Tractor Supply has agreed to pay $1.35 million to resolve allegations that between January 2023 and July 1, 2024 it failed to honor consumers' requests to opt out of the sale or
sharing of their data for advertising, California's privacy agency said Tuesday.
"Although Tractor Supply’s webform purported to allow consumers to opt-out of the sale of
their personal information, completion of the webform did not opt-out consumers from the third-party tracking technologies that Tractor Supply used for advertising purposes," the California Privacy
Protection Agency said in a written order.
The agency added that the retailer's opt-out form left
consumers "with the false impression that Tractor Supply had stopped selling and sharing their personal information."
Tractor Supply, which bills itself as a rural lifestyle
retailer, also allegedly failed to honor opt-out preference mechanisms such as the Global Privacy Control that send opt-out requests to every site people visit.
advertisement
advertisement
The order
specifies that after Tractor Supply learned of the investigation, it "substantially revised its practices," "remediated many of the issues" identified by regulators and "committed substantial
financial and other resources to remediating the shortcomings."
The California privacy agency said it launched its investigation of the company after receiving a complaint from
a consumer in Placerville.
A Tractor Supply spokesperson stated it is "committed to complying with all privacy laws and protecting the trust placed in us," and "has already
addressed the issues raised by the state of California."
Among other terms, the order requires the company to scan its digital properties for tracking technology, and to
configure those properties to honor opt-out preference signals. The order also requires a Tractor Supply corporate officer or director to certify compliance annually for four years.
California's privacy law, which took effect in 2020, gives consumers the right to learn what personal information has been collected about them by companies, have that information
deleted, and prevent the sale or transfer of that data to third parties. The law's definition of "personal information" is broad enough to cover the type of pseudonymous data that companies rely on
for ad targeting.
Regulations implementing the law also require companies to honor opt-out requests sent through signals like the Global Privacy Control.