Multi-State Privacy Notice

This Multi-State Privacy Notice (“Notice”) applies to residents of California, Colorado, Montana, Nebraska, New Hampshire, Oregon, Texas, and Virginia, and provides information about our privacy practices and your privacy rights pursuant to consumer privacy laws in your state of residence. If your state has a consumer privacy law but does not appear in the list above, it is because our Website has not met the minimum threshold required to comply with that law.

This Notice is in addition to and supplements our Privacy Policy, but in the event of a conflict between this Notice and our Privacy Policy, this Notice will prevail with respect to such conflict.

This Notice does not apply to our job applicants, current and former employees, or independent contractors.

Effective date: August 27th, 2025

I.                            Collection and Disclosure of Personal Information

While our collection, use, and disclosure of Personal Information varies depending on our relationship and interactions with you, the table below generally describes (a) the categories of Personal Information we collect about customers and website visitors, and (b) the categories of third parties to whom we may disclose such information for a business, commercial, or other lawful purpose. As used below, “Service Providers” includes without limitation third parties that provide us with delivery services, payment processing, analytics and marketing services, customer service and support, auditing services, and fraud prevention and security services. Disclosures to “government bodies, law enforcement, and third parties as required by law” pertain to all categories, but are only relevant to investigating fraud and unlawful conduct, while all requests for information by a third party (other than the person in question) require a valid warrant:

Categories of Personal Information Collected

Descriptions of Personal Information Collected

Third Party Disclosures for Business or Commercial Purpose

Identifiers

Name, username, postal address, email address, phone number and other contact information, Internet Protocol address, and unique identifiers.

(1) Service Providers; (2) Advertising networks (including companies that conduct contest and sweepstakes); (3) Social media networks; (4) Internet Service Providers; (5) Operating systems and platforms.

Categories of Personal Information

Name, account information, telephone number, address, payment information, information that individuals provide us in order to purchase products, earn Loyalty points, or get recommendations, so it may include information such as your date of birth, type of physical activity you engage in, and foot size.

(1) Service Providers; (2) Operating systems and platforms.

Commercial information

Products purchased, obtained, or considered.

(1) Service Providers; (2) Advertising networks; (3) Operating systems and platforms

Characteristics of Protected Classifications

This is a subcategory of information that you provide to us voluntarily, and may include gender, gender identity, age, date of birth, veteran status, health information, or other potential characteristics of protected classifications.

(1) Service Providers

Internet and Electronic Network Activity Information

Browsing history, browsing time, clickstream data, search history, access logs, usage and activity data, feedback from survey forms, and other similar information regarding your interaction with our websites, applications, other online services, or advertisements.

(1) Service Providers (e.g., marketing and analytics providers, and security providers); (2) Advertising networks; (3) Social networks; (4) Internet Service Providers; (5) Operating systems and platforms

Geolocation Data

Aggregated, anonymized data at the country, region, or city level (not precise geolocation data).

(1) Service Providers (e.g., web service, marketing or analytics providers, and security providers).

Audio, Video and Other Electronic Data

Audio recordings (e.g., of customer service calls), video recordings, chat transcripts.

(1) Service Providers (e.g., consumer support providers).

Profiles and Inferences

Profiles and inferences regarding consumer preferences and characteristics.

(1) Service Providers (e.g., consumer service and support providers, marketing, and analytics providers); (2) Advertising networks.

Biometric Information

We do not collect biometric information.

No third-party disclosures .

Sensitive Personal Information (Sensitive Data)

We do not collect “sensitive personal information” or “sensitive data” (as defined under applicable state laws).

No third-party disclosures.


We also collect, use, and disclose aggregate or other non-identifiable data related to our business for marketing, analytics, and other purposes. When we use or disclose this “de-identified” data (i.e., data that is not reasonably linked or linkable to a particular individual or device), we maintain it in de-identified form and do not attempt to re-identify it.

II.                        Sale and Sharing of Personal Information

State privacy laws broadly define “sale” to include disclosing personal information (or making available to a third party) in exchange for monetary consideration or a tangible benefit, and "sharing" to include disclosures to third parties for purposes of “cross-context behavioral advertising” (i.e., targeted advertising). While we do not share your PI with third parties in exchange for monetary compensation, we do share Internet and Electronic Network Activity Information, Identifiers, Inferences, and Commercial Information with third party advertising networks, social networks, and data analytics providers (e.g., via cookies, pixel tags and similar trackers on our websites and mobile apps) to provide you with more relevant personalized advertising across third party sites, to improve and measure our ad campaigns, and to reach users with more relevant ads and content. We do not sell or share sensitive Personal Information, nor do we sell or share the Personal Information about individuals who we know are younger than sixteen (16) years of age. Residents of applicable states may opt out of “sales” and “sharing” of their Personal Information as explained below.

III.                   Sources of Personal Information

In general, we may collect your Personal Information directly from you, including from your devices, from our Service Providers, and from the following categories of third-party sources:

  • advertising networks;
  • social media networks;
  • operating systems and platforms; and
  • joint marketing providers.

IV.                   Purposes of Collection, Use, and Disclosure of Personal Information

The purposes for which we may collect, use, and disclose Personal Information will vary depending upon circumstances. Generally speaking, these purposes (several of which overlap) include:

  • To perform our agreements with you (e.g., to manage and handle purchases and transactions, and provide our products and services to you);
  • To Improve our goods and services (e.g., to better understand our customers both on an aggregated and individual basis);
  • To market and promote our goods and services and brands (e.g., to send you newsletters, general marketing materials, promotional content (online and offline); and remind you of your abandoned shopping cart);
  • To advertise our goods and services (e.g., to maximize sales and personalize, analyze, and improve our marketing, including through our third-party advertising partners and social media platforms such as Facebook and Instagram);
  • To gather information about customers and users of the Website (e.g., to maximize sales, improve our goods and services, and better serve our customers by, among other means, collecting individual and aggregate analytics and statistics related to how people use the Website);
  • Obtaining customer feedback about or goods and services (e.g., by soliciting your opinions about our goods and services in order to develop and improve their quality);
  • To maintain security (e.g., to maintain website security and investigate fraud or unlawful activity);
  • To comply with a legal obligation (e.g., to maintain appropriate business records, comply with lawful requests by public authorities, and comply with applicable laws and regulations);
  • To run our business (e.g., carry out company policies, procedures, and directives; and enable us to merge, sell, acquire, or transfer assets); and
  • To engage in other legitimate business purposes permitted by applicable law.

V.                       Categories of Third Parties to Whom We May Disclosure Personal Information

We may disclose Personal Information we collect for the purposes described above to the following categories of third parties:

  • Service Providers that we engage to provide services to us or on our behalf;
  • Advertising or marketing partners, to show you ads geared to your interests (including on third party sites and platforms), and to create specific target audiences to whom to advertise;
  • Third parties, in order to comply with our legal requirements or legal processes, or to investigate actual or suspected fraud, violations of law, or breaches of security,  or to respond to any claim against us;
  • To third parties as part of a corporate transaction such as merger, sale, transfer of assets, acquisition, bankruptcy, or similar events; and
  • To others, subject to your consent or request.

VI.                   Retention of Personal Information

Generally speaking, we retain Personal Information for as long as required to satisfy the various purposes for which we collected it, unless a longer period is necessary for our legal obligations or to defend a legal claim. Specifically,

Establishing an account: we retain the Personal Information you provided in establishing your account until you delete it or request a general deletion of all of your Personal Information that we have collected.

Joining the Micro Crew Loyalty Rewards Program: we retain the Personal Information you provide in joining and participating in the Program until you delete your membership or request a general deletion of all of your Personal Information that we have collected. (For more about the Program, see Section IX below.)

Purchasing socks: when you begin the check-out process to purchase goods from us, we collect your email address, billing and shipping addresses, and telephone number(s), all of which we retain in our Customer Relationship Management (CRM) system indefinitely, subject to any rights you may have with respect to the Personal Information associated with your order.

Personal Information obtained through analytics providers: Analytics providers such as GA4 (Google Analytics) and Clarity (Microsoft) provide us with data showing how our website is being used. Both use unique identifiers (which are automatically assigned to your device/browser combination) to track your use of the Website. Since these identifiers could be combined with other data to identify a particular user, they are generally considered Personal Data.

Unique identifiers collected by GA4 are set to expire automatically 26 months after the date of collection. Clarity retains data differently. Recordings of user activity on the website are retained for 30 days. Labeled or favorited sessions, however, are retained for 13 months. In general, and subject to any rights you may have with respect to any identifiable Personal Information collected  via our analytics providers, we retain analytics data for as long as the service provider permits because it allows us to look historically at our performance over a period of time, contributing to the improvement of the Website and our goods and services.

Marketing tools and providers: Any Personal Information we may collect through our marketing tools and providers is retained in  our CRM system for at least as long as we use the particular tools.

VII.               Your Privacy Rights

State consumer privacy laws generally provide consumers who are residents of those states with the following privacy rights (subject to certain limitations and exceptions) following their request. These are:

A. Right to know (access). You have the right to know (no more than twice per year) with respect to any Personal Information that we have collected about you, (a) the specific information collected; (b) business or commercial purposes for which it was collected and/or shared; and (c) the categories of: (i) what was collected; (ii) sources from which it was collected; (iii) Personal Information about  you that was disclosed for a business purpose; and (iv) third parties to whom we disclosed your Personal Information. (As previously stated, we do not “sell” Personal Information as that term is generally understood.)

B. Right to delete. You have the right to request deletion of your Personal Information that we have collected.

C. Opt-out of sales and sharing. You have the right to opt out of “sale or sharing” as further explained below.

D. Right to correct. You have the right to correct inaccuracies in your Personal Information that we maintain. If you have a Website account, you can review and update your Personal Information there without making a request.

E. Right to non-discrimination. To exercise your rights, without being subject to discriminatory treatment.

Policy Regarding Sensitive Personal Information or Data: California broadly defines “Sensitive Personal Information” to include:

  • social security number, driver’s license or state ID card number, passport number, username and password, credit and debit card information,
  • non-public personal characteristics (e.g., racial or ethnic origin, information about a person’s sex life and sexual orientation, citizenship or immigration status, religious or philosophical beliefs, or union membership),
  • genetic and biometric data, and
  • precise geolocation data.

The other state laws relevant to this Notice define “Sensitive Personal Information” or “Sensitive Data” to include:

  • personal characteristics (generally broader than those included in the California law, e.g., mental and physical health diagnoses, status as transgender or non-binary, or status as a crime victim),
  • genetic and biometric data that can be used to uniquely identify someone,
  • precise geolocation data, and
  • personal data collected from someone known to be under the age of 16.

We do not collect any Sensitive Personal Information or Sensitive Data. Therefore, we are not required to post a “Notice of the Right to Limit Use and Disclosure of Sensitive Personal Information” (under California law) or any similar notice under the laws of other states, or to provide a “request to limit.” If you disagree with our Policy Regarding Sensitive Personal Information or Data, feel free to contact us at support@darntough.com.

VIII.              How to Exercise Your Privacy Rights

A. Requests to know (access), correct, and/or delete.

To submit a Request to know (access), correct, and/or delete, residents of the states covered by this Notice may either:

However, please note that you are likely to receive a quicker response using our online forms than by emailing us.

B. Verifying Your Request. When you submit a Request to know (access), correct, and/or delete, we will attempt to verify your Request by matching the information you provide with the information we have in our system. You must complete all required fields on our webforms (or otherwise provide us with this information by email) and also verify your email address. If necessary, we may request additional information in order to verify or process your request. (If we ask for a photo ID and a selfie, we will retain those only until completion of the verification process.)

You may also use an authorized agent to make your Request. Authorized agents must (a) submit a document showing that they are authorized to act on your behalf, and (b) if the agent is a company, show proof of registration to do business in your state of residence. Once the required documents are submitted, we will send you an email at your email address asking you to verify the agent’s authority and your identity. Once the verification requirement has been satisfied, we will respond to the Request.

C. Opting out of Sales and Sharing (“Do Not Sell or Share My Personal Information”)+

Opting out of sales and sharing is effectuated one browser at a time. On a prior login on the browser that you are using to read this Privacy Policy, you should already have encountered our “cookie banner” where you can set your data collection preferences. If you did not already encounter the cookie banner and set your cookie preference, you should do so here: .

You may also submit a request to opt out of sales and sharing, and exercise your other rights (including the right to opt in where you have already opted out) using our Consumer Rights Request forms.

IX.                   Micro Crew Rewards Loyalty Program

Our Micro Crew Rewards Loyalty Program (“Program”) may be considered to be offering “financial incentives” under applicable state law. For example, as part of the Program, we collect certain Personal Information to set up, operate, and administer the Program to provide you with rewards or benefits. As one example, you can earn Loyalty Points by volunteering your birth date to us. More information about the Program can be found here.

Signing up for our rewards programs is entirely your decision, and you can simply delete your membership at any time.

The financial incentives that Darn Tough offers to Program members are reasonably related to the value of the consumers’ Personal Information and participation. As a basis for offering the Program, we have valued that Personal Information and participation based on a reasonable and good faith calculation, by considering the expenses related to the Program, including the rewards and discounts that we offer to Program members.

Consumers are encouraged to review the Program description so they can make an informed decision whether to participate.

X.                       Rights Regarding Minors

State laws subject to this Notice prohibit businesses from selling or sharing Personal Information of consumers if the business has actual knowledge that the consumer is less than a certain age. Depending on the state, the age might be 18, 16, or 13. Consequently, in addition to their other rights, registered users of our Website who are under the age of 18 also have the right to request that we remove any content or information they have posted to the Website as part of a product review. Removal may be requested by contacting us at support@darntough.com, with details where the content or information is posted and a statement that you (or the minor in question) posted it. Subject to our reasonable verification of the person (e.g., parent or guardian) requesting removal, we will make a good faith effort to remove the content and information from public view (or anonymize it so the minor cannot be individually identified). The removal process does not remove webpages and information archived by third parties, (e.g., the Internet Archive Wayback Machine.)

XI.                   Contact Us

If you have any questions regarding this Notice or our privacy practices, please contact us here (click 'Get Help').

XII.               Modifications

We may modify, update, or otherwise amend this Multi-State Privacy Notice from time to time by posting the changes on this web page and specifying the effective date at the top. Changes are effective when posted.