California Privacy Watchdog’s Record Fine Against Tractor Supply Company Signals ‘Escalating’ Enforcement Trend

Sadia Mirza, a partner with Troutman Pepper Locke and leader of the firm’s Incidents + Investigations team, was quoted in the October 10, 2025 Law.com article, “California Privacy Watchdog’s Record Fine Against Tractor Supply Company Signals ‘Escalating’ Enforcement Trend.”

The CPPA’s trend of targeting retailers and focusing on employee data, said Sadia Mirza, leader of the incidents and investigations group at Troutman Pepper Locke in Orange County, will only continue to ramp up after the CCPA expanded its scope in Jan. 2023 to afford the same privacy protections for workers as it does for consumers.

“All the other states that have proxy laws have carved out employee or applicant data for the most part. But California has maintained that position,” said Mirza. “I feel like this is California saying, ‘Look, we know that the other states aren’t looking at employee data,’ but it demonstrates their commitment to this issue, signaling that they’re aware of their unique position and they are determined to ensure compliance.”

Impact on Compliance and Privacy Litigation

To avoid digital privacy enforcement actions in California, said Mirza, companies need to give consumers two mechanisms to opt out of the sale or sharing of their personal information to third-parties.

Tractor Supply, she said, included a link at the bottom of its website stating “Do not sell my personal information,” which led to a web form allowing visitors to opt out of the selling and sharing of their data—but did not provide disclosures about or the choice to opt out of cookies and online data collection technology.

“That’s where I think … businesses are falling short, is they’re setting up these web forms and … it looks right, everything looks correct on the website, but then you have to think about: Is the mechanism that I’ve set up actually going to stop the selling and sharing of consumer’s information, or do I need to do something more?” she said.

“There’s got to be something that says, ‘Hey, by the way, we also sell your information through cookies and online collection technologies in order to stop that. Here are the steps you can take. You can broadcast a signal, you can change your cookie preferences, you can use our cookie consent tool to manage the tracker on your page’ You’ve got to address both.”

Companies that are inundated with consumer complaints, handle sensitive information such as medical data or interact with vulnerable populations will be more at risk of enforcement actions, she added.