Tractor Supply pushed back, arguing that reviewing five years of privacy practices was overly burdensome and outside the agency’s authority before its first regulations took effect in 2023.
Largest Fine Yet
The resolution announced Tuesday requires Tractor Supply to pay the fine within 30 days and adopt sweeping remedial measures, including quarterly scans of digital platforms, streamlined opt-out processes, and enhanced training for employees handling consumer data. The company must also update contracts with service providers and certify compliance annually for four years.
Although Tractor Supply has already overhauled many of its practices since 2024, the CPPA insisted the company take further steps to protect both consumers and job applicants.
A Pattern of Enforcement
Since its launch in late 2020, the CPPA has ramped up enforcement of California’s cutting-edge privacy laws. In recent months, it fined Honda $632,500 and Todd Snyder Inc. $345,000 for privacy violations. Tractor Supply’s penalty, however, stands as the agency’s most aggressive move yet—a warning shot to businesses nationwide that California will police consumer data with the precision of a hawk circling its prey.
