Penalty Amount
$1,350,000
The California Privacy Protection Agency (CPPA) settled with Tractor Supply Company for $1.35 million over violations of the California Consumer Privacy Act (CCPA). The violations included failing to maintain a proper privacy policy, not notifying job applicants of their rights, lacking an effective opt-out mechanism, and sharing personal information without adequate contracts. Tractor Supply must pay the fine and implement remedial measures such as scanning digital properties and annual compliance certification.
Tractor Supply must pay a $1.35 million fine, scan its digital properties to inventory tracking technologies, and have a corporate officer certify compliance annually for four years.
In-house legal teams should review vendor agreements for data sharing clauses to ensure they include robust data processing addendums (DPAs) with privacy protections. Customer-facing agreements and website terms of service must be audited for compliant privacy policies and effective opt-out mechanisms, including compatibility with Global Privacy Control (GPC). Employment and contractor agreements, as well as job application processes, require updates to include clear privacy notices and rights information for applicants. All contracts should be assessed for alignment with CCPA's requirements on data minimization, purpose limitation, and consumer rights, with necessary amendments to incorporate consent management, data retention schedules, and breach notification protocols.
Entity
Tractor Supply Company
Also known as: Tractor Supply
Industry
RetailOfficial Press Release
https://privacy.ca.gov/2025/09/nations-largest-rural-lifestyle-retailer-to-pay-1-35m-over-ccpa-violations/
20250930 tractor supply bd sfo
https://privacy.ca.gov/wp-content/uploads/sites/357/2026/01/20250930_tractor_supply_bd_sfo.pdf
California Privacy Protection Agency Enforcement Page
https://cppa.ca.gov/enforcement/
The California Privacy Protection Agency (CPPA) filed a petition in Superior Court to enforce a subpoena against Tractor Supply Company for alleged CCPA violations, including failure to honor consumers' right to opt-out of the sale and sharing of personal information. This is the CPPA's first judicial action to enforce an investigative subpoena, and the agency is seeking court assistance to compel the company's compliance.
The California Privacy Protection Agency announced that over 300,000 Californians have signed up for the Delete Request and Opt-out Platform (DROP) since its launch five months ago. The Data Broker Registry now includes 581 registered data brokers, the highest number since the registry was established in 2020. Beginning August 1, 2026, all data brokers will be required to access DROP and process deletion requests.
The California Privacy Protection Agency launched a statewide roadshow to promote its Delete Request and Opt-out Platform (DROP), which allows California residents to request deletion of their personal information from all registered data brokers in a single request. The roadshow aims to increase awareness of data privacy rights and the DROP tool, which data brokers are legally required to process starting August 1, 2026.
$376K
The California Privacy Protection Agency settled with Ford Motor Company for $375,703 after finding that Ford violated the CCPA by requiring email verification for opt-out requests, creating unnecessary friction. Ford must implement easier opt-out methods, conduct a website audit, and comply with global privacy controls.
$1.1M
The California Privacy Protection Agency settled with PlayOn Sports for $1.10 million over CCPA violations, including failing to provide adequate opt-out mechanisms and improperly tracking users, particularly students. The company must implement proper opt-out methods, improve disclosures, and comply with children's data consent requirements.
The California Privacy Protection Agency (CalPrivacy) announced the appointment of Sabrina Boyson Ross as its first Chief Privacy Auditor and the formation of a new Audits Division. The division will conduct regulatory examinations of businesses to determine compliance with the California Consumer Privacy Act, and its findings may lead to enforcement referrals.