FedEx to Pay $2.975M CCPA Fine Over Opt-Out Signal Failures

The California Privacy Protection Agency's board adopted a Decision and Stipulated Final Order against Federal Express Corporation on November 6, 2026, requiring a $2.975 million administrative fine and three years of testing obligations over alleged failures to disclose online advertising sharing and to honor browser opt-out signals under the CCPA.

Information last verified on November 12, 2026.

Status: This is a Decision and Stipulated Final Order in CalPrivacy matter ENF25-073-TS-FE, adopted by the agency's board on November 6, 2026 and effective immediately. The compliance clocks are already running: the fine was payable within 30 days of the effective date, the required practice review is due within 180 days, and the injunctive terms run for three years.

Jurisdiction: This is California law. The order binds Federal Express Corporation, and the CCPA provisions it enforces reach businesses that meet the statute's thresholds and do business in California. A CalPrivacy decision does not set law in any other state. Comparable signal requirements do exist elsewhere under other states' own statutes: Connecticut's attorney general states that all controllers subject to the Connecticut Data Privacy Act must honor opt-out preference signals as of January 1, 2025.

What Happened

The board of the California Privacy Protection Agency, which brands itself CalPrivacy, signed an Order of Decision on November 6, 2026 adopting a Stipulated Final Order in Case No. ENF25-073-TS-FE. The order of decision states that the board "hereby adopts the Stipulated Final Order, attached hereto, as its decision in the above-captioned matter," and that the "Decision shall become effective immediately." Board Chair Jennifer M. Urban signed it. The agency announced the action publicly on November 10, 2026.

The complainant is the agency's Enforcement Division. The order records the agency's authority to enforce the CCPA through administrative actions under Civil Code sections 1798.199.40(a) and 1798.199.55, and notes that Government Code section 11415.60(a) allows the agency to issue a decision by settlement, by agreement of the parties, without conducting an adjudicative proceeding (paragraphs 3 and 4).

FedEx stipulated that it meets the CCPA's business thresholds, with annual gross revenue above $26.625 million and annual selling or sharing, in combination, of the personal information of 100,000 or more consumers or households (paragraph 5). The relevant period for the findings is July 1, 2023 to October 27, 2025 (paragraph 28).

What the agency says the trackers did

The order's factual findings describe cookies, pixels and similar technologies on FedEx's public websites and mobile applications. According to paragraph 30, FedEx installed tracking technologies from Meta, LinkedIn, Google, Adobe and other advertising technology companies, which made unique device and user identifiers available to those companies for purposes including targeted advertising. The same paragraph records that the personal information at issue did not include shipping data.

Paragraph 31 describes cookie syncing, in which advertising companies exchange and match their respective tracking identifiers so each can recognize the same individual across different websites and platforms. The agency's theory is that a visit to a shipping company's site is a valuable profile signal, because it may indicate interest in shipping services (paragraph 32), and that the concern persists for business-to-business visits because consumers use personal devices for both work and personal activity (paragraph 33).

On that basis the order concludes at paragraph 35 that FedEx's use of these technologies met the CCPA definition of sharing, because FedEx made consumers' personal information available to third parties for targeted advertising on sites that are not FedEx's. Civil Code section 1798.140(ah) defines sharing to include making personal information available to a third party for cross-context behavioral advertising whether or not for monetary or other valuable consideration.

The three alleged failures

First, disclosure. The order quotes FedEx's privacy policy: "We do not 'sell' or 'share' your Personal Information, including the Personal Data of children under the age of 16, as those terms are defined under California law and have not done so in the previous twelve months" (paragraph 39). The order finds that FedEx provided a "Cookie Consent" link but neither a "Do Not Sell or Share My Personal Information" link nor a "Your Privacy Choices" link (paragraph 40), and that its privacy policy did not address how it processes opt-out preference signals or how consumers can use one (paragraph 41). Paragraph 42 states that FedEx thereby failed to provide the required disclosures, in violation of Civil Code section 1798.130 and sections 7011 and 7013 of title 11 of the California Code of Regulations.

Second, opt-out preference signals. Paragraph 49 states that FedEx failed to configure its digital properties to properly detect and honor those signals. Paragraph 50 is the pinpoint on liability: "Each such sharing of personal information violated section 1798.120(d) of the Civil Code, and sections 7025(c)(1) and 7026(f) of title 11 of the Code of Regulations." The order is blunt about how long the duty has existed, stating at paragraph 48 that "California law has required businesses to honor opt-out preference signals, such as GPC, for more than six years. This obligation has been in place since 2020," and tracing the requirement through three successive regulation numbers.

Third, the request methods that did exist. FedEx offered an online webform through its privacy policy, but the order quotes the form as saying: "This form does not opt you out of cookies or tracking technologies … [y]ou can opt-out of cookies and other tracking technologies at any time by updating your preferences via the 'Cookie Consent' link in the footer of our website" (paragraph 52). The Cookie Preferences window reached through that link included granular controls for Functional, Analytical and Tracking cookies (paragraph 53), with on and off toggles for the Analytical and Tracking categories, but according to paragraph 54, "even after toggling off those cookies, FedEx continued to make certain visitors' personal information available to some AdTech companies." Paragraph 56 adds a separate defect: the cookie window could not serve as an opt-out method at all, because it did not address how the cookie settings apply to the sale and sharing of personal information, citing 11 CCR 7026(a)(4).

The fine and the injunctive terms

Paragraph 61 orders FedEx to pay an administrative fine of $2,975,000 under Civil Code section 1798.199.55, to the agency, no later than 30 days after the effective date of the board's decision. The order states the figure as a single sum and does not allocate it among the alleged violations.

The non-monetary terms are operational. FedEx must scan its digital properties at least quarterly to maintain a full and current inventory of tracking technologies that sell or share personal information; maintain third-party contracts that comply with 11 CCR 7053(a)(1) through (6); and maintain configurations that recognize and give full effect to opt-out requests, whether submitted by an opt-out preference signal such as Global Privacy Control or by another required method, within the timing rules of 11 CCR 7026(f) (paragraph 62). It must test those configurations in both staging and production environments at least quarterly and whenever a new tracking technology is added (paragraph 63).

Further terms require an onboarding process for third parties that receive sold or shared personal information (paragraph 64); a "Do Not Sell or Share My Personal Information" or alternative opt-out link, with no unnecessary burden or friction added to the request (paragraph 65); cookie tools that explicitly address how the control applies to sale and sharing (paragraph 66); an active link in any notice titled with words such as privacy, cookie, ad choices or interest-based advertising that takes the consumer to where the choice is exercised (paragraph 67); and annual posting of the request metrics described in 11 CCR 7102 (paragraph 69).

Three deadlines define the schedule. Paragraph 68 gives FedEx 180 days from the effective date to review its practices for CCPA compliance, including the accuracy of its sell-and-share disclosures and the ease of its opt-out methods. Paragraph 71 allows 210 days to complete implementation of process and system changes. Paragraph 70 keeps the Section VII.B obligations in force for three years, while stating that nothing in the order relieves FedEx of any independent duty to comply with the CCPA afterward.

What FedEx agreed to, and what it did not concede

This is a stipulated order, and the order says exactly how far the concession goes. Paragraph 75 provides: "FedEx admits the truth of paragraphs 1-5 of this Stipulated Final Order. FedEx otherwise neither admits nor denies the factual findings in this Stipulated Final Order. FedEx does not admit liability for any violation of the CCPA, actual or alleged. FedEx agrees to be bound by the terms of this Stipulated Final Order." Paragraphs 1 through 5 are the parties and jurisdiction sections, including the business-threshold stipulation.

FedEx waived its rights to a hearing and to reconsideration, appeal or other review (paragraph 78), and the agency released it from CCPA claims arising from the conduct in the factual findings, conditioned on compliance with paragraphs 61 through 71 (paragraph 73). Failure to pay or to comply with any term results in enforcement in the Superior Court of California (paragraph 81). Albert C. Chin, whose title the order gives as Director, Global Head of Privacy, signed for FedEx on November 1, 2026, with Gibson, Dunn & Crutcher as counsel as to form and content; Acting Deputy Director of Enforcement Lara Kehoe Hoffman signed for the Enforcement Division on November 2, 2026.

In the announcement, Hoffman said: "The time for implementing appropriate disclosures and functionality for opt-out preference signals has long passed," adding, "We will vigorously enforce compliance with this important and long-standing privacy right enjoyed by all Californians." Executive Deputy Director Tom Kemp framed the business-to-business point: "The Board's decision confirms that the CCPA protects Californians from online surveillance, even in a business-to-business (B2B) setting." The agency says Enforcement Division attorneys Lisa B. Kim and Michael Meyer handled the case with investigative assistance from research technologists Nikita Samarin and Primal Wijesekera.

What the Law Actually Says

The underlying right is short. Civil Code section 1798.120(a)(1) provides that "[a] consumer shall have the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer's personal information." Subdivision (d) then prohibits a business that has received that direction from selling or sharing the consumer's personal information afterward unless the consumer later consents. Our explainer on what the CCPA covers and which businesses it reaches walks through the thresholds that bring a company inside the statute in the first place.

Civil Code section 1798.135(a)(1) sets out the notice mechanism: a business that sells or shares personal information must "[p]rovide a clear and conspicuous link on the business' internet homepages, titled 'Do Not Sell or Share My Personal Information,' to an internet web page that enables a consumer, or a person authorized by the consumer, to opt out of the sale or sharing of the consumer's personal information." Subdivision (b)(1) offers an alternative: a business need not comply with subdivision (a) if it lets consumers both opt out of the sale or sharing of personal information and limit the use of their sensitive personal information through an opt-out preference signal sent with the consumer's consent, based on technical specifications in the regulations. Under 11 CCR 7013(d) a business may also substitute the alternative opt-out link of 11 CCR 7015, but it must still post the notice of right to opt out.

The regulations are where the engineering lives. 11 CCR 7026(a) requires two or more designated methods for submitting opt-out requests, and subsection (a)(1) states that a business collecting personal information from consumers online must at a minimum allow requests "through an opt-out preference signal and at least one of the following methods: an interactive form accessible via the 'Do Not Sell or Share My Personal Information' link, the Alternative Opt-out Link, or the business's privacy policy if the business processes an opt-out preference signal in a frictionless manner." Subsection (b) requires those methods to be easy to execute and to require minimal steps. Our page on how the opt-out right works in practice covers the consumer-facing mechanics in more detail.

On the signal itself, 11 CCR 7025(b) provides that "[a] business that sells or shares personal information shall process any opt-out preference signal that meets the following requirements as a valid request to opt-out of sale/sharing," then lists the two requirements: the signal must be in a format commonly used and recognized by businesses, with an HTTP header field or JavaScript object given as examples, and the tool sending it must make clear to the consumer that it is meant to opt them out. Subsection (c)(1) then requires the business to treat a conforming signal as a valid request under Civil Code section 1798.120 for that browser or device and any associated consumer profile, including pseudonymous profiles.

Compliance has a clock. 11 CCR 7026(f)(1) requires the business to cease selling to and sharing with third parties "as soon as feasibly possible, but no later than 15 business days from the date the business receives the request," and subsection (f)(2) requires notifying third parties that already received the information and directing them to comply and forward the request. The regulation's own illustrative example says a business using real-time bidding that can restrict transfers instantaneously must act immediately rather than take the full 15 business days.

The cookie-banner question is answered directly in the text. 11 CCR 7026(a)(4) states that "[a] notification or tool regarding cookies, such as a cookie banner or cookie controls, is not by itself an acceptable method for submitting requests to opt-out of sale/sharing because cookies concern the collection of personal information and not the sale or sharing of personal information," and that an acceptable method "must address the sale and sharing of personal information."

The fine authority sits in two places. Civil Code section 1798.155(a) sets an administrative fine of not more than $2,500 for each violation, or $7,500 for each intentional violation and violations involving the personal information of consumers the business actually knows are under 16, subject to inflation adjustment. The agency's published monetary-threshold update, effective January 1, 2025, raised those amounts to $2,663 and $7,988 and the business revenue threshold to $26,625,000. Civil Code section 1798.199.55(a) authorizes the agency, after determining that violations occurred, to order a violator to cease and desist and to pay fines at the same per-violation levels. For a view of how these duties line up against other states' statutes, see our comparison of state consumer privacy laws.

What Happens Next

Every date in this order runs from the effective date of the board's decision, which the Order of Decision fixes at November 6, 2026. CalPrivacy's board-decisions page lists the FedEx decision under that same date.

The fine comes first. Paragraph 61 gives FedEx no later than 30 days from the effective date to pay $2,975,000 to the agency, which counted from November 6, 2026 falls on December 6, 2026. The order provides for written payment instructions from the Enforcement Division and does not require any public confirmation of receipt.

Then the compliance review. Paragraph 68 sets 180 days, about May 5, 2027, for FedEx to review its privacy policies, notices and other disclosures for whether they accurately state that it sells or shares personal information, the methods by which consumers submit opt-out requests, and the process for fulfilling those requests. Paragraph 71 allows 210 days, about June 4, 2027, to complete implementation of the process and system changes the order requires. Neither paragraph requires FedEx to file anything with the agency on those dates, and the order does not provide for a public compliance report.

The recurring obligations then run for three years. Paragraph 70 keeps the Section VII.B terms in force until about November 6, 2029, and paragraphs 62 and 63 make the tracking-technology scan and the staging-and-production opt-out testing continuing quarterly duties inside that window, with testing also required whenever a new tracking technology is added. Paragraph 69 adds an annual posting of the request metrics described in 11 CCR 7102.

There is no appeal to wait for. Paragraph 78 records that FedEx waived its rights to a hearing and to any reconsideration, appeal or other review, and that by waiving them it consented to the order becoming final. What remains is enforcement. Paragraph 81 provides that a failure to complete the payment or to comply with any term results in enforcement of the order in the Superior Court of California, and paragraph 80 entitles the agency to an award of attorneys' fees and costs if it prevails in seeking to enforce a term.

Nothing in the order schedules a further agency action in this matter. Future decisions of this kind appear on CalPrivacy's board-decisions page as the board adopts them, which is where this one was posted.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The recurring defect in this order is not a missing policy. It is a control that exists, looks like a choice, and does not do the thing it appears to do. According to paragraph 54, a visitor could open FedEx's Cookie Preferences window, switch off Analytical and Tracking cookies, and still have identifiers made available to some advertising companies. On the agency's findings, a reader who did everything the interface invited them to do got the appearance of an opt-out.

That is why the order's testing terms are the interesting part, more than the dollar figure. Paragraph 63 requires quarterly testing in both staging and production, and whenever a new tracking technology is added. Paragraph 62 requires a quarterly scan to maintain a current inventory of the technologies that sell or share. Those are the obligations of a party that is expected to know, on a running basis, which tags are firing on its own pages. The agency is treating privacy-choice functionality as something verified by testing rather than asserted in a document.

The disclosure theory deserves separate attention. The sentence the order quotes from FedEx's privacy policy at paragraph 39 is a flat factual representation about what the company does. The CCPA's definition of sharing at Civil Code section 1798.140(ah) does not turn on money changing hands, so a statement that a company does not sell or share can be measured against the tags actually loading on its site. In the agency's framing at paragraphs 39 and 42, the mismatch between the statement and the behavior is itself the violation of the disclosure rules in Civil Code section 1798.130 and 11 CCR 7011 and 7013.

There is also a structural point in the opt-out preference signal. Under 11 CCR 7026(a)(1), the signal is not an optional extra for an online business; it is one of the minimum methods. A link-based opt-out puts the work on the consumer, once per site. A signal puts the detection work on the business, for every visitor who has set it. That is a different allocation of effort, and the order's insistence at paragraph 48 that the duty dates to 2020 reflects how long the agency considers the question settled.

Finally, the business-to-business framing. The CCPA protects consumers as defined in Civil Code section 1798.140(i), and the order's position at paragraph 33 is that the purpose of a visit does not change that, because identifiers collected on a work-related visit still attach to the same person's broader browsing. We are describing the agency's reasoning in this matter, not predicting how any other dispute would come out.

How This Affects You

For consumers in California, the practical content of the opt-out right is narrower and more specific than it sounds. It is a direction to stop selling or sharing personal information with third parties, not a deletion request and not a ban on a company collecting data for its own use. Civil Code section 1798.105 handles deletion, which is a different request with different rules.

An opt-out preference signal works at the level of a browser or device. Under 11 CCR 7025(c)(1) a conforming signal counts as a valid opt-out for that browser or device and any profile associated with it, and, if the consumer is known to the business, for that consumer as well. What it does not do by itself is travel: a consumer who sets it in one browser has not set it in another browser, on another device, or in a mobile app that does not read it. Paragraph 47 of the order describes the mechanism in technical terms: a standardized HTTP header plus a JavaScript property that a site can detect.

The timing rule matters too. Under 11 CCR 7026(f)(1) a business must stop as soon as feasibly possible and no later than 15 business days, so a tracker that appears immediately after an opt-out is not automatically a violation, although the regulation's own example says a business that can stop instantaneously must do so rather than take the full 15 business days. 11 CCR 7026(g) requires a means for the consumer to confirm the request was processed. CalPrivacy's public site also carries a channel for CCPA complaints, and the agency's Enforcement Division is the body that brings administrative actions of this kind.

For businesses subject to the CCPA, the useful content of this order is the list of things the agency treated as non-compliance in this matter: a privacy policy statement that did not match the tracking technologies in place; no "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link; a request webform that expressly excluded tracking technologies; a cookie tool that did not stop all sharing and did not say how its settings related to sale and sharing; and silence on how opt-out preference signals are handled. Our checklist of CCPA obligations and the overview of California's consumer privacy statutes set out the underlying duties.

That list is a description of one agency's findings in one matter, not a compliance plan, and the injunctive terms in paragraphs 62 through 71 bind FedEx rather than the public. Whether and how any particular company's disclosures, request methods or tag inventory satisfy California law is a question for counsel who can look at that company's actual properties.

This article is legal information, not legal advice. It describes an administrative order and the statutes and regulations it cites, as of November 12, 2026. It does not create an attorney-client relationship and it is not a substitute for advice from a lawyer licensed in your jurisdiction about your own situation.

Related articles

• CCPA opt-out rights and the Do Not Sell or Share link
• What the CCPA covers and which businesses it reaches
• California data privacy laws: an overview
• A checklist of CCPA obligations for businesses
• How state consumer privacy laws compare

Last updated: 2026-11-12. This is a developing story; details verified as of 2026-11-12.

Frequently Asked Questions

What is an opt-out preference signal?

It is a browser or device setting that tells every website a consumer visits that the consumer is exercising the right to opt out of the sale or sharing of personal information, without clicking an opt-out link on each site. Under the CCPA regulations at 11 CCR 7025(b), a business that sells or shares personal information must process a signal that is in a format commonly used and recognized by businesses, such as an HTTP header field or a JavaScript object, and whose sending tool makes clear to the consumer that it is meant to opt them out. The FedEx order describes Global Privacy Control as an example (paragraphs 46 and 47).

Does Global Privacy Control have to be honored in California?

Under 11 CCR 7025(c)(1), when a business that collects personal information from consumers online receives or detects a conforming opt-out preference signal, it must treat the signal as a valid request to opt out of sale and sharing under Civil Code section 1798.120 for that browser or device and any consumer profile associated with it, including pseudonymous profiles. The FedEx order treats Global Privacy Control as such a signal and states at paragraph 48 that the obligation has been in place since 2020.

What is the 'Do Not Sell or Share My Personal Information' link?

Civil Code section 1798.135(a)(1) requires a business that sells or shares personal information to provide a clear and conspicuous link on its internet homepages titled 'Do Not Sell or Share My Personal Information' leading to a web page where a consumer can opt out. Under 11 CCR 7013(a), clicking the link must either opt the consumer out immediately or lead to a page where the consumer can learn about and make that choice. 11 CCR 7015 allows a single alternative link covering both that right and the right to limit the use of sensitive personal information, and requires it to be titled 'Your Privacy Choices' or 'Your California Privacy Choices'.

Is a cookie banner enough to satisfy the CCPA opt-out requirement?

Not by itself. 11 CCR 7026(a)(4) states that a notification or tool regarding cookies, such as a cookie banner or cookie controls, is not by itself an acceptable method for submitting requests to opt out of sale or sharing, because cookies concern collection rather than sale or sharing, and that an acceptable method must address the sale and sharing of personal information. Paragraph 66 of the FedEx order requires any cookie tool FedEx offers for opt-out requests to explicitly address how the control applies to sale and sharing.

How much can CalPrivacy fine a business under the CCPA?

Civil Code section 1798.155(a) sets an administrative fine of not more than $2,500 for each violation, or $7,500 for each intentional violation and for violations involving the personal information of consumers the business actually knows are under 16, as adjusted for inflation. The agency's published consumer price index adjustment, effective January 1, 2025, raised those figures to $2,663 and $7,988. Civil Code section 1798.199.55(a)(2) carries the parallel per-violation figures for agency orders. The FedEx fine of $2,975,000 is a single stipulated sum and the order does not break it into per-violation components.

Did FedEx admit to violating the CCPA?

No. Paragraph 75 of the Stipulated Final Order says FedEx admits the truth of paragraphs 1 through 5, which identify the parties and the jurisdictional thresholds, otherwise neither admits nor denies the factual findings, and does not admit liability for any CCPA violation, actual or alleged. FedEx agreed to be bound by the order's terms and, under paragraph 78, waived its rights to a hearing and to review.

How long do the FedEx compliance obligations last?

Paragraph 70 keeps the non-monetary obligations in Section VII.B in effect for three years from the effective date of the board's decision, which points to about November 6, 2029, while noting that nothing in the order relieves FedEx of any independent CCPA obligation afterward. Paragraph 68 sets a 180-day deadline for the compliance review and paragraph 71 gives 210 days to complete process and system changes.

Does this order apply outside California?

No. It is an administrative decision of a California agency enforcing the CCPA against one company, and it does not set law in any other state. Connecticut's attorney general states separately that all controllers subject to the Connecticut Data Privacy Act must honor opt-out preference signals, such as Global Privacy Control, starting January 1, 2025, so comparable signal requirements do exist elsewhere under those states' own laws.

What happens if FedEx does not comply with the order?

Paragraph 81 provides that failure to complete the payment or to comply with any term results in enforcement of the order in the Superior Court of California. Paragraph 80 adds that if the agency prevails in seeking to enforce a term, it is entitled to an award of attorneys' fees and costs against FedEx, notwithstanding the general rule in paragraph 72 that each party bears its own fees.