Privacy notices, job applicant rights, opt-out, vendor contracts
Tractor Supply, the nation’s largest rural lifestyle retailer with more than 2,500 stores across 49 states, failed to maintain a privacy policy disclosing consumer rights, failed to provide job applicants with notice of their privacy rights, did not offer an effective opt-out mechanism (including failure to honor opt-out preference signals such as the Global Privacy Control), and disclosed personal information to third parties without the required contractual privacy protections in place. The settlement requires a corporate officer or director to certify compliance annually for four years and mandates a full scan of digital properties to inventory tracking technologies. A parallel subpoena enforcement action in court was dismissed upon resolution.
At the time of issuance, the largest fine in CPPA history. The case originated from a consumer complaint filed in Placerville, California. First CPPA decision to address privacy notice adequacy and the privacy rights of job applicants under the CCPA, which has covered applicants, employees, and independent contractors since 2023.