California fines FedEx $2.975m and says the CCPA reaches B2B tracking

California fines FedEx $2.975m and says the CCPA reaches B2B tracking

10 November 2026: California's privacy regulator has ordered Federal Express Corporation to pay $2.975 million and change how it handles online tracking, in a decision that says the state's privacy law applies in business-to-business settings. Any company that treats its corporate website as outside the CCPA now has a named case against that assumption.

Not yet independently verified. We have read the agency's announcement and not the Board's decision itself. The release gives no date by which FedEx must comply, and we have not seen a FedEx response. We will update this when it can be confirmed, and remove this note.

What the Board found on the website

The California Privacy Protection Agency's Enforcement Division alleged that FedEx falsely stated it did not sell or share personal information while it took part in cross-context behavioural advertising. The Board's decision adds three failures: FedEx did not honour opt-out preference signals, its webform for CCPA requests did not cover online tracking technologies, and its cookie controls, meant to deal with those technologies, did not work properly.

The opt-out signal is the browser-level instruction that a visitor sends automatically, and the regulator made plain it has lost patience. "The time for implementing appropriate disclosures and functionality for opt-out preference signals has long passed," said Lara Kehoe Hoffman, the agency's Acting Deputy Director of Enforcement.

A sentence aimed at B2B marketers

The more unusual line came from Tom Kemp, the Executive Deputy Director: "The Board's decision confirms that the CCPA protects Californians from online surveillance, even in a business-to-business (B2B) setting." He added that businesses "must assess whether their B2B operations" respect individuals' privacy rights.

A freight customer logging in to book a shipment is an employee of another company, and many marketing teams file that person's data under a looser standard than a consumer's. Advertising pixels on account pages, sales enablement tools that identify visiting companies and retargeting lists built from trade customers are the places this statement bites hardest.

Quarterly checks written into the order

The fine comes with conditions that read like a compliance programme. FedEx must:

• inventory its online tracking technologies every quarter and review any new one before it is added
• configure its systems so that the instructions in relevant contracts are followed
• test opt-out compliance every quarter, to a level of detail the decision specifies
• test its methods for submitting CCPA requests every quarter

It must also keep a working "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link on its websites and mobile apps. Where a cookie notice is used for opt-outs, it has to say how the control applies to sale and sharing, and link to the place where the choice is made.

For a privacy team elsewhere that list doubles as a checklist of what this regulator now considers reasonable, and the cookie tool's vendor should be able to show that a browser signal is actually acted on.

Where this sits among the agency's cases

The agency lists its other recent actions as a $12.75 million civil penalty against General Motors over connected-vehicle data, brought with the Attorney General and district attorneys, a $1.35 million fine for Tractor Supply and a $1.10 million fine for PlayOn Sports, along with 17 actions against unregistered data brokers.

Sources

• California Privacy Protection Agency, press release, 10 November 2026