The California Privacy Protection Agency Board has issued a decision requiring Tractor Supply Company, the nation’s largest rural lifestyle retailer with more than 2,500 stores in 49 states, to change its business practices and pay a $1.35 million fine to resolve claims that the company violated the California Consumer Privacy Act.
The fine is the largest in the CPPA’s history, and the decision is the first to address the importance of CCPA privacy notices and privacy rights of job applicants.
The CPPA opened an investigation into Tractor Supply’s privacy practices after receiving a complaint from a consumer in Placerville, California.
According to the Board’s decision, Tractor Supply violated Californians’ privacy rights by:
• Failing to maintain a privacy policy that notified consumers of their rights;
• Failing to notify California job applicants of their privacy rights and how to exercise them;
• Failing to provide consumers with an effective mechanism to opt-out of the selling and sharing of their personal information, including through opt-out preference signals such as Global Privacy Control; and
• Disclosing personal information to other companies without entering into contracts that contain privacy protections.
To resolve the allegations, Tractor Supply agreed to pay $1,35 million implement broad remedial measures, such as scanning its digital properties to inventory tracking technologies and require a corporate officer or director to certify compliance annually for the next four years.
The board’s decision underscores the need for businesses to review their privacy notices and opt-out mechanisms, as well as the need for businesses to protect the privacy of their job applicants, not just their customers. Since 2023, job applicants, employees, and independent contractors have been afforded greater privacy protections.
“We will continue to look broadly across industries to identify violations of California’s privacy law,” said Michael Macko, the Agency’s head of enforcement. “We made it an enforcement priority to investigate whether businesses are properly implementing privacy rights, and this action underscores our ongoing commitment to doing that for consumers and job applicants alike.”
“California’s privacy rights protect everyone in the state, from the Central Valley to the Silicon Valley,” said Tom Kemp, the CPPA’s Executive Director. “We appreciate the members of the public who help us uphold these rights by submitting complaints to the CPPA.”
The board’s decision follows on the heels of a separate court case brought against Tractor Supply last month to enforce an investigative subpoena. With today’s resolution, the CPPA’s Enforcement Division will be discontinuing that litigation.
The CPPA’s recent enforcement actions to protect Californians
The CPPA continues to actively enforce California’s cutting-edge privacy laws. Recent actions include:
• Issuing a decision requiring clothing retailer Todd Snyder to change its business practices and pay a $345,178 fine for CCPA violations.
• Issuing a decision requiring American Honda Motor Co. to change its business practices and pay a $632,500 fine for CCPA violations.
• Securing a settlement agreement requiring data broker Background Alert — which promoted its ability to dig up “scary” amounts of information about people — to shut down or pay a steep fine.
• Launching the bipartisan Consortium of Privacy Regulators to collaborate with states across the country to implement and enforce privacy laws nationwide.
• Partnering with the data protection authorities in Korea, France, and the United Kingdom to share information and advance privacy protections for Californians.
• In addition, the agency has secured more than half a dozen successful enforcement actions against unregistered data brokers following an investigative sweep launched late last year to assess compliance with the Delete Act.
About The California Privacy Protection Agency
The California Privacy Protection Agency is committed to promoting the education and awareness of consumers’ privacy rights and businesses’ responsibilities under the California Consumer Privacy Act.
Individuals can visit privacy.ca.gov to access helpful and up-to-date information on how to exercise their rights and protect their personal information. In addition, the Agency’s website provides important information about CPPA board meetings, announcements, and the rulemaking process