The California Privacy Protection Agency (CPPA) has levied a record-breaking $1,350,000 fine against Tractor Supply Company, the nation’s largest rural lifestyle retailer, for violating the California Consumer Privacy Act (CCPA). This landmark decision, the largest in the CPPA’s history, also marks the first time the agency has addressed the critical importance of CCPA privacy notices and the privacy rights afforded to job applicants. The ruling mandates significant changes to Tractor Supply’s business practices and underscores a broader commitment by the CPPA to enforce comprehensive privacy protections for all Californians.
Tractor Supply’s CCPA Violations
The CPPA’s investigation into Tractor Supply was initiated following a consumer complaint from Placerville, California. The agency found that Tractor Supply had infringed upon Californians’ privacy rights through several key violations. These included:
- Inadequate Privacy Policy: The company failed to maintain a privacy policy that adequately notified consumers of their rights under the CCPA.
- Lack of Transparency for Job Applicants: Tractor Supply neglected to inform California job applicants about their privacy rights and the procedures for exercising them.
- Ineffective Opt-Out Mechanisms: The retailer did not provide consumers with effective ways to opt out of the selling and sharing of their personal information, including support for opt-out preference signals like the Global Privacy Control.
- Contractual Deficiencies in Data Disclosure: Tractor Supply disclosed personal information to third-party companies without first establishing contracts that included robust privacy protections.
Resolution and Remedial Measures
To settle these allegations, Tractor Supply has agreed to pay the substantial $1,350,000 fine. In addition to the financial penalty, the company is required to implement broad remedial measures. These actions include systematically scanning its digital properties to identify and inventory tracking technologies and having a corporate officer or director certify compliance with privacy regulations annually for the next four years.
Emphasis on Job Applicant Privacy
The CPPA Board’s decision highlights a critical aspect of the CCPA: the privacy rights of job applicants, employees, and independent contractors. Since 2023, these individuals have been granted enhanced privacy protections, a fact that businesses must now actively recognize and address. Michael Macko, the Agency’s head of enforcement, emphasized this point, stating, “We will continue to look broadly across industries to identify violations of California’s privacy law. We made it an enforcement priority to investigate whether businesses are properly implementing privacy rights, and this action underscores our ongoing commitment to doing that for consumers and job applicants alike.”
Broader Enforcement Efforts
This enforcement action against Tractor Supply is part of the CPPA’s ongoing commitment to protecting Californians’ privacy. The agency is actively pursuing other cases, including a recent court case to enforce an investigative subpoena against Tractor Supply itself. The CPPA has also secured numerous successful enforcement actions against unregistered data brokers following a sweep launched to assess compliance with the Delete Act.
Tom Kemp, the CPPA’s Executive Director, noted the statewide reach of these privacy rights: “California’s privacy rights protect everyone in the state, from the Central Valley to the Silicon Valley. We appreciate the members of the public who help us uphold these rights by submitting complaints to the CPPA.”
Individuals seeking more information on their privacy rights and how to exercise them can visit privacy.ca.gov. The CPPA’s own website provides details on board meetings, announcements, and the rulemaking process.
References
- California Privacy Protection Agency. (n.d.). Tractor Supply Company Board Decision. Retrieved from pdf/20250930_tractor_supply_bd_sfo.pdf.
- California Privacy Protection Agency. (2025, August 6). CPPA Enforces Investigative Subpoena Against Tractor Supply Company. announcements/2025/20250806.html.
- California Privacy Protection Agency. (2025, July 29). CPPA Secures Enforcement Actions Against Unregistered Data Brokers. announcements/2025/20250729.html.
- California Privacy Protection Agency. (2025, January 29). CPPA Launches Sweep to Assess Data Broker Compliance with Delete Act. announcements/2025/20250129.html.
- California Privacy Protection Agency. (n.d.). Home Page. privacy.ca.gov.