Digital Audit: Costco Wholesale Corporation

Audit Phase: Digital Audit Date of Research: 29 June 2026

Enterprise Technology Stack & Vendor Relationships

Core Enterprise and Infrastructure Systems

Costco selected SAP S/4HANA Retail as its enterprise resource planning platform, with a go-live target of 2018–2019, deployed with integration to Microsoft Azure ¹. UKG (formerly Kronos) Workforce Central Absence Manager was purchased in 2015 for absence and leave management ¹. Microsoft Power BI is deployed for analytics and business intelligence ¹, HighRadius supports financial applications ¹, and AppWorx provides workload automation ¹.

Web-stack technology detection of costco.com identifies Adobe Analytics, Proofpoint (email protection), Akamai (CDN and DNS), Oracle (hosting and data-centre services), and Amazon CloudFront (CDN) as active components of the production environment ². Salesforce Commerce Cloud and VMware Cloud Foundation / vSphere are present at above-average deployment levels per independent tracking ³. Google Cloud is confirmed as Costco Canada’s “main cloud computing service provider,” with member data stored across Google’s global data-centre locations ⁴.

For cybersecurity operations, Splunk (now Cisco) is confirmed as Costco’s SIEM platform via multiple active job postings requiring Splunk SaaS SIEM experience and development of custom SOC applications in Splunk ⁵. Costco’s FY2025 10-K discloses that the company’s cybersecurity programme is supported by a security operations centre with external vendor partners; no specific vendor names are enumerated in the public filing ⁶.

Retail Media Network - “Costco Velocity”

Costco has publicly disclosed the full technology architecture of its retail media network, “Costco Velocity,” making it one of the first US retail media networks to do so ³. The unified data foundation runs on a private Google Cloud instance that consolidates 100% of member-identified transaction data ³⁷.

MetaRouter provides identity resolution and behavioural data capture ³⁷. LiveRamp delivers additional identity resolution services ³. Transcend manages privacy and consent workflows ³. GrowthLoop - an AI-powered audience segmentation platform whose co-founders include Anthony Rotio and Tameem Iftikhar ⁸ - powers member audience building for the network ³⁹. Criteo operates as the ad server for sponsored product placements on costco.com ³⁷. The Trade Desk, Google DSP, Yahoo DSP, Epsilon, and StackAdapt serve as offsite demand-side platforms ³. In-store and warehouse television media inventory is managed by PRN (Stratacache) ³. Symbiosys enables Costco product promotion within Google Shopping placements ⁷.

Habu (now LiveRamp) serves as the data clean-room provider for closed-loop measurement ³. Habu was founded in 2018 by former Krux executives and is a US-origin company; LiveRamp acquired it for $200 million in 2024, maintaining operations under US parent control ¹⁰.

Moloco Commerce Media powers Costco’s AI-driven onsite Reserved Display advertising format, deployed from 2025 ⁷¹¹. Moloco was founded in 2013 by Ikkjin Ahn and David Sehyuk Park and is headquartered in Redwood City, California ¹². A registered subsidiary entity, Moloco Technology Services Ltd, exists in the Israeli commercial registry ¹³; however, Moloco’s founding, primary operations, and headquarters are confirmed as US-based ¹².

Israeli-Origin Vendors

No confirmed direct licensing, subscription, or integration relationships with Israeli-origin cybersecurity or enterprise software vendors - including Check Point, Wiz, SentinelOne, CyberArk, Verint, NICE, Claroty, or comparable platforms - were identified in any primary source, regulatory disclosure, job posting, or technology-tracking database reviewed. No public evidence identified.

An activist claim that Costco uses Wix (Tel Aviv-based) for promotional microsites could not be verified through any primary or secondary source; W3Techs technology detection of costco.com reveals no Wix deployment ², and the originating activist website was inaccessible for direct fetch during the research session.

No specific systems integrators deploying Israeli-origin technology have been identified in connection with Costco’s known IT programmes. No public evidence identified.

Surveillance, Biometrics & Retail Technology

Facial Recognition and Biometrics

Costco has explicitly stated that it does not use facial recognition software in its stores ¹⁴. Beginning in January 2024, Costco rolled out barcode and QR-code membership card scanners at all warehouse entrances; when a card is scanned, the member’s stored account photograph is displayed on-screen for staff visual verification ¹⁴¹⁵. This constitutes a photo-on-file comparison workflow and is not automated facial recognition ¹⁴. The hardware manufacturer for these entrance scanners has not been publicly named in any reviewed source ¹⁵.

Costco’s website sells consumer-facing security cameras with facial recognition capabilities as a product category; this is a retail offering of third-party consumer devices and does not constitute deployment of facial recognition within Costco’s own operations ¹⁴.

Israeli-Origin Surveillance Vendors

No verified use of Israeli-origin surveillance, video analytics, or workforce intelligence platforms - including Trigo, BriefCam, AnyVision/Oosto, or Trax - has been identified in any reviewed source. No public evidence identified.

No verified use of Israeli-origin predictive policing, sentiment analysis, social media monitoring, or workforce surveillance tools has been identified. No public evidence identified.

No evidence of Israeli-origin surveillance capabilities bundled within Costco’s confirmed platform vendors has been identified. No public evidence identified.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Direct Costco Footprint in Israel

Costco operates no data centres in Israel. The FY2024 10-K Exhibit 21.1 subsidiary list enumerates entities across 14 countries of operation - the United States, Canada, Mexico, United Kingdom, Japan, Korea, Australia, Taiwan, China, Spain, France, Iceland, New Zealand, and Sweden - with no Israeli subsidiary recorded ¹⁶.

Google Cloud and the Israeli Region Exposure Pathway

Costco Canada’s published privacy policy explicitly identifies Google as the company’s “main cloud computing service provider” and states that member data is stored at Google’s global data-centre locations ⁴. Google Cloud opened its Tel Aviv region (code: me-west1) in October 2022; the same launch announcement confirmed that Google Cloud had been selected by the Israeli government to provide cloud services to Israeli government ministries ¹⁷¹⁸. Google Cloud has separately published compliance documentation for Israel’s Protection of Privacy Law, confirming active regulatory engagement within the Israeli market ¹⁹.

No evidence has been identified that Costco has specifically opted into the me-west1 (Tel Aviv) region, or that Costco member, transaction, or health data is stored or processed in Google’s Israeli infrastructure. Costco’s privacy policy does not enumerate the specific Google Cloud regions in use.

Project Nimbus and Sovereign Cloud Services

Costco has no documented participation in or contribution to Project Nimbus - the Israeli government’s cloud infrastructure contract awarded jointly to Google and Amazon. No public evidence identified.

Costco.com subdomains use Amazon for hosting services ², and Costco’s SAP S/4HANA deployment integrates with Microsoft Azure ¹; both AWS and Microsoft Azure operate infrastructure in Israel, but no evidence exists that Costco specifically uses these providers’ Israeli regions. No public evidence identified of Costco providing, co-developing, or subscribing to data-residency or sovereign cloud services for Israeli state entities.

2023 Meta Pixel Class Actions - Third-Party Data Exposure

Two class actions filed in October 2023 allege that Costco embedded Meta Pixel tracking code on its pharmacy website, transmitting protected health information - including prescription details and sensitive medical data - of more than one million pharmacy customers to Meta and Google without consent, for advertising targeting purposes ²⁰²¹²². Both proceedings were active at the time of this research. The lawsuits do not allege Israeli-specific data routing, though both Meta and Google operate R&D and infrastructure facilities in Israel.

Defence, Intelligence & Security Sector Technology Relationships

Military and Intelligence Contracts

No verified contracts or service agreements between Costco and the Israeli Ministry of Defence, the Israel Defence Forces, or Israeli intelligence agencies have been identified in any reviewed source. No public evidence identified.

Dual-Use Technology Deployment

No instances have been documented in which Costco technology has been deployed for military, intelligence, or law enforcement surveillance within Israel or the Occupied Palestinian Territory. No public evidence identified.

Offensive Cyber and Weapons Technology

Costco is a membership retail corporation with no documented involvement in offensive cyber capabilities, digital weapons systems, or autonomous lethal systems development. No public evidence identified.

AI, Algorithmic & Autonomous Systems

AI Provision to Israeli State or Military Bodies

No verified provision of AI or machine-learning systems by Costco to Israeli state, military, or security bodies has been identified in any reviewed source. No public evidence identified.

Internal AI Deployments

A SAP-developed AI solution supports demand forecasting for Costco’s bakery operations across more than 500 US warehouse bakery locations ²³. GrowthLoop’s Compound Marketing Engine applies AI segmentation to Costco first-party member transaction data, proposing audience journeys for the retail media network ⁹. Moloco’s AI advertising engine, trained on Costco’s first-party transaction data, powers the onsite Reserved Display advertising format ¹¹.

Training Data, Autonomous Systems, and Weapons AI

No public evidence has been identified that Costco’s AI systems are trained on surveillance-derived datasets sourced from Israel or the Occupied Palestinian Territory. No verified involvement by Costco in autonomous targeting, lethal decision systems, or battlefield AI has been identified. No public evidence identified.

Technology Ecosystem & R&D Footprint

Israeli R&D Centres and Engineering Offices

Costco operates no R&D facilities, engineering offices, innovation laboratories, or accelerator programmes in Israel. No public evidence identified.

Acquisitions and Investments in Israeli Technology

No acquisitions of Israeli-origin technology companies by Costco have been identified. No investments in Israeli technology startups, venture capital funds, or innovation accelerators have been identified. No public evidence identified.

Patents and IP with Israeli Institutions

No significant patent portfolios, licensing arrangements, or co-development agreements between Costco and Israeli-domiciled academic or research institutions - including the Technion, Hebrew University, or Weizmann Institute - have been identified. No public evidence identified.

Hello Heart / Navitus - Israeli-Founded Health Technology Indirect Link

Costco is a part-owner of Navitus Health Solutions, a pharmacy benefit manager that has managed prescription drug coverage for Costco’s approximately 300,000 employees since at least January 2019 ²⁴²⁵²⁶. In September 2025, Navitus announced a partnership with Hello Heart - an Israeli-founded digital cardiac health company with a Tel Aviv R&D centre that had raised $70 million in venture capital as of May 2022 ²⁷²⁸ - to offer Hello Heart’s app-based blood-pressure monitoring platform as an opt-in benefit to plan members across Navitus’s approximately 800 employer clients ²⁷. Whether Costco, as a Navitus part-owner and pharmacy benefit client, has specifically elected to extend Hello Heart coverage to Costco employees is not publicly documented. No public evidence identified of Costco employee enrolment in Hello Heart.

Civil Society Scrutiny & Regulatory History

OHCHR Settlement Business Database (A/HRC/60/19, September 2025)

Costco Wholesale Corporation is not listed in the UN OHCHR database of business enterprises involved in settlement-related activities, as reflected in the 2025 update (A/HRC/60/19) and the AFSC Investigate compilation of prior database iterations ²⁹³⁰.

Hadiklaim Israel Date Growers Cooperative Ltd appears in the OHCHR database ³⁰ and is documented as a Costco supplier. Canadian BDS Coalition campaigns in 2024 named Costco as stocking Hadiklaim-branded “King Solomon” Medjoul dates labelled “Produce of Israel,” with packing operations at settlement locations including Beit Ha’Arava and Netiv Hagdud in the Jordan Valley ³¹³². A 2026 Ramadan boycott campaign continued to identify Costco as a stockist of settlement-sourced dates ³³. The Costco Business Centre Canada website listed Organic Medjool Dates with Israel as country of origin ³¹.

Matrix IT Ltd - an Israeli IT services company documented in the OHCHR database as providing systems to the IDF, Israeli Civil Administration, Israel Police, and Prison Services, including the “Meitar” biometric checkpoint identification system and the “Rolling Stone” Palestinian permit data monitoring system ³⁴ - has no identified connection to Costco in any reviewed source. No public evidence identified.

Who Profits Database - Settlement-Linked Goods Suppliers

Multiple Israeli-origin companies supplying goods available at Costco appear in Who Profits’ corporate tracking of occupation-economy industries:

• Shamir Salads manufactures products at the Barkan Industrial Zone in the occupied West Bank and exports to Costco USA ³⁵.
• Mehadrin, Israel’s largest fruit exporter, has documented packing operations at Jordan Valley settlement locations - including Beka’ot, Messua, Tomer, and Na’aran - and in the Golan Heights (Ramot); Who Profits identifies distribution through “COSTCO retail chains” ³⁶, and the Canadian BDS Coalition’s 2025 Annual Report states Costco sells Mehadrin-branded dates ³².
• Keter Group formerly operated a manufacturing facility at Barkan settlement in the West Bank; Who Profits documented the closure of that facility by November 2016 ³⁷. Products including Keter fence and gate kits continue to be sold at Costco ³⁸.
• Delta Galil Industries, an Israeli textile manufacturer, is identified by Who Profits as a Costco supplier ³⁹.
• Ahava Dead Sea Laboratories was previously available on Costco’s platform; Costco reportedly discontinued Ahava products following BDS pressure circa 2010 ⁴⁰.

All settlement-supply documentation reviewed pertains to physical consumer goods - agricultural produce, cosmetics, plastics, and textiles. No Who Profits or equivalent database entry links Costco to settlement-produced technology products or digital services. No public evidence identified.

Albanese Report - A/HRC/59/23 (2 July 2025)

The UN Special Rapporteur’s report “From Economy of Occupation to Economy of Genocide” (A/HRC/59/23, 2 July 2025) names approximately 60 corporations regarding corporate complicity in Israeli military and occupation activity ⁴¹⁴². Technology companies specifically named include Google, Amazon, and Microsoft - regarding Project Nimbus cloud and AI provision to Israeli government and military - and Palantir, regarding AI platform integration with battlefield targeting and automated decision-making ⁴³⁴¹⁴². Costco is not named in this report ⁴³. The report is material to this audit insofar as Google - Costco’s confirmed primary cloud provider ⁴ - is a named entity subject to the Special Rapporteur’s findings ⁴¹⁴².

BDS and Advocacy Campaign Activity

Canadian BDS Coalition, CJPME, Solidarité Sherbrooke-Palestine, and affiliated groups have run targeted boycott campaigns against Costco since at least February 2024, focused on Israeli agricultural produce - principally Hadiklaim-sourced Medjoul dates and Mehadrin produce ⁴⁴³¹³². The 2025 BDS Annual Report identifies Costco as an active ongoing campaign target ³². A 2026 Ramadan campaign continued to call for boycott of settlement-sourced dates sold at Costco ³³. CJPME maintains a dedicated Costco page within its boycott and advocacy resources ⁴⁵.

No BDS campaign, NGO investigation, academic study, or UN report specifically examines Costco’s digital supply chain or technology vendor relationships with Israeli state or military entities; civil society scrutiny has been confined entirely to physical consumer goods. No public evidence identified.

An OpenIntel “Costco Corporate Complicity Dossier” was identified as a potential source during this research session; the URL returned HTTP 404 Not Found at the time of access and its content could not be verified or incorporated into this audit.

Israeli Government Market Outreach

In February 2023, Israeli Finance Minister Bezalel Smotrich sent a letter to Costco’s chairman and CEO inviting the company to expand into the Israeli retail market, framed as beneficial to Israeli consumers and to retail market competition ⁴⁶. No documented acceptance, commercial response, or operational follow-through by Costco has been identified in any reviewed source ⁴⁶.

Regulatory and Legal Actions

No regulatory inquiries, export control actions, or sanctions-related investigations involving Costco’s technology relationships with Israeli state entities have been identified. The open legal proceedings identified in this audit - the 2023 Meta Pixel class actions ²⁰²¹²² - relate exclusively to US domestic data-privacy claims and do not involve Israeli-nexus technology relationships.

No official public statement by Costco addressing Israeli product sourcing or in response to boycott campaigns has been identified. No public evidence identified.

End Notes