Effective Date: August 16, 2001
Updated: January 1, 2023
NFL Enterprises LLC, the National Football League, the league's thirty-two member clubs ("Member Clubs"), and the other members of the NFL Family (collectively, "NFL," "we," "our," "us") respect your privacy and value your trust and confidence. This privacy notice (the "Privacy Notice") applies to our websites, mobile applications, and other offline or online and mobile services, such as stadium Wi-Fi networks, that link to or post this Privacy Notice (collectively, the "Services"), and explains how we collect, use, and disclose information through the Services.
This Privacy Notice also provides certain region-specific disclosures, including additional information about data collected in those regions. By using the Services, you acknowledge that you have read and understood the terms of this Privacy Notice. Please note that this Privacy Notice does not apply to information collected in employment or job applicant contexts. For information about data handling practices in these contexts, please refer to the applicable privacy notices or seek more information from the relevant NFL entity. Likewise, this Privacy Notice does not apply to products and services where we have posted a separate privacy notice instead of a link to this Privacy Notice.
1. Information Collection
Information Provided by You
We may collect some or all of the following types of information, some of which may be considered sensitive information, when you register with us, use our Services, sign up for contests or sweepstakes, participate in surveys, access various content or features, submit comments or content, use a send-to-a-friend feature, or directly contact us with questions or feedback:
Identifiers, including contact information, such as name, e-mail address, postal address, and telephone number, and date of birth;
Other unique identifiers, such as a username or password, and, where needed, other identifiers such as Social Security Numbers and government-issued identifiers. For example, we may need to collect these identifiers to award you certain types of prizes under relevant laws;
Demographic information, which may include gender, race, ethnicity, and sexual orientation, and other protected classifications under California or federal law;
Financial and commercial information, such as credit card or other payment information and records of products or services purchased;
Real-time geolocation information, which may include precise geolocation information;
Communications and marketing preferences;
Favorite team and inferences about you and your personal preferences;
Audio, electronic, or visual information, such as photographs, if you provide a photograph of yourself to us, or information from CCTV cameras and/or when we film or photograph you in a public location at an NFL Event as described further here;
Biometric information, such as when you elect to use biometric authentication for stadium entry or other functionality. Where required by law, we collect this information pursuant to your consent and may provide additional notice about relevant data handling practices;
Information about your contacts, such as name and email address, when you share that information with us;
Comments and other information posted in our interactive online forums;
Correspondence, waivers or acceptances and other information that you send to us; and
Additional information as otherwise described to you in this Policy, at the point of collection, or pursuant to your consent.
If you decide not to provide this information, it may limit our ability to provide some of our content.
Information We Collect Automatically
We also may collect certain internet and electronic network activity information automatically when you visit or use the Services, including:
Your Internet Protocol (IP) address, which is the number automatically assigned to your computer whenever you access the Internet and that can sometimes be used to derive your general geographic area;
Your Media Access Control (MAC) address, which is a unique identifier assigned to a network interface controller;
Your device type or mobile carrier;
Other unique identifiers, including mobile device identification numbers; and advertising identifiers (e.g., IDFA);
Your browser type and operating system;
Sites and apps you visited before and after visiting, or while using, the Services;
Pages you view and links you click on within the Services;
Information collected through cookies, web beacons, Local Shared Objects, and other technologies, as described further below;
Information about your interactions with e-mail messages, such as the links clicked on and whether the messages were received, opened, or forwarded;
App usage information, including how often you use our application, the events that occur within the application, usage, and performance data, and where the application was downloaded from;
Standard Server Log Information; and
Standard Network Traffic Information when you are connected to an NFL stadium's Wi-Fi network.
In addition, a few of our select sponsors and business partners may be connected to our wireless internet service we provide at GEHA Field at Arrowhead Stadium, as described in our WIFI Policy (https://www.chiefs.com/stadium/wifipolicy). When you connect to our wireless internet service, depending on your mobile device, mobile network operator, and preferences, our sponsors and business partners may automatically collect your personal information to provide you their services. We do not control the services our sponsors and business partners provide you. You may choose not to accept services from our sponsors and business partners by adjusting the settings on your mobile device.
In addition to information we receive from you and collect automatically, we may receive your personal information from other sources, such as your friends, social networks, publicly available sources, data brokers, advertising partners, and our business partners and sponsors, including to facilitate co-branded programs. We may combine this data with information we already have about you.
2. Use of Information
We may use information that we collect about you for a variety of purposes, including to:
Provide you with products, promotions, services, newsletters, and information you request and respond to correspondence that we receive from you;
Contact you about your account or relationship with us;
Communicate with you about products, services, contests, and events that we think might be of interest to you, and otherwise send you promotional material or special offers on our behalf or on behalf of our marketing partners and/or their respective affiliates and subsidiaries and other third parties, and we will obtain your consent to send such communications to the extent required by law;
Maintain or administer the Services, perform business analyses, create aggregated or anonymized information that no longer identifies you and therefore is no longer subject to this Privacy Notice; or for other internal purposes to improve the quality of our business, the Services, and other products and services we offer;
Publish stories, comments, photos, and other information posted in our interactive online features;
In the case of location information, to determine your market location for purposes of administering broadcast restrictions for live games or other events, and for determining teams and offers in which you may have an interest;
In the case of Social Security Numbers, for example, for tax purposes when administering prizes to certain contest winners;
Protect the health and safety of our guests, personnel, and the public;
Protect or enforce the legal and contractual rights, safety, and security of the NFL and NFL stadiums, enforce applicable agreements with you or others, and prevent fraud; and
As otherwise described to you in this Policy, at the point of collection or pursuant to your consent.
If you choose to use our referral service to tell a friend about season tickets, we will ask for your friend's name and email address, to send your friend a one-time email inviting him or her to visit our Services.
8. Data Security and Data Integrity
The security and confidentiality of your personal information is very important to the NFL. We have implemented technical and organizational safeguards designed to appropriately protect your personal information against accidental, unauthorized, or unlawful access, use, loss, destruction, or damage. Still, no system can be guaranteed to be 100% secure.
As a result, while we strive to protect your information and privacy, we cannot guarantee or warrant the security of any information you disclose or transmit to the Services and cannot be responsible for the theft, destruction, or inadvertent disclosure of your information.
9. Data Transfers
When we transfer your personal information to third parties as described in this Privacy Notice, some of these parties may be located in countries other than your own, whose privacy and data protection laws may not be equivalent to those in your country of residence. When we transfer your personal information to other countries we apply appropriate safeguards, to protect your information and comply with applicable laws. For example, we implement measures such as standard data protection contractual clauses to ensure that any transferred personal information remains protected and secure. A copy of these clauses can be obtained by emailing email@example.com.
10. Data Retention
We will retain your information for as long as reasonably necessary for the purposes set out above, considering criteria such as applicable rules on statute of limitations, any legal requirements to retain your personal information in light of compliance obligations, any relevant litigation or regulatory investigations and to enable the NFL to defend or bring potential legal claims, the sensitivity of the relevant information, and the duration of your use of our website and receipt of our Services.
11. Children's Privacy
We do not knowingly collect personal information under this Privacy Notice from children under the age of 13 unless permitted by law. If you have reason to believe that a child under the age of 13 has provided personal data to us except as permitted by applicable law, please contact us using any of the methods described in the "Contact Us" section of this Privacy Notice, and we will endeavor to delete that data from our systems.
For children located in jurisdictions within the European Economic Area, we comply with the age limits applicable in each Member State. In these instances, the references above to the age of 13 will be deemed to be references to the age limits applicable in each Member State.
12. Communications Preferences and Access
You may choose to receive promotional emails, text messages, newsletters, push notifications, and similar communications from us. You may opt out of receiving commercial emails from us by clicking on the opt-out or "unsubscribe" link included in the commercial e-mails you receive. You may opt-out of receiving marketing text messages from us by replying "STOP." You may also opt out of receiving push notifications by turning off push notifications through your device settings.
If you have multiple accounts or relationships with different Member Clubs or other NFL entities, you may need to opt-out separately for each account and relationship in relation to these choices. In addition, if you would like to opt-out of receiving push notifications on all of your devices, you must turn off the feature on each device.
Please note that opt-out requests may take some time to be effective. Your opt-out requests will not apply to messages that you request or that are not commercial in nature. For example, we may contact you concerning any purchases you have made with us, even if you opt out of receiving unsolicited commercial email messages.
You may also have choices available to you to opt out of the collection of your geolocation information, whether collected through location services, Bluetooth, or microphone access technology. To understand your choices, please visit your device settings.
13. Your Other Choices
Some web browsers may transmit "do-not-track" signals to the websites with which the user communicates. Because of differences in how web browsers incorporate and activate this feature, it is not always clear whether users intend for these signals to be transmitted, or whether they even are aware of them. Because there currently is no industry standard concerning what, if anything, websites should do when they receive such signals, we currently do not take action in response to these signals. If and when a final standard is established and accepted, we will reassess how to respond to these signals. In some cases, third parties may be able to collect information about a user's online activities over time and across different websites when he or she uses our Services.
You may also be afforded, in accordance with applicable law, the right to limit certain uses and disclosures of sensitive personal information. You can exercise this right, if applicable, by clicking the "Your Privacy Choices" link at the footer of our sites or by clicking here. Please note that we may still maintain, use, and disclose your sensitive personal information for certain purposes, such as to provide you with services that you have requested, protect the safety and security of services, and comply with our legal obligations.
You may be afforded, in accordance with applicable law, the following rights:
- To access to the information that we have collected about you in a portable and (if technically feasible) readily usable form, including the categories and specific pieces of personal information that we have collected about you, the categories of sources for that information, the business or commercial purposes for collecting, selling, or sharing the information, and the categories of third parties with which the information was shared.
- To delete the personal information the NFL has collected about you.
- To correct the personal information we have collected about you.
- To object to or request the restriction of processing of your personal information.
- To withdraw your consent.
To exercise your access, deletion, and correction rights, please submit your request by visiting our Data Subject Request Portal. California residents may also exercise their rights under applicable law by calling 1-855-265-6894. If you are not able to submit your request via the portal above or toll-free number, you can contact the NFL by filling our an inquiry here. Once we receive your request, we may verify it by requesting information sufficient to confirm your identity. If you would like to use an authorized agent to exercise your rights, we may request evidence that you have provided such agent with power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf.
We reserve the right to deny requests as allowed by applicable law, such as where we have a reasonable belief that the request is fraudulent or where your identity cannot be confirmed or where the NFL must retain your information consistent with applicable law. You can, however, appeal those requests that we deny by submitting a request here. We will not discriminate against you for exercising your rights and choices, although some of the functionality and features available to you may change or no longer be available to you.
14. NFL Events
Information When You Attend An NFL Event: When you attend an NFL-event or NFL co-hosted event, including NFL games at an NFL stadium or at a third party stadium or other NFL fan events (including events at which a fan mobile pass is utilized) ("NFL Event"), we may capture your image, voice and/or likeness, including through the use of CCTV cameras and/or when we film or photograph you in a public location at an NFL Event. You should therefore expect to be filmed or photographed by CCTV and/or by cameras when you are in a public location at an NFL Event (e.g., as an audience-member in the stadium if you are attending a game). In addition to describing how we capture and use your image, voice and/or likeness in this Privacy Notice, we may also display signs at any NFL Event indicating that you may be filmed or photographed.
We may use your personal information collected at an NFL Event:
to produce, exhibit, advertise or otherwise use your image, voice, or likeness in any and all media now or existing in future as part of NFL's commercial, advertising and marketing activities; and
in the case of images or footage captured on CCTV cameras, to ensure the safety of the venues hosting NFL Events and of individuals attending NFL Events.
Sharing your personal information from an NFL Event: We may share your personal information captured at an NFL Event with any of the entities set out in this Privacy Notice (see section entitled "Sharing of Information"). Additionally, when you appear in a photograph or film footage at an NFL Event, we may share that photograph or film footage containing your image, voice and/or likeness with our third-party partners. These partners include our sponsors, licensees, advertisers and/or broadcasters. We will share the photographs or film footage containing your image, voice and/or likeness when it is in our legitimate business interests to do so. However, each of the third-party partners may use your personal information for their independent commercial purposes without reference to the NFL.
Please also note that broadcasters and other third parties that are unconnected to NFL may be independently filming or photographing you when you attend an NFL Event. Although we only give permission to a small group of entities (such as certain broadcasters) to film or photograph NFL Events, these entities are separate data controllers in respect of your personal information and NFL is not responsible for how those parties use your personal information and for what purposes.
15. Changes To This Privacy Notice
We may update this Privacy Notice to reflect changes to our information practices. If we make any material changes, we will notify you by email (sent to the e-mail address specified in your account) or by means of a notice on the Services prior to the change becoming effective. We encourage you to periodically review this page for the latest information on our privacy practices.
16. Contact Us
If you have any questions about this Privacy Notice or the privacy practices of the Services, please contact us by submitting an inquiry here or at the following address:
NFL Digital Media Group
345 Park Avenue
New York, NY 10154
Attn: Website Privacy Notice
17. California Users
California Consumer Privacy Act ("CCPA"): If you are a California resident and your personal information is subject to CCPA, then you have certain rights under California law.
- For information about the categories of personal information we may collect, including in the preceding 12 months, and the sources from which personal information is collected, please click here.
- For information about the purposes for which we collect personal information, please click here. We may use all the categories of personal information we collect for these purposes, although this may vary based on the nature of the relationship you have with us. You may also learn about our retention practices here.
- For information about the third parties to which we have disclosed personal information, including in the preceding 12 months, please click here. We may disclose all the categories of personal information we collect with these third parties, although this may vary based on the nature of the relationship you have with us. Please click here for more information about the circumstances in which we sell or share personal information.
For more information about the rights you have and how to exercise these rights, please click here.
The metrics below include the aggregate number of requests from consumers to know, access or delete personal information received by the League for the calendar year 2021. These numbers do not include requests that did not state a valid initial request under California law.
Requests to Know: 12 total requests were received, we complied with 3 in whole or in part and denied 9 requests that did not properly verify their identity, with an average completion time of 45 days.
Requests to Access: 18 total requests were received; we complied with 10 in whole or in part and denied 8 requests that did not properly verify their identity, with an average completion time of 45 days.
Requests to Delete: 38 total requests were received; we complied with 25 in whole or in part and denied 13 requests that did not properly verify their identity, with an average completion time of 45 days.
Shine the Light: California Civil Code Section 1798.83 permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, or if you have questions as to how your information is handled in compliance with CCPA, please contact NFL Support or write us at CA Privacy Rights, NFL Digital Media Group, 345 Park Avenue, New York, NY 10154.
18. International Users
This section of the Privacy Notice is supplemental and provides disclosures in addition to those made elsewhere in this Privacy Notice. This supplemental section applies only if you attend an event outside of the United States or use our website or Services otherwise covered by this Privacy Notice from a country that is not the United States and where the applicable member of the NFL Family is subject to jurisdiction-specific laws.
NFL Enterprises LLC is the data controller for League processing of personal information when you use our website and mobile applications. NFL International LLC is the data controller for League processing of personal information collected when you attend an NFL Event outside of the United States. Member clubs may also be a data controller for certain club specific executions and their entities are listed here.
Legal Basis for Data Processing: We process personal information for the purposes set out in this Privacy Notice, as described above. Our legal basis to process personal information includes processing that is: necessary for the performance of the contract between you and the NFL (for example, to provide you with the Services you request and to identify and authenticate you so you may use the website); necessary to comply with legal requirements (for example, to comply with applicable accounting rules and to make mandatory disclosures to law enforcement as well as to ensure your safety and the safety of our venues if you attend an NFL Event); necessary for our legitimate interests (for example, to manage our relationship with you and to improve the website and our Services, and for NFL's commercial, advertising and marketing activities); and based on consent by our customers (for example, to communicate with you about our products and services and provide you with marketing information).
In some instances, you may be required to provide us with personal information for processing, as described above, in order for us to be able to provide you all of our Services and for you to use all the features of our website.
If you are aware of changes or inaccuracies in your information, you should inform us of such changes so that our records may be updated or corrected. You may lodge a complaint with your local supervisory authority if you consider that our processing of your personal information infringes applicable law.
Except as otherwise prescribed by applicable law, in the event of any inconsistency between the English language version and local language version of this Privacy Notice, the English language version will prevail.
Your Rights: If you would like to request to access, correct, update, suppress, restrict, or delete personal information, object to or opt out of the processing of Personal Information, withdraw your consent (which will not affect the lawfulness of processing prior to the withdrawal), or if you would like to request to receive a copy of your personal information for purposes of transmitting it to another company (to the extent these rights are provided to you by applicable law), you may submit your request using our Data Subject Request Portal. We will respond to your request consistent with applicable law.
In applicable jurisdictions (such as the EEA), you will be provided with an opportunity to adjust your cookie preferences via our cookie preferences tool. As noted in Section 4, if you reject cookies through your our cookie preferences tool, you may still use our Services, but your ability to use certain features may be limited.
Supplemental Notice for the Kansas City Chiefs
This section provides additional information relevant to the Kansas City Chiefs Football Club, Inc. (the "Kansas City Chiefs"), GEHA Field at Arrowhead Stadium, and any Kansas City Chiefs affiliates (collectively, the "Chiefs Group").
This Privacy Notice applies only to personal information collected when you interact with the Kansas City Chiefs football team. For example, this Privacy Notice does not apply when you purchase tickets for or sign up for information about concerts and other events that do not involve the Kansas City Chiefs football team. For more information about our privacy practice and your choices when you interact with a member of the Chiefs Group outside the context of the Kansas City Chiefs football team, please visit the website of the appropriate entity or facility.
With the consent of their parents, we collect information from children under the age of 13 for our Kids Club. The information we collect is your child's name, date of birth, school, grade, favorite current or former Kansas City Chiefs player, and the address provided by a parent, guardian, or purchaser of the Kansas City Chiefs Kids Club membership. We use this information to allow you to sign your child up for the Kids Club and for you to receive Kansas City Chiefs merchandise as a part of the Kids Club membership, for your child. If you no longer wish to allow your child to be part of the Kids Club or wish to delete all information collected about your child, please contact us at our Data Subject Request Portal. For children located in jurisdictions within the European Economic Area, we comply with the age limits applicable in each Member State. In these instances, the references above to the age of 13 will be deemed to be references to the age limits applicable in each Member State.