CPPA $1.35M Fine 2025: Job Applicant Privacy Violation

Open office with workers at computer workstations — Photo via Unsplash

Last reviewed: September 27, 2026. Facts verified against the CPPA Stipulated Final Order and current legal commentary. What changed: Between August 13 and September 3, 2026 CalPrivacy layered four more data-broker enforcement actions and an enforcement advisory on top of the August 11 LocateSmarter decision, converting the Tractor Supply-era CCPA enforcement story from a one-off fine into a sustained data-broker strike force: Cybba Inc. ($52,400 on August 13 for Delete Act registration failure), 500,000 Californians enrolled in DROP by August 25, the California Legislature advanced a bill to strengthen deletion rights on August 28, SalesIntel Research Inc. ($36,400 on September 1, the first out-of-state data-broker settlement), and Enforcement Advisory 2026-01 on September 3 warning brokers that inaccurate annual registration triggers the $200/day Delete Act penalty. The Tractor Supply action remains the first CCPA workforce-data precedent; the new actions show the agency has now operationalized the Delete Act registry as its primary enforcement lever against the data-broker layer that buys what Tractor Supply-style HR-data leaks expose. Details and citations appended below.

Update (September 27, 2026): CalPrivacy's data-broker enforcement program has now produced five published decisions since the August 11 LocateSmarter order, all of them extending the Tractor Supply story downstream into the registry and opt-out mechanics the Delete Act created. On August 13, 2026 CalPrivacy announced its second data-broker enforcement decision in less than a week, fining Boston-based Cybba Inc. $52,400 for failing to register with the Data Broker Registry by the 2025 deadline under the Delete Act.^[16] Cybba was also ordered to post privacy-rights metrics on its website, integrate with DROP, and process future deletion requests through the platform. On August 25, 2026 CalPrivacy reported 500,000 residents had signed up for the Delete Request and Opt-Out Platform since its January 1, 2026 launch, a doubling of the 300,000 enrollment figure cited in the June 2, 2026 update and the strongest signal yet that opt-out volume is now operationally material to data-broker business models.^[17] On August 28, 2026 the California Legislature advanced a bill to strengthen consumer deletion rights; CalPrivacy's announcement frames it as a continuation of the same enforcement architecture the LocateSmarter and Tractor Supply decisions plug into.^[18] On September 1, 2026 CalPrivacy announced an enforcement decision against Virginia-based SalesIntel Research Inc., fining the company $36,400 for operating as a data broker without registering by the 2025 deadline, the agency's first out-of-state data-broker settlement and a signal that CalPrivacy will reach across state lines to enforce the Delete Act registry.^[19] On September 3, 2026 CalPrivacy issued Enforcement Advisory 2026-01, formally warning registered data brokers that inaccurate annual registration information triggers the Delete Act's $200-per-day penalty and directing consumers to the agency's complaint form.^[20] Enforcement Division head Michael Macko and Executive Director Tom Kemp are quoted in the advisory saying the agency will use "all available tools" against brokers that fail to keep registry information current. For HR, recruiting, and benefits teams, the practical implication continues to expand: every CCPA opt-out pathway a company exposes, including any data-broker downstream of a hiring funnel, must actually let a consumer opt out without surrendering sensitive personal data first, and that opt-out must now be honored by a registry that CalPrivacy is actively auditing. See the Data Broker Enforcement Strike Force coverage for the broader enforcement architecture the LocateSmarter, Cybba, and SalesIntel decisions plug into.

Update (September 8, 2026): On August 11, 2026 CalPrivacy announced an enforcement decision against LocateSmarter LLC, an Iowa data broker, marking the agency's first action against a data broker under both the CCPA and the California Delete Act.^[15] The Board found that LocateSmarter failed to register timely as a data broker, and that the company required Californians to provide the last four digits of their Social Security number as a precondition to exercising their CCPA opt-out rights, a practice CalPrivacy treated as an unlawful precondition on a right that the statute says must be exercisable without friction. LocateSmarter's records include names, dates of birth, full and partial Social Security numbers, contact details, employment history, driver's license data, bankruptcy and litigation records, and behavioral inferences such as whether a consumer is "litigious," the kind of downstream cache that turns a Tractor Supply-style HR-data leak into a brokerage-grade dossier. The Board imposed a $116,490 administrative penalty and ordered business-practice changes. The case was prosecuted by CalPrivacy's Data Broker Enforcement Strike Force and is now the second published enforcement decision in 2026 that turns on opt-out mechanics (the first was Tractor Supply's GPC failure and non-functional "Do Not Sell" webform). For HR, recruiting, and benefits teams, the practical implication is unchanged from the July 22, 2026 update: every CCPA opt-out pathway a company exposes, including any data-broker downstream of a hiring funnel, must actually let a consumer opt out without surrendering sensitive personal data first. See the Data Broker Enforcement Strike Force coverage for the broader enforcement architecture the LocateSmarter decision plugs into.

Update (July 22, 2026): CalPrivacy's enforcement tempo has continued since the June 29, 2026 update. On July 21, 2026, the California Privacy Protection Agency announced its first-ever sectoral audit under the CCPA, targeting gig economy platforms and evaluating whether they honor the privacy of both consumers and workers.^[14] Sectoral audits are a CCPA tool that lets the regulator examine an entire industry category rather than chasing one company at a time, and the choice of gig economy as the first target is consistent with the agency's focus on worker data flagged by the Tractor Supply action and the broader workforce-privacy frame of the GM/OnStar settlement. The audit announcement is the latest in a sequence of CCPA enforcement actions that has now reached at least eight public settlements (Sephora, DoorDash, Disney, Jam City, Sling TV, Healthline, Tilting Point, GM) plus the Tractor Supply Stipulated Final Order this article covers.^[11] See the GM OnStar penalty coverage and CalPrivacy's DROP platform coverage for the full breakdowns.

TL;DR: On September 30, 2025, California's Privacy Protection Agency issued its largest-ever fine ($1.35 million) against Tractor Supply Company for multiple privacy violations. This landmark case is the first CPPA enforcement action addressing job applicant data rights, signaling that HR data is now a seven-figure compliance risk. The company failed to inform job applicants of their CCPA rights, did not honor universal opt-out signals like Global Privacy Control (GPC), and maintained an ineffective "Do Not Sell" webform that failed to prevent data sharing through third-party trackers.

A Watershed Enforcement Action

On September 30, 2025, the California Privacy Protection Agency (CPPA) announced a landmark $1.35 million settlement with Tractor Supply Company, the largest fine in the agency's history.^{[1, 2]} What began as a single consumer complaint has evolved into a watershed moment in California privacy enforcement, marking the first time the CPPA has explicitly addressed violations related to job applicant data under the California Consumer Privacy Act (CCPA).^{[3, 4]}

This case sends an unambiguous message to employers across California: workforce data, including job applicant information, is no longer a low-priority compliance matter. It is now a seven-figure risk that demands the same rigorous privacy protections as customer data.

Three Critical Violations

The CPPA identified three major categories of violations by Tractor Supply Company:

1. Failure to Inform Job Applicants of CCPA Rights

Tractor Supply's privacy notice for job applicants did not adequately inform them of their rights under the CCPA. This is a compliance blind spot for many businesses that have historically focused privacy efforts on customer-facing data while neglecting employee and applicant data.^[5] The CPPA's enforcement makes clear that applicant data is not exempt from California's privacy law.

2. Ineffective "Do Not Sell My Personal Information" Webform

The company's "Do Not Sell My Personal Information" webform was fundamentally ineffective. While it may have appeared compliant on the surface, it failed to actually prevent the sale or sharing of personal data collected via third-party tracking technologies embedded on Tractor Supply's website and career pages.^{[6, 7]} This gap between stated policy and actual practice is precisely what CCPA enforcement targets: companies cannot claim compliance while continuing to share data with third parties.

3. Failure to Honor Universal Opt-Out Signals (GPC)

Until mid-2024, Tractor Supply failed to honor universal opt-out signals such as the Global Privacy Control (GPC). GPC is a browser-based signal that allows users to automatically communicate their opt-out preference to websites, eliminating the need to manually fill out forms on every site.^{[6, 8]} California law requires businesses to recognize and honor these signals, yet Tractor Supply ignored them for years.

What This Means for Employers and Job Seekers

For Employers: HR Data is No Longer a Secondary Concern

This settlement forces every company with employees or applicants in California to fundamentally reassess their approach to HR data. For years, privacy compliance programs have been customer-centric, with dedicated teams focused on consumer data while HR systems operated under legacy assumptions about employee data. The CPPA has now demolished that distinction.

Employers must now ensure that:

Privacy notices for job applicants clearly explain CCPA rights, including rights to know, delete, and opt out of data sales.
"Do Not Sell" mechanisms actually function, not just in theory but in practice. This means auditing all third-party trackers, analytics tools, and advertising pixels on career pages.
Universal opt-out signals like GPC are recognized and honored across all web properties, including applicant portals.
Data sharing agreements with recruiting firms, background check providers, and HR tech vendors are reviewed to ensure CCPA compliance.

For Job Seekers: Your Application Data Has Value, and Rights

Job applicants often assume that once they submit a résumé, their data disappears into an HR black hole. This case confirms that applicant data is being actively monetized through data brokers, advertising networks, and analytics firms. Applicants have the same rights under CCPA as consumers:

The right to know what personal information is collected and how it is used.
The right to delete that information (subject to certain exceptions).
The right to opt out of the sale or sharing of that data.

Beyond the Fine: Mandatory Remediation

The $1.35 million fine is only part of the penalty. Tractor Supply must implement sweeping remedial measures that will reshape its privacy program for years:^[9]

Quarterly Audits

Tractor Supply must conduct quarterly audits of all tracking technologies on its websites to ensure they comply with user opt-out preferences.

Annual Compliance Certifications

For the next four years, a corporate officer must personally certify annual compliance with the settlement terms. This creates executive-level accountability.

Comprehensive Privacy Notice Updates

The company must revise all privacy notices to clearly inform applicants and employees of their CCPA rights, including providing specific, accessible mechanisms to exercise those rights.

GPC Recognition

The company must recognize and honor all universal opt-out signals, including Global Privacy Control, across its entire digital footprint.

These requirements are designed to prevent future violations and to serve as a model for other California businesses. The CPPA is sending a signal: superficial compliance is not enough.

Recommendations

For Job Seekers:

Use GPC-Enabled Browsers

Enable Global Privacy Control in your browser before visiting career sites. Browsers like Brave, Firefox (with extensions), and DuckDuckGo support GPC. This automatically signals your opt-out preference without requiring you to fill out forms on every site.

Request Information

If you've applied for jobs in California, exercise your CCPA rights. Send a "Right to Know" request to companies where you've applied to learn what data they collected, how it was used, and with whom it was shared.

Minimize Data Shared

When applying for jobs, only provide information that is strictly required. Avoid uploading full résumés to third-party application portals unless absolutely necessary. Consider creating a minimal "application version" of your résumé that excludes home address, personal phone number, or other sensitive details.

For Employers:

Audit Your Career Pages

Conduct an immediate audit of all third-party trackers, analytics tools, and advertising pixels on career pages and applicant portals. Ensure that "Do Not Sell" mechanisms genuinely prevent data sharing.

Implement GPC Recognition

Work with your web development and IT teams to ensure your sites recognize and honor Global Privacy Control signals. This is not optional in California; it is a legal requirement.

Update Privacy Notices

Revise applicant-facing privacy notices to clearly explain CCPA rights in plain language. Include conspicuous links to opt-out mechanisms and instructions for submitting data requests.

Train HR and Recruiting Teams

Ensure that HR professionals, recruiters, and hiring managers understand CCPA compliance obligations. Privacy is not just a legal issue; it's an operational requirement that touches every stage of the applicant lifecycle.

References

Holland & Knight. "California Privacy Protection Agency Fines Tractor Supply $1.35M for Privacy Law Violations."
Klein Moynihan Turco LLP. "California Privacy Violations Result in $1.35 Million Fine!"
Fisher Phillips. "California Breaks New Ground With Record $1.35M Fine for Job Applicant Mistakes."
The National Law Review. "California Hits Employer with $1.35M Fine in First-Ever Job Applicant Enforcement Action."
JDSupra. "$1.35M CPPA Fine Signals New Focus on Privacy Disclosures."
Holland & Knight. "California Privacy Protection Agency Fines Tractor Supply $1.35M for Privacy Law Violations."
California Privacy Protection Agency. "Stipulated Final Order, In the Matter of Tractor Supply Company."
The Record. "CPPA fines Tractor Supply Company $1.4 million for privacy violations."
California Privacy Protection Agency. "Stipulated Final Order, In the Matter of Tractor Supply Company."
California Attorney General Rob Bonta, CalPrivacy, SF DA Brooke Jenkins, LA DA Nathan J. Hochman, Napa DA Allison Haley, Sonoma DA Carla Rodriguez. "When It Comes to Data Privacy, Consumers Must Be in the Driver's Seat: Attorney General Bonta, Partners Secure $12.75 Million General Motors Privacy Settlement." May 8, 2026.
California Privacy Protection Agency. "When It Comes to Data Privacy, Consumers Must Be in the Driver's Seat: Attorney General Bonta, Partners Secure $12.75 Million General Motors Privacy Settlement." May 8, 2026.
California Privacy Protection Agency. "Privacy Momentum Builds: 300,000+ Californians Sign Up for DROP as Registered Data Brokers Hit a Record High." June 2, 2026.
California Privacy Protection Agency. "The California Privacy Protection Agency Opposes Federal Legislation That Would Weaken State Privacy Protections." June 3, 2026.
California Privacy Protection Agency. "California Privacy Protection Agency Launches First Sectoral Audit, Targets Gig Economy Platforms." July 21, 2026.
California Privacy Protection Agency. "CalPrivacy Brings First Action Against a Data Broker Under Both the CCPA and Delete Act." August 11, 2026. Announces LocateSmarter LLC enforcement decision ($116,490 penalty), Data Broker Enforcement Strike Force action, and practice-change order tied to the SSN precondition on opt-out rights.
California Privacy Protection Agency. "CalPrivacy Announces Second Data Broker Enforcement Action in Less than a Week." August 13, 2026. Announces Cybba Inc. enforcement decision ($52,400 penalty for Delete Act registration failure), DROP integration order, and privacy-rights metrics posting requirement. Decision order at privacy.ca.gov/wp-content/uploads/sites/357/2026/08/Order-of-Decision-and-Stipulated-Final-Order_Cybba-Inc.-.pdf.
California Privacy Protection Agency. "Half a Million Californians Have Signed Up for DROP to Delete Their Personal Information From Data Brokers." August 25, 2026. Reports 500,000 DROP enrollees since the January 1, 2026 platform launch, doubling the 300,000 figure cited in the June 2, 2026 update.
California Privacy Protection Agency. "California Legislature Advances Bill to Strengthen Deletion Rights." August 28, 2026. CalPrivacy statement on legislative advancement of deletion-rights strengthening bill as a continuation of the same enforcement architecture.
California Privacy Protection Agency. "CalPrivacy Continues Enforcement Blitz with Action Against Virginia Data Broker." September 1, 2026. Announces SalesIntel Research Inc. enforcement decision ($36,400 penalty for operating as a data broker without registering by the 2025 deadline); agency's first out-of-state data-broker settlement. Decision order at privacy.ca.gov/wp-content/uploads/sites/357/2026/08/SalesIntel-Research-Inc_Decision-and-Final-Stipulated-Order.pdf.
California Privacy Protection Agency. "Enforcement Advisory Targets Incorrect Information in Data Broker Registration." September 3, 2026. Announces Enforcement Advisory 2026-01 warning registered data brokers that inaccurate annual registration information triggers the Delete Act's $200-per-day penalty. Advisory PDF at privacy.ca.gov/wp-content/uploads/sites/357/2026/09/Enforcement-Advisory-No.-2026-01-Accuracy-of-Data-Broker-Registration-Information.pdf.