Chipotle Mexican Grill, Inc. (/tʃɪˈpoʊtleɪ/) is an American chain of fast casual restaurants in the United States, United Kingdom, Canada, Germany, and France, specializing in tacos and Mission-style burritos. Its name derives from chipotle, the Nahuatl name for a smoked and dried jalapeño chili pepper. The company trades on the New York Stock Exchange under the ticker symbol CMG.

Chipotle is one of the first chains of fast casual dining establishments. Competitors in the fast-casual Mexican market include Qdoba Mexican Grill, Moe's Southwest Grill, Rubio's Coastal Grill, Pancheros Mexican Grill, Freebirds World Burrito, and Baja Fresh.

Founded by Steve Ells on July 13, 1993. Chipotle had 16 restaurants (all in Colorado) when McDonald's Corporation became a major investor in 1998. By the time McDonald's fully divested itself from Chipotle in 2006, the chain had grown to over 500 locations.

With more than 2,000 locations, Chipotle had a net income of US$475.6 million and a staff of more than 45,000 employees in 2015.

Founder Steve Ells attended the Culinary Institute of America in Hyde Park, New York. Afterward, he became a line cook for Jeremiah Tower at Stars in San Francisco. There, Ells observed the popularity of the taquerías and San Francisco burritos in the Mission District. In 1993, Ells took what he learned in San Francisco and opened the first Chipotle Mexican Grill in Denver, Colorado, in a former Dolly Madison Ice Cream store at 1644 East Evans Avenue, near the University of Denver campus, using an $85,000 loan from his father. Ells and his father calculated that the store would need to sell 107 burritos per day to be profitable. After one month, the original restaurant was selling over 1,000 burritos a day. The second store opened in 1995 using Chipotle's cash flow, and the third was opened using an SBA loan. To fund more growth, Ells' father invested $1.5 million. Afterwards, Ells created a board of directors and business plan, raising an additional $1.8 million for the company. Ells had originally planned to use funds from the first Chipotle to open a fine-dining restaurant, but instead focused on Chipotle Mexican Grill when the restaurants saw success.

In 1998, the first restaurant outside of Colorado opened in Kansas City, Missouri. The company opened its first location in Minnesota by opening near the campus of the University of Minnesota in Minneapolis in March 1999.

In 1998, McDonald's made an initial minority investment in the company. By 2001, the company had grown to be Chipotle's largest investor. The investment from McDonald's allowed the firm to quickly expand, from 16 restaurants in 1998 to over 500 by 2005. On January 26, 2006, Chipotle made its initial public offering (IPO) after increasing the share price twice due to high pre-IPO demand. In its first day as a public company, the stock rose exactly 100%, resulting in the best U.S.-based IPO in six years, and the second-best IPO for a restaurant after Boston Market. The money from the offering was then used to fund new store growth.

In October 2006, McDonald's fully divested from Chipotle. This was part of a larger initiative for McDonald's to divest all of its non-core business restaurants — Chipotle, Donatos Pizza, and Boston Market — so that it could focus on the main McDonald's chain. McDonald's had invested approximately $360 million into Chipotle, and took out $1.5 billion. McDonald's had attempted to get Chipotle to add drive-through windows and a breakfast menu, which Ells resisted. In 2008, Chipotle opened its first location outside of the United States in Toronto.

In a list of fastest-growing restaurant chains in 2009, Chipotle was ranked eighth, based on increases in U.S. sales over the past year, and in 2010 Chipotle was ranked third. Consumer Reports ranked Chipotle as the best Mexican fast-food chain in 2011. The company serves approximately 750,000 customers per day.

In December 2010, Chipotle hired chef Nate Appleman to develop new cuisine. Appleman has won Rising Star Chef from the James Beard Foundation, was named "Best New Chef" by Food & Wine magazine, and competed on The Next Iron Chef.

In 2010, U.S. Immigration and Customs Enforcement (ICE) audited Chipotle's Minneapolis restaurants, and found that some employees had been hired using fraudulent documents. In December, Chipotle fired 450 employees from its Minneapolis restaurants as a result of the audit, resulting in protests by local groups. In February 2011, ICE expanded the audit to include 60 restaurants in Virginia and Washington, D.C. which resulted in 40 workers being fired. In April 2011, the criminal division of the Attorney General's office in Washington, D.C., joined the case, and ICE agents began interviewing employees at 20 to 25 restaurants in other locations, such as Los Angeles and Atlanta. In response to the government investigations, Chipotle hired former director of ICE Julie Myers Wood and high-profile attorneys Robert Luskin and Gregory B. Craig.

In 2011, Steve Ells was a judge for the TV show America's Next Great Restaurant and investor of ANGR Holdings, the company that will be running the winning concept's restaurants. Chipotle has agreed to purchase Ells' investment in ANGR at his cost, provide support for ANGR operations, and invest a total of $2.3 million in cash contributions.

In September 2011, Chipotle opened an Asian fast-casual concept restaurant named ShopHouse Southeast Asian Kitchen in Washington, D.C. The company has said the new restaurant "would follow the Chipotle service format and its focus on 'food with integrity' in ingredients." Chipotle's plan was to start with only one store, and see how the restaurant works out before expanding the concept.

On December 18, 2013, the company revealed that it had opened its first fast-food pizza chain in Denver back in May 2013. According to Associated Press, Chipotle partnered with a local full-service restaurant called Pizzeria Locale to create a fast-food version of the eatery, keeping its name. The company plans to open at least two more pizzerias in the Denver area.

In April 2014, Chipotle announced an increase in menu prices for the first time in nearly three years, due to increasing costs for steak, avocados, and cheese. The price increase was expected to be rolled out from the end of second quarter of 2014 through the end of the third quarter. In late 2015, Chipotle expanded its mobile strategy through delivery partnerships with tech startups like Tapingo, a delivery service that targets college campuses.

On July 29, 2016, the company announced the opening of its first Tasty Made burger restaurant in the fall. Chipotle was still dealing with the various virus outbreaks with additional marketing. The company was also reducing the number of new stores for the year from 235 to 220.

According to an article in The Motley Fool, Chipotle had 17 locations outside of the United States by October 2014 with the majority in Canada, and the UK was in the process of opening more locations. The rate of overseas expansion was slower than expected. Many of the press reviewers thought that the food was overpriced for their area.

As of 2017 there are 26 locations outside of the United States with 11 locations in Canada (Ottawa, Toronto, Vancouver), 6 locations in The United Kingdom (London), 3 in France (Paris), and 1 in Germany (Frankfurt).

In August 2008, Chipotle opened its first location outside of the United States in Toronto. The second location in Toronto–and in all of Canada–was not opened until 2010.

The first Canadian location outside of the Toronto area was opened in Vancouver in December 2012. A second Vancouver-area location was opened in Burnaby in October 2014 followed by a third in Surrey in January 2016 and a fourth in Langley in October 2016.

The first location in the nation's capital of Ottawa was opened in February 2017 at the Rideau Centre.

Chipotle expanded to Europe with the first European restaurant opening in May 2010 in London. A second location open in London in September 2011. The following year, three additional locations were quickly opened in the London area. After this growth spurt, the rate of further expansion in London slowed greatly with the sixth location appearing in 2013 and the seventh in June 2015. Although Chipotle blames the slow growth in the United Kingdom on the British unfamiliarity with Mexican foods, several locally owned burrito chains had opened locations across the United Kingdom during the same interval.

The first location in France opened in Paris in May 2012.

Expansion in France was much slower than that in the United Kingdom or Canada, with a second location in Paris opening in 2013 and a third location in 2014. At 7,000 square feet, the restaurant at La Défense is, as of 2015, the largest Chipotle location in the world, while a typical Chipotle restaurant is usually between 2,200 and 2,500 square feet. A fourth Parisian location was opened in Levallois-Perret in 2015 followed by a fifth and a sixth Parisian location in 2016, both in Saint-Germain-des-Prés.

The first and, so far, only location in Germany opened in Frankfurt in August 2013.

Chipotle's team includes a residing corporate office of managers and its board of directors. Members of both teams are appointed to serve on committees: audit, compensation, and nominating and corporate governance.

The top management team consists of the Chief Executive Officer, Steve Ells; the Chief Financial Officer, Jack R. Hartung; the Chief Marketing and Development Officer, Mark Crumpacker. The current board of directors consists of: Steve Ells, Patrick Flynn, Albert Baldocchi, Neil Flanzraich, Darlene Friedman, Stephen Gillet, Kimbal Musk and John Charlesworth.

Founder Steve Ells serves as chairman and Chief executive officer, and has a 1.25% stake in the company. The labor-market research firm Glassdoor reported that Steve Ells earned $29 million in 2014, versus a median of $19,000 for Chipotle's workers, making the CEO-to-worker pay ratio 1522:1.

All of Chipotle's restaurants are company-owned, rather than franchised. As of December 2012, 1430 restaurants have since opened throughout the United States and Canada, with locations in 43 states, Ontario, British Columbia, and the District of Columbia.

The field team are the employees who work closely with but not directly within specific restaurants. The field support system includes apprentice team leaders (step up from restaurateurs), team leaders or area managers, team directors and regional directors (not atypical for them to oversee more than fifty locations). Because Chipotle does not franchise, all restaurants are corporately owned. Thus, whenever Chipotle is in the process of launching a new location, the field team hires a new general manager and trains them at a current location so that they will be ready for the new location when it opens for business. The corporate office takes care of finding and funding new locations as well.

Chipotle's menu consists of four items: burritos, bowls, tacos, and salads. The price of each item is based on the choice of chicken, pork carnitas, barbacoa, steak, tofu-based "sofritas",, or vegetarian (with guacamole, which would be at an extra charge otherwise). Additional optional toppings are offered free of charge, including: rice, beans, queso, four types of salsa, sour cream, cheese, and lettuce. When asked in 2007 about expanding the menu, Steve Ells said, "[I]t's important to keep the menu focused, because if you just do a few things, you can ensure that you do them better than anybody else." Chipotle also offers a children's menu. Most restaurants sell beer and margaritas in addition to soft drinks and fruit drinks.

The majority of food is prepared in each restaurant. Some exceptions are the beans and carnitas, which are prepared at a central kitchen in Chicago, Illinois. None of the restaurants have freezers, microwave ovens, or can openers.

The chain experimented with breakfast foods at two airports in the Washington (D.C.) metropolitan area but decided against expanding the menu in that direction. Starting in 2009, selected restaurants had offered a pozole soup, which has since been discontinued.

In June 2015, Chipotle began test marketing a pork and chicken chorizo-type sausage as a new protein option at selected locations in the Kansas City area. Some food writers have expressed their health related concerns over the protein's relatively high sodium content since a 4-ounce serving contains 293 calories and 803 milligrams of sodium while the American Heart Association’s recommended daily amount is less than 1,500 milligrams of sodium. In contrast, the protein options with next highest sodium contents are Barbacoa with 530 milligrams and sofritas with 555 milligrams. An earlier version on the Mexican sausage was tested in Denver and New York City in 2011, but that test was terminated when that version of the sausage was perceived as looking too greasy. As of September 2017, chorizo is no longer available on Chipotle's menu.

Chipotle accepts fax orders, and in 2005 the company added the ability to order online from their website. For both online and fax orders, customers proceed to the front of the line to pay for pre-ordered food. In 2009, Chipotle released an app for the iPhone that allows users to find nearby Chipotle locations, place an order, and prepay with a credit card. In 2013, Chipotle released an Android app that allows users to locate nearby Chipotle locations, place an order, prepay with a credit or gift card, and access favorites and recent orders.

In 2003, a Center for Science in the Public Interest report stated that Chipotle's burritos contain over 1,000 calories, which is nearly equivalent to two meals' worth of food. MSNBC Health.com placed the burritos on their list of the "20 Worst Foods in America" because of their high caloric content and high sodium. When a burrito with carnitas, rice, vegetables, cheese, guacamole, and salsa was compared with a typical Big Mac, the burrito had more fat, cholesterol, carbohydrates, and sodium than the Big Mac, but it also had more protein and fiber. The restaurant has also received praise – Health.com included the restaurant in its list of the "Healthiest Fast Food Restaurants".

Chipotle's vegetarian options include rice, black beans, fajita vegetables (onions and bell peppers), salsa, guacamole and cheese. All items other than the meats, cheese, sour cream, and honey vinaigrette dressing are vegan. As of late 2013, Chipotle developed a new cooking strategy for the pinto beans, eliminating the bacon and making them vegetarian and vegan-friendly. The cheese is processed with vegetable-based rennet in order to be suitable for vegetarians. In April 2010, Chipotle began testing a vegan "Garden Blend" option, which is a plant-based meat alternative marinated in chipotle adobo, at six locations in the U.S. The flour tortillas used for the burritos and soft tacos are the only items that contain gluten.

In 1999, while looking for ways to improve the taste of the carnitas, Steve Ells was prompted by an article written by Edward Behr to visit Concentrated Animal Feeding Operations (CAFOs). Ells found the CAFOs "horrific", and began sourcing from open-range pork suppliers. This caused an increase in both the price and the sales of the carnitas burritos.

In 2001, Chipotle released a mission statement called Food With Integrity, which highlighted Chipotle's efforts to increase their use of naturally raised meat, organic produce, and dairy without added hormones. Chipotle only uses the leg and thigh meat from its chickens; the breast meat is sold to Panera Bread.

Founder Steve Ells has testified before the United States Congress in support of the Preservation of Antibiotics for Medical Treatment Act, which aims to reduce the amount of antibiotics given to farm animals.

Since 2006, the Coalition of Immokalee Workers (CIW), a Floridian farmworker organization, has protested Chipotle’s refusal to sign a Fair Food agreement, which would commit the restaurant chain to pay a penny-per-pound premium on its Florida tomatoes to boost tomato harvesters’ wages, and to only buy Florida tomatoes from growers who comply with the Fair Food Code of Conduct. In 2009, the creators of the documentary film Food, Inc. (along with 31 other leaders in the sustainable food movement) signed an open letter of support for the CIW’s campaign, stating that, "If Chipotle is sincere in its wishes to reform its supply chain, the time has come to work with the Coalition of Immokalee Workers as a true partner in the protection of farmworkers rights." In September 2009, Chipotle announced that it would sidestep partnership with the CIW and instead work directly with East Coast Growers and Packers to increase wages for its tomato pickers. CEO Steve Ells has framed the dispute as a fundamental issue of control, stating that, "the CIW wants us to sign a contract that would let them control Chipotle's decisions regarding food in the future." In October 2012, Chipotle Mexican Grill signed an agreement with the CIW and became the 11th company to join the organization's Fair Food Program.

In January 2015, Chipotle pulled carnitas from its menu in a third of its restaurants; company officials cited animal welfare problems at one of the suppliers, found during a regular audit, as the reason. Subsequently, a false rumor spread online claiming it was done to appease Muslims who consider pork to be unclean, leading to some protests on social media. The company still uses antibiotic-free and hormone-free steak in its restaurants, despite being briefly forced to "serve beef that is not naturally raised" during the summer of 2013, posting an in-store notice each time that occurred. Roberto Ferdman of The Washington Post opined that Chipotle's stated mission to sell "food with integrity" may be "untenable" if meat producers continue to breach Chipotle's ethical standards.

Also in 2015, Chipotle stopped using genetically modified corn and soy beans in their foods, claiming to be the first nationwide restaurant to cook completely GMO free. This was done in response to increasing consumer demand for GMO free products.

Since 2008, a former Kansas State University food safety professor has accused Chipotle of confusing the public by using such terms as "naturally raised meats", "organic ingredients", and "locally sourced" and trying to equate those terms with food safety. In rebuttal, a Chipotle spokesperson told The Daily Beast that "all of our practices have always been very much within industry norms. It's important to note that restaurant practices are regulated by health codes, and restaurants are routinely inspected by health officials. Everything we have done in our supply chain and in our restaurants has been within industry norms." Yet, FiveThirtyEight pointed out that the 2015 norovirus outbreak appears to be unusual and others are criticizing their food sourcing or handling practices. MarketWatch wrote that the result of all of these outbreaks will be to force Chipotle to obtain their produce from larger corporate farms that can afford the more extensive microbial food-safety testing programs and to process vegetables at centralized locations instead of at the individual stores, both of which are industry-standard practices that the company had previously criticized. The New York Times implied that the company's insistence on maintaining its long standing rhetoric about "food integrity" seemed to be quite opposite with the realities of recent current events and made it appear that the management was just ignoring their current problems. It also has been pointed out that Chipotle's current record-keeping system is actually hindering the health authorities' investigation in locating the sources of the various infections.

A writer for the magazine Popular Science pointed out that Chipotle had publicly acknowledged that they "may be at a higher risk for food-borne illness outbreaks than some competitors due to our use of fresh produce and meats rather than frozen, and our reliance on employees cooking with traditional methods rather than automation." Henry I. Miller, a medical researcher and columnist and the founding director of the FDA's Office of Biotechnology, asked: "One wonders whether Chipotle’s "traditional methods" include employees' neglecting to wash their hands before preparing food, which is how norovirus is usually spread. And the fresh versus frozen dichotomy is nothing more than a snow-job. Freezing E. coli-contaminated food does not kill the pathogens; it preserves them." Describing food poisoning outbreaks as "something of a Chipotle trademark; the recent ones are the fourth and fifth this year [2015], one of which was not disclosed to the public", Miller notes that "a particularly worrisome aspect of the company's serial deficiencies is that there have been at least three unrelated pathogens in the outbreaks – Salmonella and E. coli bacteria and norovirus. In other words, there has been more than a single glitch; suppliers and employees have found a variety of ways to contaminate what Chipotle cavalierly sells (at premium prices) to its customers."

A writer for the North Carolina newspaper The News & Observer called Chipotle's "food with integrity" a "lucrative farce" and a "marketing ploy" by pointing out that organic food is "often grown with manure (an 'all-natural' fertilizer), which can certainly increase the risks of accidentally spreading fecal bacteria like E. coli."

In December 2015, Seattle health officials closed a Seattle-area Chipotle for a day after it had repeatedly had small numbers of violations during recent consecutive inspections that previously would not have generated a closure order. On December 10, 2015, CEO Steve Ells released a press statement apologizing for 2015 outbreaks and promised changes to minimize the risks of future outbreaks.

In March and April 2008, the Community Epidemiology Branch of the San Diego County Health and Human Services Agency traced a hepatitis A outbreak in San Diego County to a single Chipotle restaurant located in La Mesa, California in which 22 customers were infected with the virus.

In 2008, Chipotle was implicated in a norovirus outbreak in Kent, Ohio, where over 400 people became ill after eating at a Chipotle restaurant. Officials at the Ohio Department of Health said that the outbreak was caused by Norovirus Genotype G2. Many of the victims were students at Kent State University. The initial source of the outbreak was never found.

In 2009, an investigation by the Minnesota Department of Health traced an outbreak of campylobacteriosis to a Chipotle Mexican Grill in Apple Valley, Minnesota. The investigation found that chicken was sometimes served undercooked by the restaurant and determined that lettuce which had been cross-contaminated with raw or undercooked chicken was the vector for the outbreak.

In early November 2015, The Oregonian reported that there was a little-known E. coli outbreak that had occurred earlier in July in which five people were infected with the O157:H7 strain of E. coli. The outbreak was traced to a single Chipotle location in Seattle and that the incident was not publicized at that time. Seattle public health officials defended their actions at that time by saying that the outbreak was over by the time they made an association with Chipotle. Health officials were unable to trace the source of the July outbreak and said that the cause of the July outbreak is unrelated to the October/November outbreak.

Another norovirus outbreak was confirmed to have occurred in August 2015 at a Simi Valley, California location in which 80 customers and 18 employees reported becoming ill. Ventura County health inspectors found various health violations during two inspections following the outbreak report. Despite those violations, the county health officials did not close the restaurant and allowed it to continue to operate. In a January 2016 article, the New York Times reported that the number of victims involved in the Simi Valley norovirus outbreak was actually 207, twice the number that was reported earlier.

In an unusual move, the U.S. Attorney's Office for the Central District of California in conjunction with the Food and Drug Administration has gotten a federal grand jury to issue a subpoena in January 2016 as part of a criminal investigation seeking documents and information from Chipotle concerning the Simi Valley norovirus outbreak. As of January 2016, it is too early to tell which organization is the actual target of the investigation. In most cases involving norovirus outbreaks that involved a single location, state and/or local authorities are the usual jurisdiction responsible in the investigation and prosecution of those type of cases. However, Ventura County officials had been criticized for their handling of parts of their investigation, and for allowing the restaurant to continue to operate after finding health violations during consecutive inspections.

Less than two weeks later, a federal class action lawsuit was filed in the U.S. District Court for the Central District of California claiming that Chipotle knowingly allowed an ill kitchen manager to work for two days before sending that person home. Then, the restaurant actively deep-cleaned the restaurant to remove all traces of contamination prior to notifying the Ventura County Environmental Health Division of the existing outbreak, hindering their investigation. The lawsuit also claimed that the number of known victims was as high as 234 and estimates that the number of meals that the infected employee may have come in contact with could be as high 3,000.

At almost the same time as the Simi Valley norovirus outbreak, Minnesota health officials confirmed a Salmonella outbreak that affected 17 Minneapolis-area Chipotle restaurants in mid-August 2015. The source of the outbreak was traced back to contaminated tomatoes that were grown in Mexico. The Minnesota Department of Health reported that samples from 45 victims were tested and found that their illness was caused by the Salmonella Newport bacterium as determined by DNA profiling. Later, the state officials reported that the total of persons who became infected was increased to 64 and the number Chipotle locations in which they had acquired the bacterium was increased to 22, all located within the state of Minnesota.

In October 2015, at least 22 persons were reported to have gotten sick after eating at several different Chipotle locations in the states of Washington and Oregon. At that time, an epidemiologist for the Washington Health Department said the culprit appeared to be a Shiga toxin-producing Escherichia coli bacterium, but they were still waiting the outcome of several laboratory tests before they can give a definitive result. As a precaution, Chipotle had closed 43 stores in Washington and Oregon pending the results and recommendations of the involved health authorities. On November 5, the U.S. Centers for Disease Control and Prevention (CDC) had reported that the number of persons reported ill had risen to 40 known cases and that the bacteria samples taken from 7 infected persons in Washington and 3 persons in Oregon states were confirmed to be infected by the same strain of E. coli, the Shiga toxin-producing STEC O26 strain, as determined by DNA profiling. At least 12 persons required hospitalization, but no fatalities. As of November 2015, Health authorities were still trying to trace the exact source of the bacterial contamination, but suspected fresh produce.

On November 12, the CDC increased the number of known cases to 50, the number of persons requiring hospitalization to 14, and the number of DNA fingerprint confirmations to 33. Through a match via Pulsenet, the DNA fingerprint also matched a recent case in Minnesota, but the ill person did not eat at Chipotle. The source of the bacteria infection still had not yet been determined at the time of the report released by the CDC and the CDC is trying to use the more definitive, but more time consuming whole genome sequencing procedure to see if they are able to determine the relationships between all of the STEC O26 cases. In the meantime, Chipotle reopened the closed restaurants on November 11 after disposing all of the food within the closed facilities and deep cleaning those facilities.

On November 20, the CDC reported that the number of STEC O26 cases, as determined by DNA fingerprinting, had increased to 45 with 16 persons requiring hospitalization and the total number states being affected had increased to six. Besides Oregon and Washington, new cases were reported in the states of Minnesota, California, New York, and Ohio. 43 out of 45 of the affected individuals had reported that they had eaten at a Chipotle in the week before they had become sick.

On December 4, the CDC reported that the number of STEC O26 cases, as determined by DNA fingerprinting, had increased to 52 with 20 persons requiring hospitalization and the total number states being affected had increased to nine. New cases were reported in the states of California (1), Illinois (1), Maryland (1), Ohio (2), Pennsylvania (1), and Washington (1).

The price of shares for Chipotle stock dropped a further 12% immediately after the CDC had issued their update on November 20. Share prices had been dropping since the initial announcement of the E. coli outbreak in late October with investors unsure if the drop in share prices just a temporary aberration and that Chipotle management is handling the incident as well as they could. Chipotle has since hired a consultant to improve their food safety program and have their program reviewed by both the CDC and FDA.

On February 1, 2016, the CDC official closed their investigations on the larger E. coli that started in Pacific Northwest in October 2015 and also the smaller outbreak that started in Kansas and Oklahoma in November since no new cases were reported since December 1. In their final report, the CDC stated that 55 persons in 11 states were infected with the same strain of STEC O26 during the major outbreak with 21 of those persons requiring hospitalization. The five persons infected in the later outbreak were made ill by a generically different strain of STEC O26. The CDC also reported that federal and local health and food safety authorities were unable to detect traces of the microorganisms in any of the food samples taken from the suspected restaurants or from their supply chain. The CDC, FDA, and the USDA Food Safety and Inspection Service were unable to determine a point source that was in common in the meals that were consumed by all the victims since some of the restaurants were located far apart and had obtained some of their ingredients from different suppliers while other consumers of the suspected suppliers were not affected.

The Centers for Disease Control and Prevention reported on December 21 that five more people became ill after eating at two Chipotle restaurants located in Kansas and Oklahoma in late November. Preliminary DNA fingerprinting results appear to indicated that the newer cases were caused by a different strain of Shiga toxin-producing E. coli O26. Scientists are waiting for the results of the more definitive whole genome sequencing analyses to determine if the organisms responsible for this outbreak are genetically related to the E. coli that are responsible for causing the outbreak that had started in Oregon and Washington in late October and thus an extension of that outbreak. The agency has not yet determined which food is responsible for the outbreak. The Food and Drug Administration reported that they are trying to determine how the bacteria in these cases, along with the earlier Oregon, Washington, and other multi-state cases, might have been propagated through the food supply chain.

In December 2015, eighty students at Boston College were sickened after eating at a single Chipotle restaurant. Affected students had been tested for both E. coli and norovirus in order to determine the cause of the illnesses. Although it would take as long as two days before the results of more definitive tests became known, public health investigators reported that preliminary tests pointed to the presence of norovirus. The health inspectors for the City of Boston had since closed this particular location on December 7 for a number of health violations that included maintaining meats at a too low of a temperature on the serving line and for allowing a sick employee to work at the time of the inspection.

On December 10, officials from the Boston Public Health Commission reported that tests had identified a single strain of norovirus that is responsible for this particular outbreak. Boston Globe reported on December 10 that 141 persons were reported to have gotten ill and that some of the newer victims had not visited Chipotle before contracting the virus and most likely became infected by being in close proximity to someone who had gotten ill at Chipotle, such as a roommate or dorm-mate. Boston authorities traced the cause of the outbreak to a sick employee who was allowed to work on the day of the outbreak. Chipotle has since fired the employee and also the manager who knowingly allowed the ill worker to complete his shift instead of following health codes.

On February 8, 2016, Chipotle closed all of its eateries nationwide for a few hours during the morning for an all-staff meeting on food safety. The company hired a new head of food safety, who instituted changes including having all employees wash hands every half hour, having two employees verify that produce like onions, jalapeños and avocados have been immersed in hot water for five seconds to kill germs on their exteriors, and using Pascalization to pre-treat food ingredients.

Since the series of food-poisoning outbreaks in 2015 lowered trust in the product, Chipotle has tried to lure back its customers with free food and heavier advertising. Same-store sales increased 17.8% percent in the first quarter of 2017.

Despite corrective actions, the company faced another setback in implementing their safe food policies in July 2017. A norovirus outbreak is being investigated in Virginia. More than 130 people reported having norovirus-like symptoms and two individuals had tested positive for the virus after eating at a Chipotle restaurant in Sterling, Virginia. The Loudoun County Health Department confirmed the illnesses from July 13–16, 2017. Shares of Chipotle's stock stumbled more than 10% on this news and also the news that customers had posted videos of mice skittering through a Chipotle restaurant in Dallas just a few days before the norovirus incident was reported. On July 25, several news agencies reported that Chipotle officials confirmed that the "recent norovirus outbreak in Virginia was the result of lax sick policy enforcement by store managers" and that the company believed that an employee was the cause of the outbreak.

Chipotle had two known incidents in which customer credit card payment information was stolen.

In May 2006, Chipotle filed a report with the U.S. Securities and Exchange Commission that the company may have experience theft of credit and debit card data that might have existed as far back as 1999, when the company first accepted credit and debit cards as payment, until August 2004 when the merchant bank that process their credit and debit card transactions had informed Chipotle of the possible theft of credit and debit card information. Although the Chipotle claimed that there was no proof that theft of credit and debit card information had actually occurred, the results of outside forensic auditing firms concluded that the company's use of flawed card processing software and the use of unsecured internet gateways by some of their computers may have made their information systems at the affected restaurants vulnerable during periods before August 2004. The company spent $5.5 million to settle legal claims, and pay fines and related legal fees. The general public was not informed of the company's data security problems when the company first became aware of the situation.

In April 2017, Chipotle first announced that their point of sale payment system was compromised during a three-week period from late March to mid-April but gave very little information about the incident. The following month, the company later revealed that 2,250 restaurants in 47 states were involved which could potentially affect hundreds of thousands of customers who may had their credit or debit card account information with security codes stolen. A few restaurants in Canada was also affected. Some security experts criticized the way Chipotle had downplayed the incident. During the same month, a credit union in New Hampshire filed a class action lawsuit on the behalf of banks and credit unions against Chipotle for failure to provide elementary credit card data security in the most recent data breach after a similar data breach that had occurred in 2004. In July 2017, Gainesville, Florida, police reported that an unidentified person took more than $17,000 from a ATM at a local credit union by stealing from 40 different accounts that can be traced directly to the data breach.

In November 2016, three men filed a class-action lawsuit against Chipotle alleging that a burrito was listed as containing only 300 calories, when in fact it contained more. They are seeking "unspecified damages and for an injunction against the company to prevent it from posting what it calls misleading information on its food."

In the past, Chipotle mainly relied on billboards, radio ads, and word of mouth to advertise. In 2012, Chipotle aired its first nationally televised commercial during the 54th Annual Grammy Awards ceremony. In 2010, the company initiated an ad campaign that mocks advice given to Chipotle by advertising agencies. Chipotle has run many promotions giving out free food to potential customers, especially when opening a new store. Stores also give out free burritos on certain holidays; for instance, on Halloween, some locations have had promotions in which free burritos are given to people who come dressed as a burrito. Chipotle gave away free burritos to reporters during the 1997 trial of Timothy McVeigh, which took place in Chipotle's hometown of Denver. In addition, stores offered free burritos to those displaced by Hurricane Katrina. Chipotle received attention when Ozzy Osbourne's reality show The Osbournes featured the company's burritos heavily. For Halloween 2010, Chipotle announced that customers dressed as a processed food product would receive a burrito for $2. The event was part of a $1 million fundraiser for Jamie Oliver's Food Revolution called "Boorito 2010: The Horrors of Processed Food." For "Boorito 2011", customers dressed in costumes "inspired by family farms" will receive a menu item for $2, with proceeds from the promotion going to The Chipotle Cultivate Foundation and Farm Aid. The promotion is aimed to increase awareness of family farms. Also in support of family farms, Chipotle released music videos of Karen O of the Yeah Yeah Yeahs and Willie Nelson. On September 12, 2013, Chipotle released an animated short called The Scarecrow, with a companion mobile video game; both feature a narrative heavily critical of industrial farming, but little in the way of direct marketing for the chain. The short features a cover of "Pure Imagination" from Willy Wonka & the Chocolate Factory, sung by Fiona Apple. It was named one of the worst advertisements of 2013 by The Wall Street Journal.

In 2011, Chipotle created the "Farm Team", which is a rewards program available only by invitation from restaurant managers. The Farm Team members have access to a special Chipotle website, where members can earn rewards, i.e. free food and T-shirts. The site offers members to, "learn where Chipotle’s food comes from, take quizzes and polls, play games and watch videos about the company". In April 2014, the Farm Team program was shut down.

Chipotle sponsors Team Garmin-Barracuda (formerly Team Garmin-Chipotle, Team Garmin-Slipstream, Team Garmin-Transitions and Team Garmin-Cervélo) of the International Cycling Union, and is an official team partner of the Boston Celtics, and the Boston Bruins. In June 2009, Chipotle sponsored free screenings of Food, Inc., a film that criticizes the corporate food industry. Founder Steve Ells stated that he hoped the film would make customers appreciate Chipotle's Food With Integrity policy. From May until September 2009, Chipotle ran a contest on mychipotle.com, a microsite which had a competition for the best user-created audio and video presentations about different combinations of ingredients. In July 2010, Chipotle began a campaign to support healthier lunch alternatives for students, in which money will be donated to The Lunch Box program based on how many spam E-mails consumers forward to a company E-mail address. For Chipotle's 18 year anniversary, the company began wrapping its burritos in gold foil as part of a larger promotion to draw attention to its Food With Integrity mantra. Also as part of the gold foil campaign, Chipotle is offering prizes for customer-created pictures of items wrapped in gold foil. Chipotle hired comedian Amy Sedaris to create a comedic how-to video on wrapping with gold foil, and spread the video using Twitter. In March 2013, Chipotle pulled its sponsorship of a Boy Scouts of America event, citing that organization's ban on LGBT members.

On December 16, 2015, Chipotle ran full page ads in both The Boston Globe and Boston Herald apologizing for the recent norovirus outbreak linked to Chipotle's Cleveland Circle location. The ad, containing a letter by Chipotle founder and co-CEO Steve Ells, affirmed the company's commitment to food safety.

On March 14, 2016, a National Labor Relations Board (NLRB) administrative law judge concluded that Chipotle’s social media policy, and more specifically its application towards an employee who posted tweets regarding wages and working conditions, violated the National Labor Relations Act (NLRA). A former Chipotle employee in Havertown, Pennsylvania, wrote a series of tweets from his personal account about hourly workers being required to work on snow days. Chipotle instructed the employee to delete the tweets. The NLRB judge determined that Chipotle’s request to delete the tweets violated the NLRA even though the employee was not disciplined as a result of his tweets.

Architecturally, all Chipotle restaurants are built using most of the same materials (plywood, corrugated metal, stainless steel, exposed ductwork), although each store is unique. The interiors have been described as having an "industrial, sheet metal look". Chipotle has built restaurants using white ceramic tile instead of stainless steel. It costs the company approximately $850,000 to open a new restaurant. When the first Chipotle opened, Steve Ells asked his friend, sculptor Bruce Gueswel, to design the chairs and a styled Mayan king whose face was loosely based on that of civil rights leader Martin Luther King, Jr., a personal inspiration of Gueswel, for the restaurant. Both items were made from wood and metal. Gueswel has continued to design and build the art and chairs for all subsequent Chipotle restaurants.

Most Chipotle locations display a photograph of the original restaurant, which is near the University of Denver campus on Evans Avenue. Instead of a photograph of itself, the original location has a photograph of the Dolly Madison Ice Cream that previously occupied the location. In 2010, Chipotle began opening "A Model" restaurants, which are smaller concept locations, citing the lower costs of development and occupancy. Chipotle uses environmentally friendly packaging, with bowls made from recycled newsprint, unbleached tray liners, and napkins and cups made from postconsumer waste.

Chipotle's architectural design team incorporates the principles of sustainable architecture in their projects. The "green" restaurant in Gurnee, Illinois features an on-site six kilowatt wind turbine, which generates about 10% of the restaurant's electrical needs. The Gurnee restaurant has received Platinum level LEED certification from U.S. Green Building Council. A restaurant in Tulsa, Oklahoma, uses recycled drywall, low-VOC paint, and energy-efficient appliances. A Chipotle restaurant in Austin, Texas was the first to receive a four-star rating from the city's Green Building Program. Additionally, Chipotle has made arrangements to add solar panels to 75 of its restaurants. Chipotle has contracted to clean its stores in New York City and Long Island, with "plant-based, environmentally preferable cleaning supplies and technologies." The cleansers are readily biodegradable and non-toxic to humans or aquatic life.

Chipotle was the defendant in a lawsuit for failure to comply with the Americans with Disabilities Act (ADA). Maurizio Antoninetti, a customer who used a wheelchair, claimed he was denied the "Chipotle Experience", because he was unable to see the food preparation. The case against the company was upheld in the United States Court of Appeals for the Ninth Circuit, and the Supreme Court of the United States declined to hear Chipotle's appeal, leaving the Ninth Circuit's ruling intact. Chipotle has "an official disability policy of bringing ingredients to the tables of diners with disabilities and doing tableside preparation." Chipotle is retrofitting restaurants affected by the ruling, replacing the walls in front of the food preparation area with lower ones or transparent panels. They are incorporating the new design elements into new restaurants. The case was one of over twenty ADA-related lawsuits filed by Antoninetti, who died in 2011.