Overview
- The stipulated order follows an investigation into practices from January 2023 through July 2024 that the agency said violated California privacy law.
- Regulators found ineffective opt‑out tools, failure to process Global Privacy Control signals, deficient privacy notices including for job applicants, and noncompliant service‑provider contracts.
- Tractor Supply agreed to technical and governance fixes including GPC recognition, quarterly scans of digital properties, contract remediation, employee training, officer certifications, and public reporting of privacy metrics.
- The case began with a consumer complaint from Placerville and included a court‑enforced subpoena that affirmed the agency’s broad authority to review records, including pre‑2023 practices.
- CPPA officials characterized the penalty as the agency’s largest to date and signaled ongoing, cross‑industry enforcement with numerous active investigations.