CalPrivacy fines FedEx $2.975 million for sharing website visitors' data with ad tech companies

On November 10, 2026, the California Privacy Protection Agency (CalPrivacy) announced a $2.975 million fine against Federal Express, after finding that FedEx's privacy policy said it did not sell or share personal information while ad tech trackers ran on fedex.com.

From July 1, 2023 to October 27, 2025, cookies and pixels from Meta, LinkedIn, Google, Adobe, and other ad tech companies on FedEx's websites made visitors' device and user identifiers available for targeted advertising

FedEx failed to honor opt-out preference signals, its CCPA request form did not apply to tracking technologies, and its cookie controls did not work properly

Separately, on November 6, 2026, the CalPrivacy Board voted unanimously to advance proposed amendments concerning opt-out preference signals to formal rule making.‍

What did FedEx allegedly do?

FedEx's privacy policy told visitors it did not sell or share their personal information.

Its websites ran cookies and pixels from Meta, LinkedIn, Google, Adobe, and other ad tech companies.

These trackers made unique device and user identifiers available to those companies for purposes including targeted advertising. Shipping data was not included.

Some of the vendors also synced cookies, matching identifiers so each could recognize the same person across websites and platforms.

Under the CCPA, making personal information available to a third party for cross-context behavioral advertising is "sharing," whether or not money changes hands.

‍How did each opt-out route fail?

California has required businesses to honor opt-out preference signals such as Global Privacy Control (GPC) since 2020. According to CalPrivacy’s order, FedEx continued sharing visitors’ personal information with ad tech companies after visitors submitted opt-out requests through browser-based preference signals.

FedEx had a "Cookie Consent" link in its footer, but no "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link.

Its CCPA request form stated that it did not opt users out of cookies or tracking technologies, and pointed them to the Cookie Consent link instead.

The Cookie Preferences window let visitors switch off "Analytical" and "Tracking" cookies. Even after they did, FedEx kept making some visitors' data available to some ad tech companies.

The window also did not explain how those settings related to selling or sharing, which California requires when cookie controls serve as the opt-out.

What does FedEx have to do now?

FedEx must scan its websites and apps at least quarterly to keep a full inventory of trackers that sell or share personal information, and keep CCPA-compliant contracts with the third parties it sells or shares data with.

It must test that opt-outs, including GPC, are honored in both staging and production, at least quarterly and whenever a new tracker is added.

It must review new third parties before onboarding them, add a "Do Not Sell or Share" or "Your Privacy Choices" link, and make sure any cookie tool used for opt-outs explains how it applies to sale and sharing.

The order requires a review of FedEx’s privacy disclosures and opt-out practices within 180 days of its effective date. Unless otherwise specified, required process and system changes must be implemented within 210 days of that date. The order’s conduct obligations remain in effect for three years.

For other companies, these terms provide a useful benchmark for tracking governance and opt-out testing.

Why does this decision matter beyond FedEx?

The CCPA's temporary exemption for business-to-business data expired on January 1, 2023, six months before FedEx's conduct period began.

CalPrivacy's Tom Kemp said the decision confirms the CCPA protects Californians from online surveillance even in a B2B setting.

The opt-out signal problem is not new. In 2022, the California Attorney General settled with Sephora over allegations that it failed to disclose sales of personal information and failed to honor Global Privacy Control opt-outs.

CalPrivacy has also advanced proposed amendments to clarify existing opt-out obligations. These amendments are not yet final or in effect.

The proposed amendments would name GPC in the regulations and require businesses using a consent or tag management platform to check for the signal before third-party advertising and analytics trackers that facilitate the sale or sharing of personal information are set.

The draft also adds examples on timing, cookie syncing, and linked devices, requiring businesses that link a person's devices for advertising to apply the opt-out to all of them.

Businesses subject to the proposed metrics-reporting requirements would have to report how many opt-out requests arrived through browser-based preference signals.

From January 1, 2027, California's Opt Me Out Act will require covered browser providers to offer an easy-to-find, configurable opt-out preference signal feature. This could increase the use of browser-based opt-outs. 

Key takeaways‍

-- Establish robust digital tracking governance to track all personal data elements shared and all third parties receiving personal data

-- Continuously audit websites and apps to  verify that consent choices and applicable opt-out signals are honored, and identify unlawful or unintended disclosures of personal information.

-- Businesses subject to the CCPA must conduct risk assessments for selling or sharing personal information and covered processing of sensitive personal information, subject to applicable exceptions and timing requirements.

Privado AI's Web Auditor verifies whether a website actually stops sharing personal information with advertising partners after a user opts out through the cookie banner or sends a Global Privacy Control signal.