The California Privacy Protection Agency has issued a record $1.35 million fine against Tractor Supply for violating the state’s landmark consumer privacy law. The case marks the agency’s first major action against a company for mishandling data from job applicants, setting a new tone for how California intends to enforce its privacy rules.
Tractor Supply, a national retailer with more than 2,500 stores across 49 states, was accused of failing to meet several requirements of the California Consumer Privacy Act. Regulators said the company neglected to notify customers and job applicants about their rights, ignored opt-out signals such as Global Privacy Control, and shared personal data with third parties without the contracts required to protect that information.
In addition to paying the fine, Tractor Supply must conduct a full audit of its digital properties and certify compliance for the next four years. The agency’s message was clear: ignoring privacy obligations will come with a cost.
What makes this case stand out is not the size of the fine, but the target. Tractor Supply is not a Silicon Valley data broker or a social media platform. It is a rural retail chain, better known for selling feed, tools, and workwear. Yet according to regulators, its digital operations were quietly collecting, tracking, and sharing consumer information at a scale that caught the attention of California’s watchdogs.
Michael Macko, the agency’s head of enforcement, said the investigation began with a single consumer complaint from Placerville, California. That tip led to months of scrutiny and ultimately the largest fine in the agency’s history. “We will continue to look broadly across industries to identify violations,” Macko said in a statement. “This action underscores our ongoing commitment to protecting both consumers and job applicants.”
Privacy advocates praised the move, noting that strong enforcement is what keeps data protection laws from becoming symbolic. But the case also raises a broader question about the reach of digital tracking. If a company like Tractor Supply is quietly logging user behavior, how many others are doing the same and how often do those patterns go unnoticed?
The agency’s decision serves as a reminder that surveillance is no longer confined to big tech or social platforms. It has become embedded in retail systems, job applications, and even loyalty programs that most people use without a second thought. The fine may close one case, but it also opens a new chapter in how far regulators are willing to go to confront the everyday infrastructure of data collection.
For consumers, the takeaway is simple but unsettling: the companies tracking you are not always the ones you expect.