Rural lifestyle giant Tractor Supply Co. has been ordered to pay a $1.35 million penalty and revamp its privacy practices after California regulators accused the retailer of failing to properly safeguard consumer and job applicant data. The fine, announced Tuesday, is the largest in the California Privacy Protection Agency’s (CPPA) history, underscoring the state’s hardening stance on corporate accountability.

Regulator’s Hard Line on Privacy

The CPPA said Tractor Supply fell short of the California Consumer Privacy Act (CCPA) by not adequately informing customers and job applicants of their privacy rights, neglecting to ensure service providers protected personal data, and failing to offer consumers a clear way to stop the sale or sharing of their information.

“This action underscores our ongoing commitment to ensuring consumers and job applicants alike can exercise their privacy rights,” said Michael Macko, the agency’s head of enforcement.

From Complaint to Courtroom

The saga began when a consumer complaint in Placerville triggered a CPPA investigation in early 2023. By August, the regulator had taken the unusual step of publicly disclosing its probe and petitioned a Sacramento court to force the retailer to comply with subpoenas covering practices dating back to 2020.

Tractor Supply pushed back, arguing that reviewing five years of privacy practices was overly burdensome and outside the agency’s authority before its first regulations took effect in 2023.

Largest Fine Yet

The resolution announced Tuesday requires Tractor Supply to pay the fine within 30 days and adopt sweeping remedial measures, including quarterly scans of digital platforms, streamlined opt-out processes, and enhanced training for employees handling consumer data. The company must also update contracts with service providers and certify compliance annually for four years.

Although Tractor Supply has already overhauled many of its practices since 2024, the CPPA insisted the company take further steps to protect both consumers and job applicants.

A Pattern of Enforcement

Since its launch in late 2020, the CPPA has ramped up enforcement of California’s cutting-edge privacy laws. In recent months, it fined Honda $632,500 and Todd Snyder Inc. $345,000 for privacy violations. Tractor Supply’s penalty, however, stands as the agency’s most aggressive move yet—a warning shot to businesses nationwide that California will police consumer data with the precision of a hawk circling its prey.

Tractor Supply is represented by Greenberg Traurig LLP, while the CPPA’s legal team includes Michael S. Macko, Lara Kehoe Hoffman, Michael J. Meyer, and Alex D. Berger.