The Challenge
FedEx claimed it didn't sell or share personal information, yet the California Privacy Protection Agency (CalPrivacy) found it involved in cross-context Behavioural Advertising. This contradiction led to a $2.975 million fine and mandatory operational changes.
The issues went beyond a misleading privacy policy. FedEx failed to honor opt-out preference signals, its webform for CCPA requests didn't cover online tracking technologies, and its cookie controls were ineffective.
As a compliance manager, consider each failure: inaccurate disclosures, non-functional signal handling, incomplete request coverage, and ineffective user controls.
The Environment and Constraints
This case is notable because FedEx's setup is typical. It operates websites, uses online tracking, and has cookie controls and request webforms. Two constraints are key:
Tracking Changes Rapidly. Marketing teams add tags, vendors change behavior, and contracts specify configurations that engineering might miss. Any gap between privacy notices and site actions is a liability that can quietly grow.
B2B Assumptions. CalPrivacy's Executive Deputy Director, Tom Kemp, emphasized that the CCPA protects Californians even in business-to-business settings. Treating B2B web traffic as lower risk is a mistake. Visitors to a business site are consumers under the law.
The Approach Taken
The enforcement outcome outlines the remediation steps FedEx must follow, serving as a blueprint for compliance:
- Quarterly Inventory of Tracking Technologies. Review new tracking technologies before adding them.
- Configuration Compliance. Ensure contract instructions are followed.
- Quarterly Opt-Out Compliance Testing. Include specific testing details.
- Quarterly CCPA Request Testing. Confirm functionality.
FedEx must also maintain a clear "Do Not Sell or Share My Personal Information" link on its websites and apps. Cookie notices must explicitly state how they handle sales and sharing, with an active link for consumers to exercise their choice.
This structure isn't a one-time fix. It establishes a recurring cycle of inventory, pre-approval, testing, and verification. The pre-launch review for new tracking technology shifts compliance from reactive to proactive.
Results and Metrics
The decision's measurable outcomes include a $2.975 million fine and quarterly testing and inventory obligations. CalPrivacy's recent actions include a $12.75 million penalty against General Motors and other significant fines, highlighting its active enforcement stance.
The fine is only part of the cost. The ongoing testing and inventory regime is a substantial operational commitment. Acting Deputy Director of Enforcement Lara Kehoe Hoffman stated, "The time for implementing appropriate disclosures and functionality for opt-out preference signals has long passed," indicating clear expectations.
What They Would Do Differently
FedEx hasn't shared its internal perspective, but the decision highlights necessary controls:
Test Outcomes, Not Interfaces. A correctly rendered consent notice doesn't ensure underlying tags stop firing. Verify opt-out and OOPS effectiveness by inspecting network requests and cookies after applying the signal.
Align Disclosures with Behavior. The claim of not selling or sharing data conflicted with cross-context advertising. Derive disclosures from your tracking inventory, not assumptions.
Scope Request Channels to All Data Flows. A CCPA webform that omits online tracking technologies leaves data unaddressed.
Gate New Tags. A pre-deployment review prevents unreviewed vendor scripts from undermining compliance.
Takeaways for Your Team
- Build a Living Tracking Inventory. Regulators chose a quarterly cadence. Use it as a minimum, recording owner, purpose, vendor, and contract terms for each item.
- Test OOPS Handling Directly. Send the signal from a supporting browser, then confirm tracking is suppressed. Document test steps and results.
- Check Contract-to-Configuration Alignment. Ensure vendor agreements on data use or restrictions are enforced by tag or SDK configurations.
- Verify Request Intake End to End. Test each request channel to ensure it reaches the right team and covers tracking data.
- Make Opt-Out Links Functional and Explicit. If a cookie notice is your opt-out mechanism, it must explain its application to sales and sharing and link to the choice exercise location.
- Stop Treating B2B as Exempt. Ensure your business-facing sites respect consumer rights.
Your next quarterly review is your most cost-effective defense against enforcement. Schedule it before regulators do.
