.
Product recommendation, customer support consultation, and complaint handling.
Transaction processing and order fulfillment.
Order delivery, localized marketing, and service personalization.
Website functionality, fraud prevention, analytics, and targeted advertising.
Product recommendations, marketing personalization, analytics, and service improvement.
Account authentication, social features, and cross-platform marketing.
Community engagement, product reviews, marketing, and user-generated content features.
Service delivery, customer support, and product recommendations.
Cross-Platform Tracking
The Ordinary tracks users across first-party sites and third-party advertising networks through cookies, web beacons, and pixels to build behavioral profiles for targeted advertising. Data is also aggregated across multiple DECIEM brand properties (The Ordinary, NIOD, The Chemistry Brand) and linked through account login, enabling cross-brand behavioral tracking and profiling.
Tracking Methods:
First-Party Cookies
Cookies set by The Ordinary on its own domain to store login sessions, preferences, and browsing activity.
Third-Party Cookies & Web Beacons
Tracking pixels and cookies from advertising networks, analytics providers, and data brokers placed on The Ordinary website to track user behavior across the web for targeted advertising.
Google Analytics
Third-party web analytics service collects IP address, device type, browsing patterns, and user interactions to build usage reports and behavioral profiles shared with advertising platforms.
Web Server Logs
Server-side collection of IP addresses, timestamps, and request information from user interactions, shared with third-party advertisers.
Device Fingerprinting
Unique device identifiers combined with device type, operating system, and browser characteristics to create a persistent device profile for cross-device tracking and account linking across brand properties.
Email Tracking
Web beacons embedded in marketing emails to track email opens, click-throughs, and user engagement for marketing attribution and behavioral profiling.
Account Login
User authentication and account ID linking enables tracking across devices, brand properties, and sessions for persistent cross-platform profiling.
AI & Data Training
theordinary does not train AI on your content
Based on their public policy, your content is not used to train AI models.
How to Object
No opt-out available
This service does not currently provide a public way to opt out of AI training.
Why We Analyzed theordinary
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.