FedEx's privacy policy told visitors, "We do not 'sell' or 'share' your Personal Information."
But at the same time, cookies and pixels from Meta, LinkedIn, Google, Adobe, and other ad tech companies were running on fedex.com, collecting device and user identifiers for targeted advertising. On November 10, 2026, the California Privacy Protection Agency (CalPrivacy) announced a $2.975 million fine against FedEx over that discrepancy and three related violations.
If your site runs ad pixels, not only does analyzing this action show you what to avoid, but looking at the fixes CalPrivacy ordered FedEx to make can serve as a set of privacy best practices you can run on your own site.
What Happened in the FedEx Enforcement Action
CalPrivacy's Board adopted a stipulated final order on November 6, 2026, and announced it four days later. FedEx agreed to pay the fine and change its practices, though it neither admits nor denies the factual findings.
The Four CCPA Violations CalPrivacy Cited
1. FedEx's Privacy Policy Said It Didn't Sell or Share Personal Information
The CCPA defines "share" broadly: making personal information available to a third party for cross-context behavioral advertising, whether or not money changes hands. FedEx's trackers made unique device and user identifiers available to ad tech companies for targeted advertising. Some of those companies also synced cookies, matching their IDs so each could recognize the same person on other websites and apps. That matching is the "cross-context" in cross-context behavioral advertising.
Reading between the lines, FedEx didn’t seem to know what its own website was doing with visitor data. A company that knew its pixels counted as sharing wouldn't have written "we do not sell or share" into its policy, and it would likely have built the opt-out link, signal handling, and working cookie controls the law requires (all of which were absent; see below). If you haven't audited what your site sends to third parties, start there. You can't disclose data flows, or offer opt-outs for them, until you know they exist.
2. FedEx Didn't Honor Opt-Out Preference Signals
The Global Privacy Control (GPC) is a browser setting that tells every site a person visits not to sell or share their data. California has required businesses to honor these signals since 2020. FedEx's site wasn't set up to detect them, so visitor data kept flowing to ad tech companies after people had opted out this way.
3. FedEx Had No Opt-Out Link, and Its Request Form Excluded Tracking
FedEx had a "Cookie Consent" link in its footer but no "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link. Its CCPA request form said it plainly: "This form does not opt you out of cookies or tracking technologies."
4. FedEx's Cookie Controls Didn't Stop the Sharing
FedEx's Cookie Preferences window let visitors switch off "Analytical" and "Tracking" cookies. Even after they did, FedEx kept making some visitors' data available to some ad tech companies. The window also didn't explain how those settings related to selling or sharing, which California requires when cookie controls serve as your opt-out.
FedEx's problem is common. When InfoTrust's Tag Inspector audited 450 US websites, 79% kept firing tracking tags after visitors opted out. In this clip from our webinar series with InfoTrust, InfoTrust's Lucas Long walks through a real, anonymized audit of a site whose banner looked like it worked while its tags kept firing.
The CCPA Covers B2B Activity, Too
The CCPA originally included a temporary exemption for personal information collected in business-to-business (B2B) interactions. It expired on January 1, 2023, six months before FedEx's conduct period began. Since then, a California resident browsing your site for work has the same CCPA rights as anyone else. And because people use the same phones and laptops for work and personal browsing, identifiers collected during a work visit can still feed their ad profiles.
"The Board's decision confirms that the CCPA protects Californians from online surveillance, even in a business-to-business (B2B) setting," said Tom Kemp, CalPrivacy's Executive Deputy Director, in the press release. If the CCPA applies to your business, selling mostly to other businesses won't take your website's ad pixels out of scope.
What the Order Requires FedEx to Do
The order turns FedEx's fixes into a schedule, and most of it is a routine worth copying for any site that runs ad tech. Paragraph numbers refer to the decision and stipulated final order.
|
Requirement |
Para. |
|---|---|
|
Scan its sites and apps at least quarterly to keep a full inventory of trackers that sell or share personal information |
62 |
|
Keep contracts that meet California's requirements (Cal. Code Regs. tit. 11, § 7053) with every third party it sells or shares data with |
62a |
|
Configure its sites to honor opt-outs, whether they arrive as GPC signals or through another required method |
62b |
|
Test those configurations in staging and production at least quarterly, and whenever a new tracker is added |
63 |
|
Review new third parties before onboarding them, to confirm the right contract is in place |
64 |
|
Offer a "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link |
65 |
|
Explain how any cookie control used for opt-outs applies to selling and sharing |
66 |
|
Link cookie notices to the place where people actually make the choice |
67 |
|
Review its privacy disclosures and opt-out methods within 180 days |
68 |
|
Post CCPA request metrics on its website every year |
69 |
|
Finish implementation within 210 days; the obligations last 3 years |
70–71 |
Check Your Own Site for the Same Violations FedEx Had
Each of these checks lines up with a problem in the FedEx decision. For a broader list, see the 7 things privacy regulators are looking for on your website.
- List every tracker on your site, then compare that list with what your privacy policy says about selling and sharing.
- Turn on the GPC in a browser that supports it (Firefox, Brave, and DuckDuckGo do). Open the developer console and run navigator.globalPrivacyControl; if it returns true, the signal is on. Then load your site and see whether ad trackers still fire.
- Opt out through your cookie banner, then watch the Network tab in your browser's developer tools for requests to ad platforms.
- Read the fine print on your request form. Does it cover cookies and tracking, or send people somewhere else?
- Check your footer for a "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link.
Where Osano Fits
Spot checks catch problems once, but compliance drifts. Your website changes, the rules change, and your business changes, so these checks need to run on an ongoing basis.
- Honoring opt-out signals: With GPC support turned on, Osano CMP detects the signal. For US visitors, it automatically sets and locks "Do Not Sell or Share" and switches off marketing and targeted advertising. It also shows the "opt-out honored" indicator California requires.
- Finding gaps before a regulator does: Osano's free privacy audit checks whether your site honors GPC signals, whether banner opt-outs actually block trackers, and whether your privacy policy is current and gives people a way to submit requests. Customers can run Compliance Check on a schedule, up to daily on Pro plans.
- Vetting vendors before their tags go live: The order requires a review before FedEx onboards a new third party. Osano Assessments includes a vendor privacy assessment based on the NIST Privacy Framework, and you can send it to vendors who don't have an Osano account. Osano also handles recurring assessments and reminders.
Osano also offers the No Fines, No Penalties Guarantee. It gives us every reason to keep the product current as regulators' expectations change, which puts us on the same side of the table as our customers. If you use Osano as documented, the guarantee covers up to $500,000 in penalties.
FAQ
Why Was FedEx Fined Under the CCPA?
CalPrivacy found that FedEx's privacy policy said it didn't sell or share personal information while ad tech trackers on fedex.com shared visitor identifiers. The decision also found that FedEx ignored opt-out preference signals, that its request form excluded tracking, and that its cookie controls didn't fully stop the sharing. FedEx neither admitted nor denied the findings.
How Much Was the FedEx CCPA Fine?
The fine was $2.975 million, plus 3 years of compliance obligations, including quarterly tracker scans and opt-out testing.
Does the CCPA Apply to B2B Companies?
Yes. The CCPA's temporary exemption for B2B data expired on January 1, 2023. If the CCPA applies to your business, California residents who visit your site for work have the same rights as any other consumer.
What Is the Global Privacy Control?
The Global Privacy Control is a browser setting that sends a "do not sell or share" signal to every website a person visits. California treats it as a valid opt-out request for businesses that sell or share personal information.
See How Your Site Holds Up to Regulatory Scrutiny
Run Osano's free privacy audit. Our privacy team scans your site for the issues in the FedEx decision, including GPC signals, opt-outs that don't block trackers, and gaps in your privacy policy, then tells you what to fix first. Results usually arrive within one business day.
U.S. Data Privacy Checklist
Stay up to date with U.S. data privacy laws and requirements.
Download Your Copy
