The California Privacy Protection Agency (“CPPA”) entered into its largest settlement to date—a $1.35 million penalty against Tractor Supply Co. for multiple violations of the California Consumer Privacy Act (“CCPA”).[1] This enforcement action sends a clear message: California is serious about privacy compliance, and businesses of all sizes need to pay attention.
Anatomy of the Violations
The CPPA’s enforcement was not triggered by a catastrophic data breach, but by foundational compliance failures that could exist within any organization:
- Inadequate Privacy Disclosures: The company failed to provide compliant privacy policies for consumers and, notably, for job applicants. This marks the first CCPA enforcement action to specifically address applicant data, a crucial reminder that California’s privacy law extends to HR and recruitment functions.
- Deficient Vendor Contracts: Tractor Supply shared personal information with third parties, such as ad-tech companies, without data processing agreements that sufficiently limited the use of that data to specified business purposes.
- Non-Functional Opt-Outs: The company’s website featured an opt-out form that did not actually prevent the sharing of consumer data, creating a misleading impression of user control.
- Failure to Honor Global Privacy Controls: The retailer did not recognize or process universal opt-out preference signals (like the Global Privacy Control or “GPC”), a mandatory requirement for businesses that “share” personal information for cross-context behavioral advertising.[1, 2]
The CPPA’s Remediation Demands: A Blueprint for Compliance
Beyond the monetary penalty, the settlement’s injunctive terms provide a clear roadmap for what the CPPA considers a reasonable compliance program. For the next five years, Tractor Supply is required to implement and maintain robust oversight, including:
- Quarterly Website Scans to identify and inventory all tracking technologies.
- Annual Audits of third parties with whom it shares personal data.
- Public Reporting of metrics related to consumer privacy requests.
- Annual Certifications to the CPPA confirming its adherence to the settlement terms.
These long-term monitoring and reporting requirements signal that the CPPA expects companies not only to implement privacy controls but also to continuously validate and document their effectiveness. [2]
Imperatives for CCPA Compliance
In light of this enforcement action, all businesses with a California nexus should continue to review their privacy programs for compliance with the CCPA. The focus should be on demonstrating mature, operationalized compliance:
- Review and Broaden Privacy Disclosures: Your privacy program must account for all categories of California individuals, including consumers, employees, and job applicants. HR and legal departments should collaborate to ensure recruitment and employment-related data practices are fully disclosed.
- Scrutinize Data Processing and Vendor Contracts: Ensure all contracts with service providers and third parties who handle personal information contain robust data processing addenda that meet the CCPA’s specific requirements.
- Operationalize Consumer Rights and Opt-Outs: Privacy choices must be functional, not just cosmetic. Regularly test your website’s opt-out mechanisms, including the processing of GPC signals, to ensure they work as intended. This is a technical requirement that could involve coordination between legal, marketing, and IT teams.
- Establish a Demonstrable Compliance Record: Maintain records of privacy activities, including data inventories, consumer requests and responses, and vendor due diligence, to prove that your compliance program is not just on paper, but in practice.
The Bottom Line
The Tractor Supply settlement demonstrates the CPPA’s commitment to enforcing all aspects of the CCPA, with Enforcement Chief Michael Macko vowing to “look broadly across industries to identify violations.”[1] The agency is focused on the foundational pillars of privacy governance: transparent notices, robust contracts, and functional user controls. Proactive investment in operationalizing these core requirements is no longer just best practice—it is an essential risk mitigation strategy.
Navigating these compliance requirements can be complex; please feel free to reach out to Mark Williams to discuss best practices and compliance strategies.
[1] California Privacy Protection Agency, “CPPA Announces $1.35 Million Settlement with Tractor Supply Co.,” September 30, 2025, https://cppa.ca.gov/announcements/2025/20250930.html.
[2] California Privacy Protection Agency, “Statement of Facts and Order,” September 30, 2025, https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf
