Chipotle Mexican Grill
Consumer Discretionary
62
out of 100. Number 101 of 512, counting from the worst.
Where Chipotle Mexican Grill does well
- Renewals 1 of 20. Few problems found.
- Chipotle Rewards has no membership fees and no paid subscription, so there is nothing to auto-renew or make hard to cancel; enrolling in Rewards does not require opting in to marketing texts (SMS consent is separate and opt-in, with STOP to 888222 to quit); the privacy policy provides a 'Your Privacy Choices' footer opt-out for sale/sharing, a state-rights request portal, and unusually, published privacy-request metrics (e.g., 156,990 deletion requests received in the prior year); the arbitration clause permits either side to elect small claims court for individual disputes and offers a 30-day written opt-out for future changes to the arbitration agreement; and precise geolocation is restricted from sale/sharing even though general location data is not.
Joining Chipotle Rewards means you give up your right to sue in court, join a class action, or get a jury trial.
The fine print
6 clauses and findings from the draft archive, dated 1 October 2026. The plain English comes first; the small print is the company's own words. None of these has been checked yet.
-
Joining Chipotle Rewards means you give up your right to sue in court, join a class action, or get a jury trial. Before you can even file for arbitration, you must send a personally signed written notice and wait out a mandatory 60-day informal negotiation period that Chipotle made a 'condition precedent' — a court can enjoin your arbitration if you skip it.
You and Chipotle agree that any claim, dispute, or controversy (whether based in contract, tort, statute, fraud, or otherwise) ... will be resolved in individual arbitration with limited exceptions ... YOU AND WE EACH AGREE THAT ANY PROCEEDING, WHETHER IN ARBITRATION OR IN LITIGATION, WILL BE CONDUCTED ONLY ON AN INDIVIDUAL BASIS AND NOT IN A CLASS, COLLECTIVE, CONSOLIDATED, PRIVATE ATTORNEY GENERAL, OR REPRESENTATIVE ACTION. ... TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, YOU AND WE WAIVE THE RIGHT TO A JURY TRIAL. ... Compliance with this mandatory pre-arbitration informal dispute resolution process is required and a condition precedent to initiating arbitration.
-
Chipotle has a pre-built defense against mass arbitration: if 25 or more customers file similar claims together, your claim gets shoved into a staged bellwether process where only 50 claims are heard first, the rest are frozen without even being filed, and you explicitly agree your case 'might be delayed.'
If, at any time, 25 or more claimants (including you) seek to file demands for arbitration raising similar claims against any Chipotle Entity with the same or coordinated counsel or are otherwise coordinated ('Mass Arbitration'), these provisions shall apply. ... Counsel for the claimants and counsel for the Chipotle Entity shall each select 25 claims per side (50 claims total) to be filed and to proceed in individual arbitrations as part of a staged process.
-
Rewards members get only one year to raise any claim — no tolling, possibly shorter than the law normally allows — and they permanently give up the right to seek injunctions or other equitable relief over the rewards program.
EACH CHIPOTLE REWARDS PARTICIPANT AGREES THAT ANY LEGAL, EQUITABLE OR OTHER CLAIM ... MUST BE NOTICED WITHIN ONE (1) YEAR AFTER THE FIRST OCCURRENCE OF THE ACT, EVENT, CONDITION OR OMISSION UPON WHICH THE CLAIM OR ACTION IS BASED. EACH PARTICIPANT ACKNOWLEDGES AND AGREES THAT THIS ONE (1)-YEAR CONTRACTUAL LIMITATIONS PERIOD IS NOT SUBJECT TO TOLLING AND MAY BE SHORTER THAN THE DEFAULT STATUTE OF LIMITATIONS THAT WOULD OTHERWISE APPLY. ... PARTICIPANTS IRREVOCABLY WAIVE ANY RIGHT TO SEEK INJUNCTIVE OR EQUITABLE RELIEF.
-
If you visit Chipotle's site or app to check whether it complies with privacy laws, Chipotle says you are trespassing — and by doing so you consent to having your data shared via trackers and waive any privacy or wiretapping claims. It's a 'don't look behind the curtain' clause aimed at privacy testers.
The Services are not intended to be accessed by any person who seeks or intends to access the Services for purposes of being a 'tester' plaintiff or claimant, including individual consumers or attorneys ... who access the Services in order to investigate, evaluate, test, and/or assess the Service's compliance with the consumer privacy laws and regulations ... you agree that ... (a) you have no reasonable expectation of privacy in connection with your access to or use of the Services, (b) you have consented to our disclosure of any data collected about you ... to any third parties through cookies, pixels, tags, web beacons, java scripts, GET requests, and other technology, and (c) you hereby waive and release Chipotle from any liability for any claims related to invasion of privacy or violation of state or federal wiretapping laws.
-
Chipotle's own notice-at-collection table says your name, email, phone, order history, browsing history, location, nutrition preferences, and even your dietary-avoidance data can be disclosed to data brokers and third-party advertisers for sale, sharing, or targeted advertising under state privacy laws.
Category of personal information: Identifiers such as names, addresses, phone numbers, and email addresses ... Categories of Recipients: Analytics companies / Data Brokers / Third Party Advertisers ... Used for 'Sell,' 'Share,' or 'Targeted Advertising': Yes. (Same Yes/designation for Commercial information, General Geolocation Data, Internet/network activity including browsing history, user-generated content, Inferences, and Nutrition Preferences.) Precise Geolocation Data (this is sensitive personal information): collected 'to provide you with the nearest restaurant location, location nudges, and to have your order ready when you arrive.'
-
Your rewards can lose value whenever Chipotle wants: it can raise point costs at any time, points die after 365 days of no purchases, earned rewards expire in just 60 days, and if your account is terminated all points vanish. The rules themselves can be rewritten without telling you — changes take effect the moment they're posted, and you've waived the right to be notified.
Chipotle reserves the right to change the number of points required to earn Rewards and/or the benefits associated with one or more Rewards in its sole discretion at any time. Rewards points expire after 365 days of account inactivity ... Except as otherwise provided ... Rewards expire if not used within 60 days after they have been added to a participant's account. ... In the event that your participation in Chipotle Rewards is terminated, then all accumulated points and Rewards in your account are void. ... Chipotle reserves the right to change, update and/or discontinue ... these Chipotle Rewards Terms ... at any time in its sole discretion and without advance notice to you ... any changes or modifications will be effective immediately upon posting ... and you waive any right you may have to receive specific notice of such changes or modifications.
How these were found
All documents were read directly from the official chipotle.com domain on October 1, 2026 via browser text fetch — no mirrors needed. Rewards Terms show 'LAST UPDATED APRIL 13, 2026'; Privacy Policy shows 'LAST UPDATED APRIL 8, 2026'; the Terms of Use page itself carries no visible 'last updated' date in the fetched text, though a search snippet referenced an August 13, 2025 version. The Canadian rewards/privacy documents (chipotle.ca) were not reviewed; US terms only. Chipotle has no paid subscription product, so the auto-renew category reflects that (near-zero score). Quotes are verbatim excerpts from the fetched text, which appears to be the full current documents.
These notes come from the original draft and are not independent verification.