CalPrivacy Fines FedEx $2.975 Million and Orders a Quarterly Tracker Testing Program

California’s privacy regulator has issued another multimillion-dollar fine over website tracking. In a decision the CalPrivacy Board signed on November 6, 2026 and announced on November 10, Federal Express Corporation agreed to pay $2,975,000 and run a three-year testing and monitoring program to resolve claims that fedex.com shared visitor data with advertising companies while telling consumers it did not. The money will get the headlines. For privacy and marketing operations teams, the more useful part is the order’s remedial program, which reads like a step-by-step specification for how the agency now expects any business running third-party tags to prove that opt-outs actually work.

What the order says happened

The case, numbered ENF25-073-TS-FE, was resolved by settlement under California’s Administrative Procedure Act rather than a contested hearing. The factual findings were drafted by the agency and accepted by FedEx for purposes of the settlement only. FedEx admits the jurisdictional basics, including that it meets the CCPA’s thresholds, and otherwise “neither admits nor denies” the findings or any liability. That distinction matters when the case is cited: these are the agency’s allegations embedded in a stipulated order, not findings after a trial.

According to the order, FedEx placed tracking technologies from Meta, LinkedIn, Google, Adobe and other ad tech companies on its digital properties. Those tools collected unique device and user identifiers and made them available for purposes that included targeted advertising. The agency stresses that shipping data was not part of what was shared. Some of the ad tech companies also engaged in cookie syncing, matching their identifiers with each other so they could recognize the same person across sites. Under the CCPA’s broad definition, making personal information available to a third party for cross-context behavioral advertising is “sharing” whether or not money changes hands.

Against that backdrop, the agency identified four failures:

• An inaccurate privacy policy. FedEx’s policy said it did not “sell” or “share” personal information and had not done so in the previous 12 months. It also did not explain how the company processed opt-out preference signals.
• No opt-out link. The site offered a “Cookie Consent” footer link but no “Do Not Sell or Share My Personal Information” or “Your Privacy Choices” link, so there was no compliant notice of the right to opt out.
• Ignored browser signals. The site was not configured to detect and honor signals such as Global Privacy Control, so sharing continued for visitors who had sent one. The order notes that California has required businesses to honor these signals since 2020.
• Controls that did not do what they said. FedEx’s CCPA webform said outright that it did not opt users out of cookies or tracking and pointed them to the cookie panel. Yet even after visitors toggled off “Analytical” and “Tracking” cookies, the agency found that some ad tech companies still received certain visitors’ data, and the panel never explained how its settings related to sales and sharing.

None of these is a new theory. The signal failure in particular has been the focus of a multistate push, which we covered in our look at how enforcement escalated on GPC non-compliance across California, Colorado and Connecticut. What is new is how detailed the fix is.

The B2B argument did not work

One point in the order is aimed squarely at companies that assume their websites fall outside consumer privacy law because their customers are businesses. The agency writes that the concerns “persist even when visits to FedEx’s digital properties occur in a business-to-business context,” because people use the same devices for work and personal browsing, and identifiers collected during a work visit can be folded into the broader ad profile tied to that person. Executive Deputy Director Tom Kemp made the same point in the announcement, saying businesses “must assess whether their B2B operations respect the robust privacy rights of individuals.” California’s B2B exemption expired at the start of 2023. This order shows the agency will apply the law to business-facing websites that run consumer ad tech.

The remedial program, clause by clause

Most CCPA settlements require a business to “comply with the law.” This one prescribes the mechanics. Read together, paragraphs 62 through 71 of the order describe a recurring control cycle that any company running marketing tags could adopt today, whether or not a regulator has written to it.

1. Scan and inventory every quarter. FedEx must scan its websites and apps at least quarterly to keep a “full and current inventory” of tracking technologies that sell or share personal information. The order defines those broadly: scripts, cookies, pixel tags, web beacons, SDKs and similar tools. A spreadsheet maintained by hand from vendor contracts would not meet that description. Our guide to tracking technologies and ad tech compliance covers what a usable inventory needs to record.
2. Tie every tracker to a contract. For each inventoried tool, FedEx must hold a contract with the receiving third party that includes the terms listed in section 7053(a)(1)–(6) of the CCPA regulations, and it must keep an onboarding process that checks for those terms before a new partner goes live.
3. Configure for both opt-out paths. Each property must recognize and give full effect to opt-outs whether they arrive by a signal such as GPC or by another required method, and must meet the timing rules in section 7026(f). In practice that means the signal has to suppress the tag before it fires, not after the first page load.
4. Test in staging and production. Configurations must be tested at least quarterly in both environments and every time a new tracking technology is added. That second trigger is the one most programs miss, because new tags often arrive through a marketing team’s tag manager rather than an engineering release. Pre-release checks like those described in our piece on testing Google Tag Manager before changes go live are one way to meet it.
5. Fix the front door. FedEx must offer a working “Do Not Sell or Share My Personal Information” or “Your Privacy Choices” link that either opts the user out immediately or leads straight to the place to do so, without unnecessary friction. Any cookie tool used for opt-outs must say how its settings apply to sales and sharing, and any notice whose title includes words like “privacy,” “cookie” or “ad choices” must include an active link to where the choice is made.
6. Review disclosures within 180 days. The privacy policy, notice at collection and opt-out notice must each state plainly whether FedEx sells or shares personal information as the CCPA defines those terms.
7. Publish metrics. FedEx must post the request metrics described in section 7102 every year, which turns the program’s results into a public record.

The obligations run for three years, and system changes must be in place within 210 days. The cadence matches a broader shift we flagged when the TaxAct settlement showed regulators moving from privacy policies to continuous tracker monitoring. A one-time cleanup before a regulator calls no longer counts as a control. Regulators want to see evidence that the checks are repeated.

How the fine compares

The $2.975 million figure sits above the agency’s other recent board decisions listed in its announcement, including $1.35 million against Tractor Supply and $1.10 million against PlayOn Sports, the ticketing case we unpacked in our PlayOn analysis. It is smaller than the $12.75 million General Motors resolution, which was brought with the Attorney General and district attorneys as a civil penalty. Acting Deputy Director of Enforcement Lara Kehoe Hoffman framed the case as a warning about timing: “The time for implementing appropriate disclosures and functionality for opt-out preference signals has long passed.”

The order also credits two of the agency’s research technologists with investigative help. That detail suggests the agency is testing live websites itself rather than relying only on consumer complaints, so assume your own pages can be checked the same way at any time.

What to do this quarter

• Load your homepage, a product page and checkout with GPC turned on, and record every third-party request. Anything that reaches an ad platform is a finding.
• Repeat the test after toggling off each category in your cookie panel. If the panel is your opt-out method, its text must say so in sale/sharing terms.
• Compare your privacy policy’s sell/share statement against the actual tag list. A “we do not sell or share” sentence is the easiest claim for an investigator to disprove.
• Check your B2B and logged-out pages, not just consumer checkout flows.
• Add “new tag added” as a test trigger in your change process, and keep dated evidence of each run.

Frequently asked questions

Did FedEx admit it violated the CCPA?

No. FedEx admitted only the jurisdictional facts in the first five paragraphs and otherwise neither admitted nor denied the findings or any liability. It waived its rights to a hearing and appeal, so the order is final and enforceable in California Superior Court.

Was shipping or package data shared?

The order says the shared personal information did not include shipping data. It concerned identifiers and browsing activity collected by ad tech pixels and cookies.

If we honor GPC, do we still need a “Do Not Sell or Share” link?

Yes, if you sell or share. Online businesses must offer at least two methods, and the signal and an interactive form behind the link are the expected minimum. The order requires both.

Is quarterly testing now required for everyone?

Not as a rule. The cadence binds FedEx under this order. But it is the clearest statement yet of what the agency considers a credible control, and other businesses should expect to be compared against it.

The order doubles as a specification

Most enforcement orders tell you what a company did wrong. This one also spells out, clause by clause, a process the regulator will accept as evidence that opt-outs work: scan, contract, configure, test, disclose and publish. Companies that build that process now will have records to show if the agency asks. Read the CalPrivacy announcement and the full decision and stipulated final order, then compare your current controls against paragraphs 62 to 71.