Run a free scan

Tractor Supply: a Do Not Sell form must switch off the trackers, and you need an inventory to know which

Check what your "Do Not Sell" form actually changes. At Tractor Supply, the CPPA found, it filed a request while the advertising cookies kept running, and the fix the agency ordered starts with a quarterly scan of every tracker on the site.

California Privacy Protection Agency · CCPA · Board decision 26 September 2025

The problem

Tractor Supply’s footer link "Do Not Sell My Personal Information" led to a webform. The order finds that completing it "did not opt-out consumers from the third-party tracking technologies" used for advertising, which kept sharing cookie IDs and IP addresses. The site ignored Global Privacy Control until July 2024, and job applicants were told nothing about their CCPA rights (Order, ¶¶ 35–45, 57–60).

Case record

Regulator
California Privacy Protection Agency; decision by its Board, Chair Jennifer M. Urban ([Order, p. 1](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf))
Case number
ENF24-M-TR-04
Parties
CPPA Enforcement Division v. Tractor Supply Company
Counsel
CPPA Enforcement Division; Greenberg Traurig, LLP for Tractor Supply ([Order, pp. 15–16](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf))
Laws
CCPA; CCPA regulations (11 CCR)
Stage
Stipulated final order adopted by the Board, 26 September 2025; review waived ([¶ 86](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf))
Amount
USD 1,350,000 administrative fine ([¶ 65](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf))
Source review
17 October 2026

The order sets out factual findings that Tractor Supply violated the CCPA, and Tractor Supply agreed to it. Unlike the Honda and Todd Snyder orders, it has no clause limiting what the company admits. The order also credits Tractor Supply’s remediation since 2024 (¶ 66).

What the regulator found

What the regulator found
PracticeWhat the law requiresWhat the order describesSource
Webform did not stop trackingStop selling and sharing once a consumer opts out (Civ. Code §§ 1798.120(d), 1798.135(a)(1))Consumers submitted "Do not sell my information" requests, and Tractor Supply "continued to sell or share their personal information through third party tracking technologies"[¶¶ 35–41](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf)
GPC ignoredTreat an opt-out preference signal as an opt-out (11 CCR §§ 7025, 7026)Site not configured to honour the signal until July 2024; privacy policy did not explain how signals are processed[¶¶ 42–46](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf)
ContractsRequired terms with service providers and third parties (11 CCR §§ 7051, 7053)Some contracts, including with ad-tech companies, lacked terms from a nine-item list, among them a duty to honour forwarded opt-outs[¶¶ 47–51](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf)
Privacy policyDescribe rights and practices; update annually (11 CCR § 7011; Civ. Code § 1798.130(a)(5))Policy posted in September 2018, updated November 2021, then not again until after the investigation began[¶¶ 52–56](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf)
Job applicantsNotice of CCPA rights from 1 January 2023 (Civ. Code § 1798.145(m))The careers pop-up listed data collected but no rights or how to use them[¶¶ 57–60](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf)

What the order requires

Paragraphs are from the stipulated final order.

  • Quarterly tracker scan. "At least quarterly, scan its digital properties and maintain a full and current inventory of tracking technologies", recording for each whether it sells or shares and whether a CCPA-compliant contract supports it (¶ 68(a)–(b)).
  • GPC. Configure each property so that ad trackers "give full effect" to opt-out preference signals, and apply GPC to known consumers (¶ 68(c), (d)(2)).
  • A working opt-out. Honour signals "in a frictionless manner" or offer a "Do Not Sell or Share" link that stops "all selling and sharing" (¶ 68(d)(1)).
  • Equal buttons. In both the tracking management platform and the pop-up banner, the reject button must be "a similar size and design as any button accepting" (¶ 69).
  • Paperwork. Review the privacy policy, email employees and applicants about updated policies, train staff, and confirm contract terms by 31 March 2026 (¶¶ 70–73).
  • Four years of oversight. An officer or director certifies compliance every 31 March from 2026 for four years (¶ 75); an opt-out monitoring programme and an annual tracker-recipient review with reports run for four years (¶¶ 76–77); request metrics are posted for five years (¶ 74).

Technical issue

  • Tools or vendors: cookies and similar tracking technologies for advertising; a tracking management platform and banner; vendors not named (¶¶ 35, 69).
  • Where: the website and app; the careers page.
  • What data: cookie identifiers, IP addresses and other unique identifiers (¶ 35).
  • When: relevant period 1 January 2023 to 1 July 2024 (¶ 31), including after submitted opt-outs.
  • How it came to light: a complaint from a consumer in Placerville, California, in 2024 (¶ 30). The CPPA also went to court in August 2025 to enforce an investigative subpoena, which it agreed to drop (¶ 81).

Inth’s technical interpretation: the privacy request system and the tag stack were not connected. The form fed a request queue; nothing in the browser learned that this visitor had opted out, so the advertising tags ran as before. The fix is to make the form set the same opt-out state that GPC sets, and to know which tags that state must stop, which is why the order begins with an inventory.

Illustrative pattern, not the defendant’s code.

// Bad: "Do not sell" becomes a ticket; the ad tags never hear about it
app.post("/privacy/request", async (req, res) => {
  await tickets.create({ type: req.body.type, email: req.body.email });
  res.render("thanks");
});

Illustrative pattern, not the defendant’s code.

// Fixed: the form sets the same opt-out state the tag loader reads for GPC
app.post("/privacy/request", async (req, res) => {
  if (req.body.type === "do_not_sell") {
    await optOuts.record({ email: req.body.email, source: "webform" });
    res.cookie("us_opt_out", "1", { maxAge: 400 * 24 * 3600 * 1000, sameSite: "lax" });
  }
  await tickets.create({ type: req.body.type, email: req.body.email });
  res.render("thanks");
});
// Tag loader: skip sale and share tags if us_opt_out === "1" or navigator.globalPrivacyControl

Timeline

Timeline
DateEvent
September 2018Privacy policy first posted; updated November 2021 ([¶ 56](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf))
2024Investigation opens after a consumer complaint ([¶ 30](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf))
July 2024GPC honoured from this point ([¶ 45](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf))
6 August 2025CPPA subpoena enforcement case, No. 25CV018464 ([¶ 81](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf))
26 September 2025Board adopts the order ([Order, p. 1](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf))
30 September 2025CPPA announcement ([Announcement](https://cppa.ca.gov/announcements/2025/20250930.html))
31 March 2026First certification and contract confirmation due ([¶¶ 73, 75](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf))

Outcome

Tractor Supply pays USD 1,350,000 within 30 days of the decision (¶ 65); each side bears its own fees (¶ 80). System changes were due within 90 days unless another date applies (¶ 79). Reports to the agency are confidential (¶ 78). Non-compliance is enforced in the Superior Court, with the agency’s fees (¶¶ 88–89).

What it cost

What it cost
ItemAmount or term
Administrative fineUSD 1,350,000 ([¶ 65](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf))
Agency feesEach side bears its own ([¶ 80](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf))
Officer certificationAnnually for four years from 31 March 2026 ([¶ 75](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf))
Monitoring and recipient reviewFour years, annual reports ([¶¶ 76–77](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf))
Quarterly tracker scansNo end date stated ([¶ 68(a)](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf))
Public request metricsFive years ([¶ 74](https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf))

Why it matters

The CPPA called it "the largest in the CPPA’s history" at the time and "the first to address the importance of CCPA privacy notices and privacy rights of job applicants" (Announcement). For engineering teams, ¶ 68(a) is the notable term: a regulator writing a quarterly tracker scan and inventory into an order. Paragraph 69 turns the symmetry rule from Honda into a design spec: same size, same design. See failed opt-out controls and CCPA.

How Inth catches this

  • Code audit: tracker and SDK detection flags new advertising and analytics dependencies as they enter the codebase, so the inventory does not depend on a quarterly crawl alone.
  • Website audit: script and domain monitoring sees third-party scripts and destinations as they appear, and vendor discovery ties each domain to a vendor record, which is the raw material for the ¶ 68 inventory. It records ad requests made after an opt-out, with the page, time and consent state.
  • Consent banner: Inth’s default California policy is opt-out, so tags run until the visitor opts out, and in California Global Privacy Control counts as an opt-out of sale and sharing, so marketing and analytics stay off for that visitor. The banner gives Accept and Reject the same weight by default, the point ¶ 69 makes.
  • Evidence: dated runtime observations and consent records (choice, country, policy).

Limit: whether each tracker is a sale or share, and whether its contract has the required terms, is a judgement for your legal team. Inth has nothing for job-applicant notices.

Checks for your own systems

In the repository

  • Find the handler behind your "Do Not Sell" form and check it changes the state your tag loader reads.
  • Check the tag loader treats a form opt-out and GPC the same way.
  • Confirm the reject and accept buttons share one component and style.

In the browser and network

  • Submit the opt-out form, reload, and filter for advertising domains.
  • Crawl the site and list every third-party host; compare it with your vendor register.

With the people responsible

  • Ask when the privacy policy was last updated. Annual updates are required.
  • Check the careers site gives California applicants a rights notice.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Tractor Supply’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.