FedEx Fined $2.975M Under CCPA for Ad Trackers and Ignored GPC Signals

The California Privacy Protection Agency (CalPrivacy) has fined Federal Express Corporation $2.975 million under the CCPA. The Board adopted the decision on November 6, 2026 and the agency announced it on November 10. The order says FedEx ran advertising trackers on its website while telling visitors it did not sell or share their data, and that the site did not honour opt-out signals such as Global Privacy Control (GPC).

FedEx Fined $2.975M Under CCPA for Ad Trackers and Ignored GPC Signals

The fine is more than double the $1.35 million Tractor Supply paid in 2025, and it is the largest administrative fine the agency's Board has issued so far. FedEx agreed to the order without admitting or denying the findings, and it does not admit liability.

What the Order Says

The order covers July 1, 2023 to October 27, 2025. It makes four findings about fedex.com.

Ad trackers counted as "sharing"

FedEx had installed tracking technologies from Meta, LinkedIn, Google, Adobe and other ad tech companies. These cookies and pixels made unique device and user identifiers available to those companies for purposes that included targeted advertising. Shipping data was not involved.

Under the CCPA, making personal information available to a third party for cross-context behavioural advertising is "sharing", whether or not money changes hands. The agency also rejected the idea that a business-to-business site is different: people use the same devices for work and personal browsing, so identifiers collected on a work visit end up in the same advertising profiles.

The privacy policy said the opposite

FedEx's privacy policy stated: "We do not 'sell' or 'share' your Personal Information." Because the trackers were sharing data, the agency treated this statement as false. The site also had no "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link, only a "Cookie Consent" link in the footer, and the policy did not explain how opt-out preference signals are handled.

GPC signals were not honoured

According to the order, FedEx "failed to configure its digital properties to properly detect and honor consumers' opt-out preference signals". Visitors who browsed with GPC turned on had already opted out, and their data continued to go to ad tech companies. The agency points out that California has required businesses to honour these signals since 2020.

The cookie preferences did not stop the sharing

The FedEx opt-out webform stated that it did not cover cookies and sent people to the "Cookie Consent" link instead. That link opened a window with toggles for "Functional", "Analytical" and "Tracking" cookies. The order says that even after a visitor switched off the analytical and tracking toggles, FedEx continued to make some visitors' personal information available to some ad tech companies.

The window also did not mention sale or sharing at all. A cookie tool can only count as a CCPA opt-out method if it explains how the cookie settings apply to the sale and sharing of personal information.

What FedEx Has to Do Now

Besides the fine, the order sets obligations that run for three years:

• Scan its websites and apps at least every quarter and keep a current inventory of trackers that sell or share personal information
• Keep CCPA-compliant contracts with every third party it sells or shares data with, and review new third parties before they are added
• Configure its sites and apps to give full effect to opt-outs, whether they arrive through GPC or another method
• Test that configuration in staging and production at least every quarter, and whenever a new tracker is added
• Provide a "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link, without adding unnecessary steps
• Make any cookie tool used for opt-outs state how it applies to sale and sharing
• Publish its CCPA request metrics on its website every year

Lessons for Your Website

If you run ad pixels, you probably "share"

A Meta Pixel, LinkedIn Insight Tag or Google Ads tag that supports ad targeting is enough. If those tags are on your site, a privacy policy that says "we do not sell or share" is a liability. Check the tags first, then write the policy to match.

GPC has to change what the page loads

Detecting the signal is not enough. When a visitor arrives with GPC on, advertising tags that share data must not run for that visitor. In its announcement, the agency's acting head of enforcement said "the time for implementing appropriate disclosures and functionality for opt-out preference signals has long passed". From 2027, California's Opt Me Out Act also requires browsers to offer a built-in opt-out signal, so more of your visitors will send one.

A cookie banner is not automatically a CCPA opt-out

FedEx had a cookie preferences tool, and it was not enough. The tool has to say that it controls sale and sharing, it has to stop the trackers when a visitor opts out, and the site still needs the opt-out link. The Coca-Cola class action raises the same problem from the plaintiff side: a control that does not change what the tags do.

Test it every quarter, and after every new tag

The order requires quarterly scans and tests, plus a test whenever a tracker is added. That is a reasonable standard for any site. To check yours, turn on GPC in Firefox or Brave, load your pages and look at the network tab. Requests to advertising vendors with GPC on are what the agency found on fedex.com.

B2B sites are covered

FedEx is mostly used for business shipping, and that did not help. If your company meets the CCPA thresholds and your site has ad trackers, the rules apply even when your customers are other businesses.

How UniConsent Helps

UniConsent detects GPC in the visitor's browser and opts that visitor out automatically, without them opening the notice. Advertising tags such as the Meta Pixel, LinkedIn Insight Tag and Google tags are held back for opted-out visitors, and the opt-out is passed on to your ad partners through IAB GPP. You set this up in the dashboard with the Tags Loader, without changing your website code.

UniConsent also adds the "Do Not Sell or Share My Personal Information" link to your footer for US state privacy laws, scans your site every day for new cookies and keeps a record of every choice.

FAQ

Did FedEx admit to breaking the law? No. FedEx agreed to the order but neither admits nor denies the findings, and does not admit liability.

We do not sell data for money. Does this still apply? Yes. Under the CCPA, making personal information available to an ad tech company for cross-context behavioural advertising is "sharing", even if nothing is paid.

How do I check whether my site honours GPC? Open your site in a browser with GPC enabled and check navigator.globalPrivacyControl in the console. Then watch the network tab for requests to advertising vendors. If they still fire, the signal is not being honoured.

Is GPC only a California requirement? No. Other states, including Colorado, Connecticut and Texas, also require websites to honour it. See our US privacy guide.

Sign up and set up GPC and US opt-outs on your website in a few minutes.

References

• Federal Express to Change Practices and Pay Close to $3 Million Fine Over CCPA Privacy Violations - CalPrivacy
• In the Matter of Federal Express Corporation: Decision and Stipulated Final Order (PDF)
• California Privacy Agency Fines FedEx Nearly $3M - MediaPost