Privacy Pros Applaud CPPA Raising Regulatory Stakes in Tractor Supply Battle
The California Privacy Protection Agency (CPPA) filing a court petition to force Tractor Supply Co. to comply with an investigative subpoena Wednesday demonstrates its willingness to fight for privacy rights, consumer advocacy groups and other privacy professionals said.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
"It's heartening to see the CPPA bring the fight to a multibillion-dollar company that appears to be flouting its privacy obligations,” John Davisson, director of litigation at the Electronic Privacy Information Center (EPIC), said in an email to Privacy Daily. “Privacy laws aren't worth much without enforcement to back them up, and often that means cracking down on well-heeled corporations when they drag their feet.”
The agency alleged that the retailer failed to comply with an investigative subpoena seeking information about its compliance with the California Consumer Privacy Act (CCPA) (see 2508060070). CCPA began investigating Tractor Supply early last year. It's the first instance of a current investigation into a company being publicly disclosed, CCPA said.
Davisson added, “It goes to show what a difference a dedicated privacy enforcement agency can make, particularly at [a] moment when federal regulators are busy letting big tech and other violators off the hook."
Cobun Zweifel-Keegan, IAPP managing director for Washington, D.C., sees "a remarkable legal battle brewing in California," he said in a LinkedIn post Thursday. “Tractor Supply, rather than comply with a routine investigative inquiry from the [CPPA], decided to flip the board game and change the terms of engagement” by arguing “that the CPPA's investigative powers do not extend to the time before the agency came into existence,” he said. “The agency seems more than happy to meet the upended battle head-on in order to settle this argument for good.”
Electronic Frontier Foundation (EFF) Staff Attorney Mario Trujillo noted that “since consumers largely can't enforce their own privacy rights under California's law, it is good that the agency has brought some settlements and investigations of companies this year.”
He added that "EFF recently sent the agency hundreds of other investigative leads about data brokers,” citing blog posts concerning their failure to register with states that require it (see 2508040046).
Markus Sullivan, GLS Group corporate data protection manager, said Tractor Supply is a “fascinating case” with a “curious defense strategy, though not entirely new.” Responding Thursday to a LinkedIn post, Sullivan said it appears to be "an attempt to spread the stock impact over time,” since “a regulatory hit triggers a sharp drop, but a drawn-out legal battle leads to gradual repricing as odds shift. Higher overall cost, but lower market volatility.”
Tractor Supply shares were down less than 1% on Thursday, closing at $60.02. The home improvement, garden, lawn and outdoor retailer operates 2,335 stores in 49 states.
Troutman Amin law clerk Tammana Malik also called the situation a “watershed moment for privacy enforcement” in a blog post.
Tractor Supply’s “decision to challenge the CPPA’s request may reflect broader industry uncertainty about the scope of the Agency’s powers, particularly with respect to historical data,” Malik said. “A positive outcome for the CPPA could lead to more aggressive investigatory tactics and increased demands on businesses to maintain and produce historical records.”
“The CPPA has made clear that this judicial action is not a finding of wrongdoing,” but instead “a procedural step to enforce the Agency’s ability to conduct a full investigation,” Malik added. “Nevertheless, the filing underscores the Agency’s willingness to escalate matters when businesses do not cooperate with its investigations.”
Fox Rothschild privacy lawyer Odia Kagan said that the judicial action against Tractor Supply means companies subject to the CCPA should "make sure that [their] privacy notice is annually updated and that this [is] clear to the viewer," since the "CPPA specifically calls out the 'last updated"' date visible on the site" in its petition. She also said Thursday on LinkedIn that companies should ensure they can demonstrate compliance for the last five years, going back to 2020.
Companies could get a "bonus point" if they "cooperate with the regulator," Kagan added. "The CPPA complaint specifically mentions issues like delays and incomplete responses. We have also seen from EU [regulatory] investigations that cases were closed or issues mitigated due to openness and cooperation from the company being investigated."