Gallery Collection Privacy Risk: What Its Policy Reveals

calendar Sep 19, 2026 / · 8 min read · identity theft catalog privacy gallery collection mailing list opt-out direct mail consumer privacy direct marketing data brokers holiday card catalogs  ·
Share on: linkedin copy

Why a Greeting Card Catalog Is Worth a Privacy Check

The FBI's Internet Crime Complaint Center logged 101,068 fraud complaints from adults aged 60 and older in 2023, totaling $3.4 billion in losses — an average of $33,915 per victim, up roughly 11% from 2022. A loss that size rarely starts cold. It starts with a scammer who already has one real, verifiable detail to open the call or letter with: a name matched to a home address — the same pairing a mail-order catalog collects on every order form and prints on every mailing label it sends back out. Phishing emails get most of the attention in identity-theft coverage. The catalog sitting in a mailbox gets far less scrutiny, even though it carries that same core detail in plain sight, readable by anyone who handles the mail before it reaches the recipient. A Gallery Collection catalog is a useful case to look at closely, because the company that publishes it, Prudent Publishing Company, writes out in its own privacy policy exactly what happens to that address after an order goes through.

Gallery Collection sells personalized greeting cards, many of them aimed at the holiday and business-card season, along with the usual catalog trimmings: sample requests, scholarship contests and an affiliate program. Ordering a box of holiday cards, requesting a free catalog or asking for a sample is enough to put a name and address into the company's customer file, and the policy is specific about what can happen to it from there.

Most of what the policy protects is narrower than it first sounds. It states that the company "will never disclose to non-affiliated third parties, without your prior approval, your e-mail address, phone number, credit card information, site usage, or site preferences." Read that list again: it does not include your mailing address. A separate section of the same policy, headed "Information Disclosed for Direct Marketing," spells out why the omission matters: "The Company occasionally makes our customers' physical mailing addresses available to a few carefully screened companies whose products or services may interest our clients." In plain terms, the strong non-disclosure promise Gallery Collection makes does not cover the one detail that lets a stranger send you mail.

That's worth taking seriously against the backdrop of how expensive mail-based and mail-adjacent fraud already is for older adults. In 2023, victims aged 60 and older reported $3.4 billion in losses to the FBI's Internet Crime Complaint Center, across 101,068 complaints, with an average loss of $33,915, up roughly 11% from 2022. Nothing in that report names Gallery Collection or any greeting-card company. The figure is the reason any company that says, in writing, that it shares your address with outside firms is worth a closer read — and worth an opt-out.

How Gallery Collection uses your address — and who else gets it

The privacy policy describes several ways information reaches the company: placing an order, requesting a catalog, requesting a sample, or simply contacting them with a question. It also monitors site usage — including your IP address — to diagnose technical problems, and it uses cookies to collect "name, address, and purchasing behavior," explicitly noting that it "allow[s] trusted third parties to create cookies and collect information from our Site." A site visit alone, not just a completed order, can put information in front of outside parties.

Two exceptions carve into the company's disclosure promise. First, it outsources some functions — the policy names shipping and credit-card processing — to business partners, sharing only what's needed to complete the transaction. Second, it cooperates with law enforcement on fraud investigations and subpoenas, which is standard and expected. Neither of those is the marketing disclosure described above; the direct-marketing sharing of physical addresses is a separate, ongoing practice the policy describes as routine ("occasionally"), not an exception carved out for a specific legal reason.

California residents get an additional layer under the CCPA: the right to know what categories of personal information were collected, to request deletion, to opt out of the sale of personal information, and to be free from discrimination for exercising those rights. The policy lists the categories it collects — identifiers like name and address, payment records, commercial information about what you've bought or browsed, and inferences drawn from that activity — and offers a "Do Not Sell My Personal Information" opt-out by phone or through an online form linked from the policy page.

What to do: opt out + protect yourself

  1. Opt out of Gallery Collection's own address sharing. The privacy policy says the option to stop mailing-address disclosure is "cost free" and can be exercised through the contact details on the privacy policy page itself, or by calling 1-800-950-7064. Ask specifically to be removed from the "carefully screened companies" list described in the policy's direct-marketing section, not just from Gallery Collection's own mailings.

  2. Cut the rest of the catalog mail. The Federal Trade Commission's junk-mail guidance describes DMAchoice, run by the Association of National Advertisers, where you choose which catalogs and other mail you get. It stops most, but not all, promotional mail, for a $6 fee online or $7 by mail, and the registration lasts 10 years. For junk mail beyond catalogs, OptOut.ws walks through the rest. For the wider mechanics of how catalog mailing lists connect to identity-theft exposure generally, see Catalog Mail and Identity Theft Risk.

  3. Opt out of prescreened credit and insurance offers. These travel through a separate system from any single catalog's mailing list. The FTC says you can opt out for five years or permanently at OptOutPrescreen or by calling 1-888-5-OPT-OUT (1-888-567-8688). The permanent option is only complete once you sign and return the form you're sent after starting the request.

  4. Manage the third-party ad cookies the policy discloses. Gallery Collection's own policy tells visitors they can configure their browser to block or flag new cookies, and it offers a separate opt-out link on the privacy page for the third-party cookies that collect name, address and purchasing behavior on its behalf. Using it is a second, narrower step beyond the mailing-address opt-out in step 1.

  5. Consider a mail-management app for mailers you can't trace back to a source. Services like PaperKarma let you photograph an unwanted catalog and request removal without tracking down a phone number or address for every sender yourself — useful once your address has moved through a "screened company" list you never dealt with directly.

  6. Shred anything with your name, address and an order or account number before you recycle it. A catalog with a printed mailing label carries both out of the house; a shredded one doesn't.

Signs your information has been shared

New catalogs from home-goods, gift or greeting-card companies you've never ordered from are the clearest sign that a "screened company" on Gallery Collection's list, or a similar list elsewhere, has your address. It doesn't mean anything was stolen — it means the sharing the policy already discloses is working as described. A rise in prescreened credit-card or insurance offers points to the credit-bureau channel in step 3 above, not to any single catalog company.

The warning sign worth acting on is a call, email or letter that pairs a real detail — your name, a recent card order, even the fact that you're a Gallery Collection customer — with a request for something sensitive: a card number, a Social Security number, or a "confirmation" payment. An accurate detail proves only that whoever contacted you has a record, not that they're who they claim to be. Hang up and call Gallery Collection back at the number on its own privacy policy page, never a number given to you by the caller.

Frequently asked questions

Does Gallery Collection sell my mailing address? Its privacy policy doesn't use the word "sell" for this practice; it says the company "occasionally makes our customers' physical mailing addresses available to a few carefully screened companies whose products or services may interest our clients." Whatever the wording, the practical effect for a customer is the same: your address can reach companies you never contacted.

Is my address covered by the same promise as my email or phone number? No. The policy's strongest non-disclosure language names email address, phone number, credit card information, site usage and site preferences specifically. Physical mailing address is not on that list, and a separate section of the same policy describes sharing it for direct marketing.

How do I stop Gallery Collection from sharing my address? Contact the company through the details on its privacy policy page or call 1-800-950-7064, and ask to be removed from the direct-marketing address-sharing described in that section, separately from any request to stop the catalog itself.

Does opting out stop the Gallery Collection catalog completely? Not necessarily. Stopping the address-sharing described above is a separate request from stopping Gallery Collection's own mailings. Say clearly which one you want, and consider DMAchoice for broader catalog volume from other senders.

Does the CCPA opt-out apply if I don't live in California? The rights the policy describes under the California Consumer Privacy Act are written for California residents. Readers elsewhere can still use the direct-marketing opt-out described in the policy's Notice section, which isn't limited by state.

References

Posts in this series