The California Privacy Protection Agency (“CPPA”) Board recently reached a $1.35 million settlement with Tractor Supply Company, a company that describes itself as the nation’s largest rural lifestyle retailer, to resolve allegations that it violated the California Consumer Privacy Act (“CCPA”) between January 1, 2023 and July 1, 2024. The Agency announced that this is the largest fine in the CPPA’s history and is the Agency’s first decision that addresses company privacy notices and the privacy rights of job applicants. According to the Agency, it launched an investigation into Tractor Supply’s privacy practices after a California consumer filed a complaint with the CPPA. Agency investigators determined that Tractor Supply’s privacy policy violated the CCPA by failing to notify California consumers and job applicants of their privacy rights; failing to provide California consumers with methods that effectively enabled them opt-out of the selling and sharing of their personal information; and by sharing personal information with service providers, contractors and other third parties pursuant to contracts that lacked proper privacy protections.
According to the Agency, investigators discovered, among other things, that the “Do Not Sell My Personal Information” link on Tractor Supply’s website directed consumers to a webform that gave the impression that consumers could submit the form in order to opt-out of the selling and sharing of their personal information. However, Tractor Supply allegedly continued to collect personal information from consumers who submitted the form using third-party tracking technologies and collected information that the company ultimately used for advertising purposes. Tractor Supply was also accused of failing to inform consumers how they could opt-out of sharing their information with the third-party tracking technologies. In addition, Tractor Supply’s contracts with third-parties who received consumers’ personal information allegedly failed to include certain privacy protections, including clauses that required the companies to comply with the CCPA and that specified the limited purposes for which the personal information would be used, as the CCPA required.
In addition to the payment of a $1.35 million administrative fine, Tractor Supply agreed to implement broad remedial measures to ensure that its privacy policy complied with the CCPA. The changes include modifications to Tractor Supply’s opt-out procedures that would enable consumers to reject the company’s use of tracking technologies and updated CCPA training for all personnel who handle CCPA requests. In addition, for a period of four years, Tractor Supply is required each year to provide the Agency with written certification that the company is in compliance with the provisions in the Stipulated Final Order.
CPPA Announcement | Order of Decision and Stipulated Final Order