CALIFORNIA PRIVACY NOTICES
LEGAL NOTICES
Last Updated: January 31, 2026
These California Privacy Notices supplement the information in the Simon Privacy Policy and applies solely to California residents providing personal information to us. This California Notice uses certain terms that have the meaning given to them in the California Consumer Privacy Act (“CCPA”) of 2018 (as amended by the California Privacy Rights Act (“CPRA”) of 2020) and related regulations. The definitions of any capitalized terms used in these California Privacy Notices are as provided in the Terms of Use or Simon Privacy Policy.
We collect this personal information directly from residents of California, as well as from social media platforms (e.g., if the individual has connected a social media account to an Account on our Sites); referrals; joint marketing, co-branding, co-promotional, or advertising ventures; and sources of demographic and other information, including through devices you used to interact with us through our Sites. All sources of personal information collected are noted in the “How We Collect Personal Information” section of the Simon Privacy Policy.
Categories of personal information Collected, Disclosed, Shared, or Sold
The categories of personal information that we collect, disclose, share, or sell are in the table below and categories of third parties to whom each category of personal information is disclosed, shared, sold, or processed for the purpose of targeted advertising. The purposes for processing these types of personal information are listed below the table.
| Category of personal information | To whom may we disclose such information | Sold or Shared to |
|---|---|---|
|
Identifiers, such as name, IP address, e-mail address, and online and device identifiers |
Service providers that we use to provide you the Sites. Affiliates for whom we may be a service provider or advertiser or who may be a service provider to us. Government, regulatory, or law enforcement agencies. |
Advertising and Data Technology Vendors and Affiliates. |
|
Internet or other electronic network activity information, such as hardware model, device software platform/OS and firmware, mobile carrier, preferred languages, and in some cases, browser type, Internet service provider, referring/exit pages and URLs, and clickstream data |
Service providers that we use to provide you the Sites (including, without limitation, cloud-based customer service and survey tools we use, and payment processors). Affiliates for whom we may be a service provider or advertiser or who may be a service provider to us. Government, regulatory, or law enforcement agencies. |
Advertising and Data Technology Vendors and Affiliates. |
|
Characteristics of protected classifications under California or federal law |
Service providers that we use to provide you the Sites (including, without limitation, cloud-based customer service and survey tools we use, and payment processors). Affiliates for whom we may be a service provider or advertiser or who may be a service provider to us. Government, regulatory, or law enforcement agencies. |
N/A |
|
Commercial information, including financial information, products or services purchased, or other purchasing or consuming histories or tendencies |
Service providers that we use to provide you the Sites (including, without limitation, payment processors and point-of-sale providers). Affiliates for whom we may be a service provider or advertiser or who may be a service provider to us. Government, regulatory, or law enforcement agencies. |
Advertising and Data Technology Vendors and Affiliates. |
|
Audio, electronic, visual, and other similar information, such as (1) CCTV camera footage taken from our centers (which may record or collect information about you including, without limitation, your vehicle (e.g., license plate information [see more in the ALPR Notice section below]), or whether you are carrying a weapon (2) photos taken by shoppers on our interactive directories or Sites, which we store (so that they can be shared back with the user that took it via a public weblink) |
Service providers that we use to provide you the Sites (including, without limitation, providers or hosts of websites or applications, that are active when you interact with or receive advertisements or images back to yourself at our Sites). Affiliates for whom we may be a service provider or advertiser or who may be a service provider to us. Government, regulatory, or law enforcement agencies. To the General Public or Other Users to the extent you have provided such information in a public forum or associated with an account profile on our Sites. |
Advertising and Data Technology Vendors and Affiliates. |
|
Non-Precise Geolocation Data |
Service providers that we use to provide you the Sites. Affiliates for whom we may be a service provider or advertiser or who may be a service provider to us. Government, regulatory, or law enforcement agencies. |
Advertising and Data Technology Vendors and Affiliates. |
|
Professional or employment-related information |
Service providers that we use to provide employment application and lifecycle management, or any part of the Sites for which you may register an account or post such content yourself. Affiliates for whom we may be a service provider to provide employment application and lifecycle management, or any part of the Sites for which you may register an account or post such content yourself. Government, regulatory, or law enforcement agencies. To the General Public or Other Users to the extent you have provided such information in a public forum or private forum associated with an account profile on our Sites. |
N/A |
|
Education Information |
Service providers that we use to provide employment application and lifecycle management, or any part of the Sites for which you may register an account or post such content yourself. Affiliates for whom we may be a service provider to provide employment application and lifecycle management, or any part of the Sites for which you may register an account or post such content yourself. Government, regulatory, or law enforcement agencies. To the General Public or Other Users to the extent you have provided such information in a public forum or private forum associated with an account profile on our Sites. |
N/A |
|
Communications with us, preferences, and other information you provide to us |
Service providers that we use to provide you the Sites. Affiliates for whom we may be a service provider or advertiser or who may be a service provider to us. Government, regulatory, or law enforcement agencies. To the General Public or Other Users to the extent you have provided such information in a public forum or private forum associated with an account profile on our Sites. |
Advertising and Data Technology Vendors and Affiliates. |
|
Sensitive personal information in the form of precise geolocation |
Service providers that we use to provide you the Sites. Affiliates for whom we may be a service provider or advertiser or who may be a service provider to us. Government, regulatory, or law enforcement agencies. |
Advertising and Data Technology Vendors or Affiliates based on your device’s location sharing settings and opt-in. For more information about how we use and share precise geolocation information or other sensitive personal information, see Section 12 of our Terms of Use and the How We Collect Personal Information section of our Privacy Policy. |
|
Inferences, such as information used to create a profile about a consumer reflecting the consumer’s preferences |
Service providers that we use to provide you the Sites. Affiliates for whom we may be a service provider or advertiser or who may be a service provider to us. Government, regulatory, or law enforcement agencies. |
Advertising and Data Technology Vendors and Affiliates. |
Processing Purposes:
We, our Service Providers, Affiliates, and our Advertising and Data Technology Vendors may use, disclose, sell and share your personal information to provide the Sites and may use, disclose, sell, and share this personal information for the purposes, including commercial purposes, as listed below:
- to operate, manage, and maintain our business;
- to send you ongoing marketing communications;
- to provide our Sites;
- to accomplish our business purposes and objectives, including developing, improving, repairing, and maintaining our Sites;
- for personalizing advertising and marketing;
- to collect analytics and conduct research;
- to provide you with location services, including to help you locate stores within our retail shopping destinations;
- for quality and safety purposes, including to maintain the security, quality, and integrity of our Sites and the Simon Properties;
- to implement security controls and monitoring;
- to detect and prevent fraud;
- to verify your identity;
- for audit, and other internal functions;
- to comply with law, legal process, and internal policies;
- maintaining records; and
- exercising and defending legal claims.
In limited circumstances, we may sell or share (as such terms are defined by the CCPA) personal data when we allow Affiliates to use your name and contact information and precise geolocation information to market their own products and services. We do not knowingly sell for monetary value, share, or process personal information of children under 16 years of age.
We do not use or disclose sensitive personal information for any additional purposes that are incompatible with the purposes listed above, unless we have provided you with notice of those additional purposes in the Terms of Use, Simon Privacy Policy or elsewhere.
Your California Privacy Rights
Right to Know and Access personal information: You may request to access information we have collected about you, the categories and categories of sources of personal information we have collected about you, the business/commercial purpose for collecting, sharing, or selling your personal information, and the categories of personal information about you that we sell or otherwise disclose, as well as the categories of third parties to whom we sell or otherwise disclose your personal information. If your request is granted, we will provide you with a copy of the personal information in a portable manner. Requests to access your personal information may be submitted up to two times in a rolling twelve-month period. Please note that, in some instances, we may decline to honor your request or only honor your request in part, where, for example, we are unable to verify your identity or an exception to this right applies.
Deletion of personal information: You may request that we delete the personal information we have collected from you. Please note that, in some instances, we may decline to honor your request or only honor your request in part, where, for example, we are unable to verify your identity or an exception to this right applies.
Opt Out of Certain Selling or Sharing Practices: You may request to opt out of the sale or sharing of your data for cross-context behavioral advertising/targeted advertising.
Limit use and Disclosure of Sensitive personal information: You may limit the use or disclosure of your sensitive personal information such as precise geolocation information, (1) to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services; (2) for certain business purposes; and (3) as authorized by the implementing regulations of the CPRA.
Correction of Inaccurate personal information: You have a right to request the correction of inaccurate personal information that we may have on file about you. Please note that, in some instances, we may decline to honor your request or only honor your request in part, where, for example, we are unable to verify your identity or an exception to this right applies.
Non-Discrimination: You have the right to be free from unlawful discrimination for exercising your above-listed rights under the CCPA.
Right to Appeal: You may appeal our determination not to act on your request within a reasonable period after receipt of our notice. In order to appeal you must click here. We will inform you within 45 days after receipt of your request (extended by an additional 60 days where reasonably necessary, taking into account the complexity and number of requests serving as the basis for the appeal), and we will include a written explanation of the reasons in support of our response. If we require the 60-day extension, we will inform you within 45 days after receipt of the appeal, together with the reasons for the delay.
To Exercise Any of These Rights:
You or your authorized agent may exercise the rights to know and access, delete and correct by calling us at phone at +1 (888) 914-9661; enter the required PIN number of 187828 when prompted, or submitting a request through the linked form here. You can also contact us by any of the methods listed in the Contact Us section of the main Simon Privacy Policy. To exercise your right to opt out of the sale or sharing for cross-context behavioral advertising/targeted advertising of your personal information, click here to fill out our general opt-out form or go to the footer of our website and select the “Do Not Sell or Share My Personal Information and Opt Out of Targeted Advertising” link. You can also go to Settings > Adjust Data & Privacy Settings to change privacy settings in the Simon Apps. To exercise your right to limit the use or disclosure of your personal information, click here to fill out our general form or go to the footer of our website and select the “Limit the Use of My Sensitive Personal Information” link. You can also go to Settings > Adjust Data & Privacy Settings to change privacy settings in the Simon Apps.
The CCPA and CPRA requires businesses to process opt-out preference signals (“OOPS”), such as global privacy control (“GPC”) signals, which are signals sent by a platform, technology or mechanism, enabled by individuals on their devices or browsers, that communicate the individual’s choice to opt-out of the sale and/or sharing of personal information for that specific device or browser. To use an OOPS/GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable the OOPS/GPC (for example, https://globalprivacycontrol.org/). We have configured the settings of our consent management platform to receive and process GPC signals on our Site. The opt-out only applies to the browser in the device in which you set it. For example, if you set the opt-out while using the Chrome browser, then the opt-out applies only to the Chrome browser on the device where it was set, not other browsers or devices. To opt-out across multiple browsers or devices, follow the same process for each browser and device.
When you make a request to know and access, delete and correct, you will be asked to answer a few questions about yourself to help us verify your identity. Third-party identification services may help us with verification to prevent disclosure of your personal information resulting from fraudulent requests. In the event more documentation is necessary to verify your identity, we will notify you directly.
Additionally, we may need to obtain information about you or your specific request in order to verify your identity and respond including, without limitation:
- First name*, Middle initial, Last name*
- Address*
- Email address*
- Phone number
*Required field
Authorized Agent
You may use an authorized agent acting on your behalf to exercise a privacy right discussed above. If you are an authorized agent acting on behalf of a California resident to communicate with us or to exercise a privacy right discussed above, you must be able to demonstrate that you have the requisite authorization to act on behalf of the resident. If you are an authorized agent trying to exercise rights on behalf of a consumer, please contact us at the contact information in the “To Exercise Any of These Rights:” section above with supporting verification information, which includes providing signed written permission from the consumer.
Financial Incentives
We provide account and loyalty-based discount, incentive, and community programs for users of our Sites (e.g., Simon Mall Insider®, VIP Shopper Club®, the Simon® co-branded credit card) and occasionally run a survey, contest, or sweepstakes (each a “Program”) where participants can provide personal information in exchange for a chance to win one or more prizes, such as gift cards, cash, shopping sprees, goods or services, or receive other benefits like product discounts or points redeemable for goods or services, any of which may be considered a “financial incentive” under California law. When you sign up for any Program, you are provided with the Terms and Conditions of the Program and are asked to provide your opt-in consent to participate in the Program, which you can withdraw from the Program at any time. We believe the exchange of data for the chance to win the Program prize(s) or to receive the benefits of the Program represents a fair value to the consumer, based on a good-faith estimate of the value of the consumer’s data as such data relates to such prize(s) or benefits. This is based on an analysis including the retail value of the Program prize(s) or benefits multiplied by (respectively) either the likelihood of winning the Program prize(s) (in the aggregate) or the number of benefits the consumer has or is likely to receive during the consumer’s participation in the Program. The value of the consumer data collected in relation to these Programs is limited based on the limited amount of data collected from each consumer, the categories of Personal Information collected, the limited transferability of such Personal Information, the limited use of such Personal Information in connection with marketing activities pursuant to this Notice, considering the volume of consumers participating in the Program overall, and that we do do not sell or share (as such terms are defined under the CCPA) this data outside of the context explained in the section above entitled “Categories of Personal Information Collected, Disclosed, Shared or Sold.”
The CCPA also requires that consumers continue to receive the benefits of the Programs, if possible, even if they exercise their opt-out and deletion rights. Since, for example, we offer some Program prizes (e.g., digital gift cards) via e-mail delivery to winners of a Program, we cannot provide such digitally-delivered prizes to you without you providing us your e-mail address. Additionally, you may be required to provide additional information such as your phone number, e-mail address, mailing address (for physically delivered prizes), date of birth, full legal name, etc. in order for us to verify your eligibility and to deliver any prize(s) you may have won should you try to claim any Program prize(s) notwithstanding any Program opt out you may have previously communicated to us. You will only be permitted to register for or continue to use our parts of our Sites that require registration of an account, including without limitation, any shopping or discount club or credit card account, if you agree to our Terms of Use and Simon Privacy Policy and provide the minimum necessary personal information for us to properly maintain such account and deliver any benefits on a commercially reasonable fashion. You will still have the right to request deletion of your data, in any event, as described above.
Shine the Light Disclosure
California residents also have the right to request that we provide you with (a) a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year and (b) the identity of those third parties. To exercise this right, contact us at the address below. We do not disclose personal information of California residents as defined by California Civil Code § 1798.83 (the “Shine the Light Law”) with third parties, other than our Affiliates, for their direct marketing purposes absent your consent. If you are a California resident, you may request information about our compliance with the Shine the Light Law by sending an e-mail to privacy@simon.com or by mailing a letter to:
Simon Media Properties, LLC
Attention: Data Privacy Officer
225 W Washington St
Indianapolis, IN 46204-3435 USA
Any Shine the Light Law request must include “Request for California Privacy Information” in the subject line and include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through the e-mail address or mailing address referenced above.
Automated License Plate Reader (“ALPR”) Notice
Simon utilizes ALPRs to help ensure security, prevent theft and fraud, assist with parking enforcement, and to help maintain the safety of individuals and property in and around the Simon Properties.
Simon’s ALPR system is led by our Senior Vice President & Chief Security Officer. Only authorized employees or security contractors are permitted to access ALPR systems, including the security operations and information services teams of Simon, as well as employees and contractors who manage the Simon Properties. Notwithstanding the immediately preceding sentence, Simon may allow Tenants at the Simon Properties to place their own ALPR systems or to maintain separate accounts with Vendors of existing ALPR systems in portions of the parking lot near their leased premises. Simon does not share any data Simon collects gathered from ALPR systems with Tenants and does not receive any ALPR data collected by Tenants. Tenants are solely responsible for their access and use of any data gathered through ALPR systems that such Tenants use or operate.
Employees and contractors who have access to personal information of our visitors must undergo training to ensure the responsible and ethical use of personal information, including ALPR data. The training includes understanding the principles of data privacy, including the protection of personal information and compliance with Applicable Laws, as well as procedures for responding to security incidents, data breaches, and unauthorized access attempts.
Personal information collected through ALPRs is processed in accordance with our Privacy Policy and it may be disclosed when we believe doing so will help to protect the safety, property, or other rights of any Persons using our Sites, visiting any Simon Property, or that are employed or contracted by any of the Simon Entities or our Vendors. See Who We Disclose Personal Information and Why under the paragraph titled “Government, regulatory, or law enforcement agencies” for additional information.
We use reasonable information security measures, including physical, administrative, and technical safeguards to protect your personal information, including information gathered through our ALPRs. Simon routinely monitors its ALPR system for accuracy, however if you want to submit a request to correct your personal information, please see the “Correction of Inaccurate personal information” section above.
We will retain data collected through our ALPR systems for 30 days, unless retention for longer periods is required because the information is related to a law enforcement investigation, subject to a legal hold declared in accordance with Simon policies, or is otherwise necessary to comply with our legal obligations.
How Long We Retain Your Personal Information
Except as otherwise stated in this Privacy Policy, we will retain your Personal Information for as long as necessary to provide our services, and as necessary to comply with our legal obligations, resolve disputes, and enforce our policies. We will not retain your personal information longer than reasonably necessary for the purposes for which the information was collected.
