The Enforcement Division of the California Privacy Protection Agency entered into a Stipulated Judgment with the Tractor Supply Company. The underlying litigation involved alleged violations of the California Privacy Protection Act. In the Judgment, the parties agreed that:
- TSC failed to properly implement opt-out mechanisms for sale/sharing of personal information.
- TSC had an ineffective ‘Do Not Sell My Personal Information’ webform that didn’t stop third-party tracking.
- TSC failed to process opt-out preference signals.
- TSC had inadequate contracts with service providers and third parties.
- TSC had deficient privacy policy lacking required CCPA disclosures.
- TSC had insufficient notice to job applicants about their CCPA rights.
To settle the dispute, TSC agreed to pay a fine in the amount of $1,350,000. Additionally, TSC agreed to the following:
- Maintain inventory of tracking technologies and properly configure systems to honor opt-out requests.
- Ensure symmetry of choice in tracking technology interfaces.
- Review and update privacy policies.
- Notify employees and job applicants of updated policies.
- Train personnel handling CCPA requests.
- Modify contract management processes.
- Post required metrics annually for five years.
- Provide annual certification of compliance for four years.
- Implement monitoring program for opt-out requests.
ECAC seeks to provide members with up to date information regarding consumer privacy actions. Please contact ECAC with any questions your organization may have.
Mitchell Roth