FedEx Pays $2.975M for Ignoring California Opt Outs

You type a tracking number into fedex.com to see where your parcel is. In the background, according to California's privacy regulator, the page was handing identifiers for your browser to advertising companies, so the fact that you were shipping something could follow you around the web. On November 6, 2026, the Board of the California Privacy Protection Agency, which now calls itself CalPrivacy, adopted a stipulated final order requiring Federal Express Corporation to pay $2,975,000 and rebuild how its websites and apps handle opt outs. The agency announced the decision on November 10. The same Board meeting also voted to start formal rulemaking that would spell out, in plain regulatory text, how browser opt out signals must work.

Key Takeaways

• CalPrivacy's Board ordered Federal Express Corporation on November 6, 2026 to pay a $2,975,000 administrative fine under the California Consumer Privacy Act, in case ENF25-073-TS-FE.
• FedEx placed tracking technologies from Meta, LinkedIn, Google and Adobe on its digital properties, which made unique device and user identifiers available for targeted advertising between July 1, 2023 and October 27, 2025, according to the order.
• FedEx's privacy policy said it did not sell or share personal information, its site did not honor Global Privacy Control, and turning off tracking cookies in its Cookie Preferences window still left some visitors' data flowing to some ad tech companies.
• The order requires quarterly tracker inventories and quarterly opt out testing for three years, plus a working Do Not Sell or Share link, with changes completed within 210 days.
• CalPrivacy's Board voted unanimously the same day to begin formal rulemaking on opt out preference signals, including making clear that signals must be honored before cookies or other tracking technologies are set.

What Did FedEx Do Wrong?

FedEx shared visitors' personal information with ad tech companies through cookies and pixels while telling those visitors it did no such thing. The order's factual findings name the trackers: tools from Meta, LinkedIn, Google, Adobe and other ad tech companies, which assigned identifiers to your browser and made them available for targeted advertising. The order notes that this data did not include shipping data. What it did include was enough to recognize you across sessions and sites.

Some of those companies also ran cookie syncing, which the order describes as exchanging and matching tracking identifiers so each company can recognize the same person on different websites. CalPrivacy's argument is that a visit to a shipping site is a useful signal in itself, because it suggests interest in shipping services, and that syncing lets it land in a much bigger profile.

Meanwhile, the privacy policy said: "We do not 'sell' or 'share' your Personal Information, including the Personal Data of children under the age of 16, as those terms are defined under California law and have not done so in the previous twelve months." Under the CCPA, "share" covers handing data to a third party for cross context behavioral advertising whether or not money changes hands (Civil Code section 1798.140). By that definition, the order says, FedEx was sharing.

How Did the Opt Out Controls Fail?

Every route a Californian could use to say stop was broken in a different way. The order lists three failures:

• No opt out link. The site had a Cookie Consent link in the footer but neither a Do Not Sell or Share My Personal Information link nor a Your Privacy Choices link, both of which the regulations require from a business that shares.
• Global Privacy Control ignored. Global Privacy Control is a browser setting that sends a standard HTTP header and a JavaScript property telling every site you want out of sale and sharing. FedEx's properties were not configured to detect and honor it, so data kept flowing to multiple ad tech companies.
• A webform that excluded trackers, and cookie toggles that leaked. FedEx's privacy request form stated: "This form does not opt you out of cookies or tracking technologies." It sent people to the Cookie Preferences window instead. There, even after a visitor switched off Analytical and Tracking cookies, FedEx continued to make some visitors' personal information available to some ad tech companies.

The cookie window had a second problem. California regulations let a business use cookie settings as an opt out only if the settings explain how they apply to the sale or sharing of personal information. FedEx's did not, so even a perfectly working toggle would not have counted.

How Long Has Honoring GPC Been Required?

California has required businesses to honor opt out preference signals since August 14, 2020, which the order counts as more than six years. The rule moved between regulation numbers three times (section 999.315, then 7026, then 7025 since March 29, 2023), but the duty never lapsed. The period CalPrivacy examined runs from July 1, 2023 to October 27, 2025, roughly 28 months, and it starts almost three years after the obligation began. FedEx was not caught out by a new rule.

The PlayOn case, covered in our story on the CalPrivacy fine over student ticket data, also turned on tracking that families could not meaningfully refuse. The Disney settlement over ignored opt outs was another case about opt outs that did not stick. FedEx is the clearest case yet in which the company's own written promise was the problem.

What Does FedEx Have to Change?

Beyond the fine, due within 30 days, FedEx accepted three years of operating conditions. The stipulated order requires it to:

1. Scan its websites and apps at least quarterly to keep a full inventory of tracking technologies that sell or share personal information.
2. Configure those properties to give full effect to opt outs, whether they arrive through GPC or another method.
3. Test those configurations in staging and production at least quarterly, and every time a new tracker is added.
4. Keep compliant contracts with every third party it sells or shares data with, through a formal onboarding process.
5. Add a Do Not Sell or Share My Personal Information or Your Privacy Choices link that works without unnecessary friction.
6. Make any cookie tool used as an opt out explain how it applies to sale and sharing, and put an active link in any notice whose title mentions privacy, cookies, ad choices or interest based advertising.
7. Rewrite its privacy policy and notices within 180 days so they state accurately whether it sells or shares data, and post annual request metrics.

Process and system changes must be finished within 210 days. FedEx admitted only the jurisdictional facts and neither admitted nor denied the rest. It signed on November 1, 2026, through its Global Head of Privacy.

What Did the November 6 Rulemaking Vote Change?

Nothing yet, legally, but it shows where the rules are heading. IAPP reported that the Board voted unanimously to begin formal rulemaking on opt out preference signals. The draft formally recognizes Global Privacy Control as a signal and adds examples covering pseudonymous profiles, cookie syncing, and browser features that disclose personal information. According to Hunton Andrews Kurth's summary, the proposal would "clarify that online platforms must honor opt-out preference signals before setting cookies or other tracking technologies on their websites." Businesses would also have to report how many opt out requests reached them through browser signals.

Put the two actions side by side and the message is consistent. The FedEx order already demands quarterly checks that opt outs take full effect. The draft rule would make the timing explicit: the signal has to win before the first tracker loads, not after. A formal 45 day public comment period comes next, and the amendments take effect only after Board adoption and review by the Office of Administrative Law.

Why This Matters Even for Business Visitors

CalPrivacy rejected the idea that business to business traffic is exempt from the concern. The order notes that people use the same personal devices for work and personal browsing, so identifiers collected while you book a shipment for your employer can join your broader profile. The agency's announcement stressed the same point, telling companies to assess their B2B operations.

For compliance teams, the size of the fine matters less than the shape of the order. A quarterly tag scan, a test that GPC actually stops trackers, and a policy that matches what the tags do are now written terms in a California enforcement order, and they amount to a de facto checklist. The agency's own release lists earlier fines against Tractor Supply ($1.35 million) and PlayOn Sports ($1.10 million); FedEx's is more than double the first. Studies such as the one in our piece on how often big tech ignores opt out signals suggest FedEx is far from the only site with this gap.

How Can You Protect Yourself Right Now?

Turn on Global Privacy Control, then assume some sites will still ignore it. The GPC project site lists supporting browsers and extensions, including Firefox, Brave, DuckDuckGo and Privacy Badger. Practical steps:

• Enable GPC in your browser or a supporting extension, so every California covered site receives your opt out automatically.
• Use the Do Not Sell or Share link too on sites you visit often, since a webform request creates a second record.
• Do not rely on cookie banners alone. The FedEx order shows a switched off toggle did not stop all sharing.
• Report sites that ignore your signal through CalPrivacy's complaint process; FedEx's case shows the Enforcement Division tests these flows directly.

The Bottom Line

FedEx's privacy policy said one thing and its tags did another, for at least 28 months, under a rule that has existed since 2020. The $2.975 million fine is modest for a company of its size. The quarterly tag scans and opt out tests are the more important part, and the draft rule requiring signals to be honored before any tracker loads would apply the same expectation to every covered business. For more on how widely the gap reaches, see our analysis of hospital websites that ignore GPC.