Overview

• California’s privacy regulator finalized a $1.35 million settlement on Sept. 30 with Tractor Supply after an investigation sparked by a single consumer complaint and escalated through subpoena enforcement.
• The order faults the company for outdated privacy notices, missing job‑applicant disclosures, failures to honor opt‑outs and Global Privacy Control signals, and gaps in vendor and ad‑tech contracts.
• Remedies require quarterly scans of websites and apps, improved cookie banners and preference centers, retraining staff, and officer‑level compliance certifications for four years.
• Tractor Supply must remediate contracts by March 31, 2026, run a five‑year program to assess opt‑out effectiveness, and post required privacy metrics for five years.
• As part of the settlement, the company acknowledged the CPPA’s broad authority to investigate conduct predating 2023, reinforcing the agency’s expansive investigatory reach.