California privacy agency hits Tractor Supply with record $1.35M fine

The California Privacy Protection Agency has fined Tractor Supply Company $1.35 million -- the largest penalty in its history -- for violating the California Consumer Privacy Act. The agency also ordered the home improvement retailer, which operates more than 2,500 stores nationwide, to overhaul its data practices.

The case marks the first decision by the agency addressing the privacy rights of both job applicants and consumers. Investigators found that Tractor Supply failed to maintain adequate privacy policies, offer effective opt-out opportunities, notify job applicants of their privacy rights and enter into contracts with partners to safeguard shared data.

"We made it an enforcement priority to investigate whether businesses are properly implementing privacy rights, and this action underscores our ongoing commitment to doing that for consumers and job applicants alike," Michael Macko, the agency's head of enforcement, said in a Tuesday news release.

The announcement linked to a settlement agreement signed Friday by agency Chair Jennifer M. Urban: In re Investigation of Tractor Supply Company, ENF24-M-TR-04 (Before the California Privacy Protection Agency, Sept. 26, 2025). The agreement also resolves a separate court case filed by the agency: In re: Investigation of Tractor Supply Company, 25CV018464 (Sac. Super. Ct. filed Aug. 6, 2025).

As part of the settlement, Tractor Supply must implement several remedial measures, including scanning its websites for tracking technologies and requiring a corporate officer to certify compliance annually for four years. A company spokesman did not respond to a request for comment.

The fledgling agency has been active in recent months. It fined clothing retailer Todd Snyder $345,178 in May and American Honda Motor Co. $632,500 in March. In both cases, the agency found the companies failed to share opt-out information with customers and process privacy requests.