CarGurus' Privacy Notice

a. Your State Privacy Rights

Residents of California, Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Tennessee, Utah, Virginia, or any other state with an applicable privacy law have certain rights relating to the collection, use, disclosure, and other processing of their Personal Information. The exact scope of these rights may vary by state.

• Right to Know. Consistent with applicable law, you may have the right to confirm in a portable and (if technically feasible) readily usable form, after making a verifiable request whether we are processing your personal information and, in some cases, to obtain certain personalized details about the personal information we have collected about you, including the below. Please note that we may not be required to respond to your requests “to know” or access specific pieces of Personal Information more than twice in any 12-month period.

• The categories of personal information collected;
• The categories of sources of the personal information;
• The purposes for which the personal information were collected;
• The categories of personal information disclosed to third parties (if any), and the categories of recipients to whom the personal information were disclosed;
• The categories of personal information shared for targeted advertising or CCBA purposes (if any), and the categories of recipients to whom the data were disclosed for those purposes; and
• The categories of personal information sold (if any), and the categories of third parties to whom the data were sold.

• Right to Request Specific List of Third Parties. You may have the right to request a list of the specific third parties to whom we have disclosed your Personal Information.
• Right to Request List of Categories of Third Parties. You may have the right to request a list of the categories of third parties to which we have disclosed your Personal Information.
• Right to Data Portability. Consistent with applicable law, you may have the right to access your Personal Information in a portable format.
• Right to Delete. Consistent with applicable law, you may have the right, after making a verifiable request to have your personal information that is maintained by CarGurus deleted.
• Right to Correct: Consistent with applicable law, you may have the right after making a verifiable request to correct inaccurate personal information, considering the nature of the data itself and the processing activities it supports.
• Right to Opt Out of Certain Types of Personal Information Uses and Disclosures: We use and disclose to third parties Personal Information for analytics and advertising purposes. Accordingly, you may have the right to opt out of the “sale” or “sharing” of your Personal Information, or the use and disclosure of your Personal Information for “targeted advertising” (as these terms are defined in applicable law). You may opt out of such processing by navigating to "Your Privacy Choices" located in the footer of our site.

To exercise any of the above listed privacy rights, please submit a request by visiting our My Privacy Rights page. To exercise your Opt Out rights, please click the "Your Privacy Choices" located here or in the footer of our site. You can also exercise these rights by contacting us using the information provided below.

Verification. Consistent with applicable law, please understand that, depending on the type of request you submit, and to protect the confidentiality of yours and others' personal information, we will only complete your request when your identity has been verified. We will seek to match the information in your request to the personal information we maintain about you. As part of our verification process, we may ask you to: submit additional information, use identity verification services to assist, or, if you have set up an account on our website, to sign into your account as part of our identity verification process. Please note that, where permitted under applicable law, we may decline a request (other than for opt outs) if we are unable to verify your identity (or an agent’s authority to make the request) and confirm the Personal Information we maintain relates to you.

Right to an Authorized Agent. In certain states, consumers may designate an authorized agent to exercise their privacy rights. You may designate an authorized agent to submit requests on your behalf. However, we may require written proof of the agent's permission to do so and verify your identity directly.

Right to Non-Discrimination. You also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise your rights. However, the exercising of the rights described below may result in a different price, rate, or quality/level of product or service where that difference is reasonably related to the impact the right has on our relationship with you or is otherwise permitted by law.

You are not required to create an account to exercise your state privacy rights.

To appeal a refusal to take action on your request, please see the instructions in our response to your request or submit your appeal in writing by contacting privacy@cargurus.com with the subject “Appeal of Consumer Privacy Rights Request.”

b. Other State Rights and Disclosures

Nevada: Nevada law (NRS 603A.340) requires each business to establish a designated request address where Nevada consumers may submit requests directing the business not to sell certain kinds of personal information that the business has collected or will collect about the consumer. A sale under Nevada law is the exchange of personal information for monetary consideration by the business to a third party for the third party to license or sell the personal information to other third parties. If you are a Nevada consumer and wish to submit a request relating to our compliance with Nevada law, please contact us at privacy@cargurus.com.

California “shine the light”: California residents that have an established business relationship with us have the right to know how their personal information is disclosed to third parties for their direct marketing purposes under California's “Shine the Light” law, or the right to opt out of such practices (Civ. Code § 1798.83).

c. Unsubscribing From Marketing and Promotional Information

From time to time, we may send you marketing and promotional communications, including special offers from us or our partners. You may opt out of any or all future marketing emails from us here or by clicking on the unsubscribe link we place at the footer of every email we send that is not in response to an action taken by the user. Please note that you cannot opt out of non-promotional emails, such as those about your account, transactions or servicing. To opt out of marketing messages from car dealers with whom you’ve shared your personal information, please contact the individual dealer.

d. Interest Based Advertising

Targeted Advertising. Also referred to as “interest based,” “online behavioral,” “personalized” advertising, as well as “Cross-Context Behavioral Advertising,” targeted advertising is the serving of digital advertisements based on predictions generated over time from your visits across different websites, devices, mobile applications, as well as our own. We encourage you to consult our detailed notice on Interest Based Advertising here.

We may work with advertising technology partners who allow us to personalize our ads based on your browsing behavior on our digital properties. Many of these companies are participants of the Digital Advertising Alliance (“DAA”) and/or members of the Network Advertising Initiative (“NAI”). In addition to your right under your state's privacy law to opt out from targeted advertising by us and our own advertising partners, you can learn more about targeted ads provided by these companies as well as others we are not partnered with, and how to opt out of receiving certain targeted ads from them by visiting:

• https://www.aboutads.info/choices - For targeted ads from DAA participants on websites;
• https://optout.networkadvertising.org/?c=1 - For targeted ads from NAI members on websites and to learn more about how to opt out from receiving targeted ads on your other connected devices.

Opting out only means that the selected participants should no longer deliver certain targeted ads to the specific browser or device on which you made your request, it does not mean you will no longer receive any targeted content and/or ads from other advertising technology companies or on your other browsers or devices that have not been opted out.

We also partner with Amazon to deliver advertisements. You can opt out of delivery of targeted advertising to you by Amazon here. Please note that even if you opt out, you will continue to receive advertisements, but they will not be tailored to your specific interests.

We may also display interest-based ads to you when you are using Facebook and other social media platforms or websites.

Your member profile will be publicly viewable and identifiable via your username. CarGurus will not share your email address with any other members or display it publicly. Please consider carefully before making any information public as you are solely responsible for any information you make public. Once you have posted information, you may not be able to edit or delete it.

If you choose to participate in our member-to-member communications programs, you may be contacted by other members, using us as an intermediary. All members have the option to turn off the member-to-member communication features at any time.

Information that you make available to us and others via social media networks, forums, blogs, list serves, chat rooms or similar functionality is public information that we or others may share or use in accordance with the law.

CarGurus is committed to making its digital properties reasonably accessible. While we strive for substantial conformance with recognized accessibility standards (such as WCAG), we do not guarantee that every feature will be fully accessible at all times.

We have implemented administrative, technical, personnel, and physical security measures designed to protect the personal information stored in our systems against loss, theft and unauthorized use, disclosure or modification. We also employ processes (such as password hashing, login auditing, and idle session termination, as appropriate) designed to protect against unauthorized access to your personal information. While we endeavor to create secure and reliable digital properties for users, the confidentiality of any communication or material transmitted to/from a CarGurus digital property, and the security of your personal information, cannot be guaranteed. We encourage you to take steps to protect your personal information online. By using our digital properties, you acknowledge and assume the inherent risks of internet-based data transfer, and agree that disputes relating to such risks are subject to the arbitration provisions in the Terms of Use.

We are based in the U.S. and the information we collect is governed by U.S. law. If you are accessing our digital properties from outside of the U.S., please be aware that information collected may be transferred to, processed, stored, and used in the U.S. and other jurisdictions. Data protection laws in the U.S. and other jurisdictions may be different from those of your country of residence. Your use of this digital property or provision of any information therefore constitutes your consent to the transfer to and from, processing, usage, sharing, and storage of information about you in the U.S. and other jurisdictions as set out in this Privacy Notice.

CarGurus digital properties are intended for a general audience and are not directed at children under eighteen (18) years of age. We do not knowingly “sell” the personal information of minors under eighteen years old.

We do not knowingly gather personal information (as defined by the U.S. Children’s Online Privacy Protection Act, or “COPPA”) in a manner not permitted by COPPA. If you are a parent or guardian and you believe we have collected information from your child in a manner not permitted by law, contact us at privacy@cargurus.com. We will remove the data to the extent required by applicable laws.

If you are under 18 years old and registered to use a CarGurus digital property, you can ask us to remove any content or information you have posted. To make a request, email us at the email address set out in “Contact Us” section with “California Under 18 Content Removal Request” in the subject line, and tell us what you want removed. We will make reasonable good faith efforts to remove the post from prospective public view, although we cannot ensure the complete or comprehensive removal of the content and may retain the content as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

We may occasionally update this Privacy Notice to reflect changes in our practices. When we post modifications to this Privacy Notice, we will revise the "Last Updated" date at the top of this page. If we change the Privacy Notice in a material way, we will provide appropriate notice to you. Such notice may be provided via a temporary banner on our Site, an email sent to users for whom we have an email address, or by temporarily noting “UPDATED” next to the Privacy Notice link on the footer of our Site.

The modified Privacy Notice will be effective immediately upon posting. Your continued use of our digital properties after the posting of the modified Privacy Notice constitutes your agreement to abide and be bound by it. We encourage you to periodically review this page for the latest information on our privacy practices. If you object to any modification, your sole recourse is to stop using the digital property.

CarGurus, Inc.

1001 Boylston Street, 16th Floor

Boston, MA 02115

Attention: Privacy

privacy@cargurus.com