Digital Audit: Coca-Cola

Digital Audit: Coca-Cola

Enterprise Technology Stack & Vendor Relationships

Coca-Cola Europacific Partners’ Australia/Pacific/Indonesia unit (CCEP API) selected CyberArk, an Israeli-founded privileged access management (PAM) and identity-security vendor headquartered in Petah Tikva, as its Privileged Access Manager solution, rolling it out during 2021 to several hundred admin accounts and roughly 1,000 local admin accounts, integrated with SailPoint, Qualys, and CCEP’s Azure/AWS/GCP multicloud environment ¹². Coca-Cola Hellenic Bottling Company (CCH) separately announced its own selection of CyberArk for identity security on June 10, 2024 ³. Palo Alto Networks announced a $25 billion acquisition of CyberArk on July 30, 2025, a deal described as the second-biggest exit in Israeli technology history ⁴⁵. CyberArk was rebranded “Idira” as Palo Alto Networks extended the underlying technology to machine and agentic identities, effective May 12, 2026 ⁶⁷. As a result, Coca-Cola’s and its bottlers’ existing CyberArk deployments are now embedded within Palo Alto Networks’ identity-security stack under the Idira brand, an Israeli-founded (1999, Petah Tikva) technology lineage that remains in active use ⁸. Coca-Cola Co. was both an investor and a client of Bringg, a Tel Aviv-founded logistics and delivery-orchestration SaaS platform, participating in a $10 million Series B round in March 2017 alongside Aleph VC and Pereg Ventures ⁹¹⁰. Coca-Cola Hellenic’s Russia operations and Coca-Cola Amatil are documented customers of Trax, an Israeli-founded, Singapore-headquartered retail computer-vision and shelf-analytics company, for image-recognition retail-execution auditing ¹¹. Anagog, a Tel Aviv-based smartphone-sensor location and behavioral-data analytics firm, was admitted into Coca-Cola’s “The Bridge” startup commercialization program in June 2017 ¹²¹³. Cimagine, an Israeli augmented-reality startup and Bridge alumnus, was later acquired by Snap Inc. ¹⁴. No public evidence identified of a direct Coca-Cola or bottler licensing or subscription relationship with Check Point, Wiz, SentinelOne, Verint, Nice, or Claroty specifically, as distinct from the CyberArk/Idira identity-security relationship documented above.

Surveillance, Biometrics & Retail Technology

Coca-Cola Israel, working with agency Publicis e-dologic, deployed a “FaceLook” facial-recognition kiosk built on Face.com technology at the 2011 “Summer Love” consumer marketing event, allowing attendees to be identified and auto-posted to Facebook ¹⁵¹⁶. Face.com was an Israeli company later acquired by Facebook in 2012, and no evidence of any continuation of this activation beyond the single 2011 event was identified. Coca-Cola Freestyle vending machines contain an embedded camera reported to have future capability for motion sensing and facial recognition, and a third-party AI vendor published and then removed a case study describing demographic image capture from Freestyle cameras during roughly 2018-2019 lab testing, though Coca-Cola states the cameras are not currently collecting data; that vendor was U.S./India-based rather than Israeli ¹⁷. No public evidence identified of any Coca-Cola or franchisee deployment of Israeli-origin biometric or computer-vision vendors such as Trigo, BriefCam, or AnyVision/Oosto for loss prevention, access control, or store analytics. No public evidence identified of predictive-policing, social-media monitoring, or workforce-surveillance tools of Israeli origin in use at Coca-Cola or its bottlers. No public evidence identified of Israeli-origin biometric or surveillance technology reaching Coca-Cola indirectly via bundled managed-security or platform-provider suites, beyond the CyberArk/Idira identity-access-management relationship documented above, which is not a biometric surveillance function.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

No public evidence identified of Coca-Cola, its parent, or its bottlers operating, leasing, or co-locating data-center infrastructure within Israel. No public evidence identified of Coca-Cola participation in Project Nimbus or any comparable Israeli government cloud initiative. The Coca-Cola Company announced a five-year, $1.1 billion strategic partnership with Microsoft in April 2024 to accelerate cloud and generative-AI initiatives on Azure, expanding an earlier $250 million 2020 agreement, with reporting indicating Coca-Cola has migrated its applications to Microsoft Azure ¹⁸¹⁹²⁰. Coca-Cola’s multicloud strategy also includes Amazon Web Services, a relationship documented since 2013 in a joint marketing-data case study ²¹, and a historical Google Cloud marketing-data relationship dating to approximately 2013-2016 ²². CCEP’s CyberArk identity-security deployment separately spans Azure, AWS, and Google Cloud ². No public evidence identified that any of this cloud workload is specifically hosted in an Israel-based Azure, AWS, or Google Cloud region, or that Coca-Cola’s cloud contracts contain Israel-specific data-residency terms. No public evidence identified of Coca-Cola providing or being contracted for digital-sovereignty or resilience services to Israeli state or military bodies, consistent with Coca-Cola’s position as a cloud customer rather than a cloud vendor in this ecosystem.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of direct contracts between Coca-Cola, its subsidiaries, or Central Bottling Company and the Israeli Ministry of Defence, the IDF, or Israeli intelligence agencies for IT, communications, hosting, or analytics services. Israeli soldiers have been documented receiving Coca-Cola products through civil-society donation drives, including a reported distribution of over 100,000 units alongside Bamba snacks ²³; this is a consumer-product donation rather than a technology relationship. Coca-Cola piloted Palantir Technologies in July 2014 for a Diet Coke North America sales-data-analytics project but declined to sign the proposed five-year, approximately $18 million contract, citing cost and a difficult working relationship, and no evidence indicates this pilot involved Israeli government data or infrastructure ²⁴. No public evidence identified of any Coca-Cola commercial technology product being redeployed for Israeli military, intelligence, or law-enforcement surveillance applications. No public evidence identified of Coca-Cola involvement in offensive cyber or weapons technology; Coca-Cola is documented exclusively as a customer or investor in enterprise software in this space.

AI, Algorithmic & Autonomous Systems

Coca-Cola’s generative-AI initiatives are built on Microsoft Azure OpenAI Service and Copilot for Microsoft 365, targeting marketing, manufacturing, and supply-chain use cases as a general-purpose enterprise AI deployment ¹⁸¹⁹. No public evidence identified of Coca-Cola providing AI/ML, computer-vision, or decision-support systems to any Israeli state, military, or security body. No public evidence identified that any Coca-Cola AI model or platform was trained on or given access to civilian population data, intercepted communications, or surveillance-derived datasets originating from Israel or the occupied territories. No public evidence identified of Coca-Cola providing autonomous target-generation, threat-detection, or tracking systems to Israeli military or security forces.

Technology Ecosystem & R&D Footprint

Coca-Cola founded “The Bridge,” a Tel Aviv-based startup commercialization program, in 2014, run in partnership with Mercedes-Benz and Turner in some cohorts and explicitly focused on identifying Israeli tech startups in AI, AR/VR, cybersecurity, customer engagement, and supply chain for integration into Coca-Cola’s global bottler and vendor ecosystem ²⁵²⁶. Documented Bridge alumni include Anagog, a location and behavioral-data analytics firm ¹²¹³, and Cimagine, an augmented-reality company later acquired by Snap ¹⁴. A secondary aggregator source additionally names Cyabra (social-media/bot-detection) and Edgybees (drone/video AR) as Bridge portfolio companies, but this could not be independently corroborated in primary Bridge program materials and should be treated as unconfirmed ²⁷. No public evidence identified of Coca-Cola directly acquiring an Israeli-origin technology company, as distinct from minority startup investments made through The Bridge or venture rounds. Coca-Cola Co. participated as an investor in Bringg’s $10 million Series B round in March 2017, an Israeli enterprise logistics-SaaS company that was also a Coca-Cola client ⁹¹⁰. No public evidence identified of a verified strategic partnership between Coca-Cola and the Technion, Hebrew University, or the Weizmann Institute; a claim to this effect in secondary reporting could not be corroborated against any primary source describing scope, dates, or subject matter.

Civil Society Scrutiny & Regulatory History

Central Bottling Company (Coca-Cola Israel), documented by Who Profits, operates a regional distribution center and cooling houses in the Atarot Industrial Zone, an Israeli settlement in occupied East Jerusalem, via its wholly owned subsidiary Central Beverage Distribution Company, while a separate wholly owned subsidiary, Tabor Winery, sources grapes from vineyards in West Bank and Syrian Golan settlements ²⁸. Secondary reporting is in direct conflict regarding whether Coca-Cola/Central Bottling Company was ultimately included in or omitted from the United Nations’ February 2020 database of businesses linked to Israeli settlements, with some accounts describing Coca-Cola as expected to appear on the list amid reports of delayed publication under U.S./Israeli pressure ²⁹³⁰³¹, a conflict that could not be resolved against the primary OHCHR database document ³². The UN Special Rapporteur’s June 2025 report “From economy of occupation to economy of genocide” (A/HRC/59/23) does not mention Coca-Cola based on a direct text search of the advance edited version ³³. Central Bottling Company, Coca-Cola’s Israeli franchisee, donated approximately 50,000 NIS (roughly $13,850) in 2015 to Im Tirtzu, a right-wing Israeli group with pro-settlement positions and a record of targeting left-wing and human-rights activists, a donation Im Tirtzu subsequently sought to keep confidential ³⁴³⁵³⁶. Coca-Cola was added to the BDS National Committee’s priority boycott list in December 2024, with campaigners citing settlement operations at Atarot and Tabor Winery and the Im Tirtzu donation as grounds, though no boycott campaign identified is specifically grounded in Coca-Cola’s technology-vendor relationships ³⁷. The Coca-Cola Company has been subject to multiple OECD Guidelines “specific instance” complaints, including an IUF-filed case before the U.S. National Contact Point concerning alleged labor conduct in Indonesia, filed in March 2017 and unresolved after mediation in early 2018 ³⁸³⁹, and an Ireland National Contact Point case concerning Coca-Cola Company/Ballina Beverages in August 2021 ⁴⁰; none of the located OECD NCP cases concern Israel, settlements, or technology exports. Two 2025 data-security incidents were documented: an Everest ransomware group breach of Gulf Coca-Cola Beverages, a Dubai-based Middle East distributor, exposing employee passport, banking, and identification data from infrastructure located in Dubai ⁴¹⁴², and a separate breach of Coca-Cola Europacific Partners’ Salesforce CRM environment affecting approximately 23 million records ⁴¹; no Israeli infrastructure or data-routing was identified in either incident. David B. Weinberg, Coca-Cola’s Lead Independent Director since 2015 and Chairman/CEO of Judd Enterprises Inc., is President of its early-stage tech-investing affiliate Digital Bandwidth LLC, whose disclosed portfolio covers wireless networks, speech recognition, network security, and RFID, including U.S. companies Alien Technology and NFR Security ⁴³⁴⁴⁴⁵. No public evidence identified connecting Weinberg or Digital Bandwidth to any Israeli surveillance, cyber, AI, or SIGINT firm. No public evidence identified of any other named Coca-Cola board member, C-suite executive, or major shareholder holding equity, board seats, or personal investments in Israeli surveillance, cyber, AI, or SIGINT firms. Coca-Cola’s official FAQ pages publicly deny that the company sends profits to the Israeli army and address perceived connections to Israel ⁴⁶⁴⁷. A June 2024 Coca-Cola advertisement in Bangladesh drew backlash for reportedly denying ties with Israel ⁴⁸, and reporting in February 2025 described Palestinian consumers dropping Coca-Cola for a local alternative amid boycott sentiment tied to U.S. support for Israel ⁴⁹. A 2017 SEC no-action letter addressed a Rule 14a-8 shareholder proposal concerning the Holy Land Principles submitted for Coca-Cola’s proxy statement ⁵⁰.

End Notes