On September 30, 2025, the California Privacy Protection Agency (“Agency”) announced a decision and $1.35 million fine to resolve allegations that Tractor Supply Co. (“Tractor Supply”) violated the California Consumer Privacy Act (“CCPA”). The settlement comes after the Agency filed a petition to enforce an investigative subpoena against Tractor Supply. In addition to imposing the Agency’s largest fine to date, the settlement also marks the Agency’s first enforcement action related to job applicant personal data. Similar to the enforcement actions against American Honda Motor Co., Inc. and Todd Snyder, Inc., the Agency continues to focus on how businesses facilitate consumer rights under the CCPA.

The decision outlines Tractor Supply’s alleged violations of the CCPA, including the following:

• Job Applicant Privacy Rights: The Agency alleged that the privacy policy provided by Tractor Supply to California job applicants failed to inform those applicants of their CCPA rights and how to exercise them.
• Consumer Privacy Policy Contents & Updates: The Agency also alleged that Tractor Supply’s privacy policy provided none of the disclosures required under the CCPA and had not been updated annually as required by law. In particular, the Agency alleged that Tractor Supply failed to explain in its privacy policy how an opt-out preference signal would be processed.
• Sale/Share Opt-Out Requests: Tractor Supply uses cookies and other tracking technologies that the agency alleged resulted in the sale/sharing of personal information. In particular, the Agency alleged that Tractor Supply failed to opt consumers out of third-party tracking technologies that Tractor Supply used for advertising.  
• Service Provider & Third-Party Contracts: The Agency alleged that Tractor Supply’s contracts with service providers and third parties failed to contain provisions required by the CCPA regulations.

As part of the settlement, Tractor Supply agreed to prescriptive remedial measures. These include, among others, reforming its opt-out practices, notifying all employees and job applicants about its updated Privacy Policy by email, and modifying contractor processes and confirming in writing to the Enforcement Division that all required contractual terms are in place “with all external recipients of personal information.” Tractor Supply must also implement programs to assess and monitor opt-out rights and third parties who collect personal information through tracking technologies for the next four years, as well as submit an annual, written certification of compliance with this decision for the next four years.