Fortune 500 Company Faces Subpoena Enforcement Action

SACRAMENTO, CA — The California Privacy Protection Agency has filed a judicial action seeking to enforce an investigative subpoena against Tractor Supply Company (NASDAQ: TSCO), a Fortune 500 company that bills itself as the nation's largest rural lifestyle retailer. The CPPA's petition alleges that Tractor Supply failed to comply with a subpoena seeking information about the company's compliance with the California Consumer Privacy Act of 2018. The petition marks the CPPA's first public disclosure of an ongoing investigation into a company, and the CPPA's first judicial action to enforce an investigative request.

According to the petition filed in Superior Court, the CPPA's Enforcement Division has been investigating whether Tractor Supply violated Californians' privacy rights in multiple ways, including whether Tractor Supply failed to honor Californians' right to opt-out of the sale and sharing of their personal information online. The right to opt-out is a hallmark of California's privacy law. Although the Enforcement Division served a subpoena asking the company to answer questions under oath, the petition alleges that Tractor Supply refused to answer questions about its business practices during specific time periods.

“We will not hesitate to seek the court's assistance when necessary to advance our investigations and protect Californians' privacy rights,” said Michael Macko, the CPPA's head of enforcement. “We look forward to addressing the merits of this dispute in court.”

The CPPA's Recent Enforcement Actions to Protect Californians

The CPPA continues to actively enforce California's cutting-edge privacy laws. Recent actions include:

• Issuing a decision requiring clothing retailer Todd Snyder to change its business practices and pay a $345,178 fine for CCPA violations.
• Issuing a decision requiring American Honda Motor Co. to change its business practices and pay a $632,500 fine for CCPA violations — one of the highest fines in the law's history.
• Securing a settlement agreement requiring data broker Background Alert — which promoted its ability to dig up “scary” amounts of information about people — to shut down or pay a steep fine.
• Bringing an enforcement action against National Public Data, Inc., the Florida-based data broker responsible for a data breach that exposed millions of Americans' Social Security numbers and personal information.
• Launching the bipartisan Consortium of Privacy Regulators to collaborate with states across the country to implement and enforce privacy laws nationwide.
• Partnering with the data protection authorities in Korea, France, and the United Kingdom to share information and advance privacy protections for Californians.

In addition, the agency has secured more than half a dozen successful enforcement actions against unregistered data brokers following an investigative sweep launched late last year to assess compliance with the Delete Act.

About Us

The California Privacy Protection Agency is committed to promoting the education and awareness of consumers' privacy rights and businesses' responsibilities under the California Consumer Privacy Act.

Individuals can visit privacy.ca.gov to access helpful and up–to–date information on how to exercise their rights and protect their personal information. In addition, the Agency's website provides important information about CPPA Board Meetings, announcements, and the rulemaking process.