Most of us have flipped a website’s tracking toggles to “off” and wondered whether it actually stopped anything. On fedex.com, according to California’s privacy agency, it looks like those concerns were warranted.
CalPrivacy fined FedEx $2.975 million this week. The order says ad-tech trackers from Meta, LinkedIn, Google, Adobe, and others picked up visitors’ identifiers on fedex.com for targeted advertising, while FedEx’s privacy policy said it didn’t “sell” or “share” personal information. The site had no “Do Not Sell or Share” link and didn’t honor opt-out signals like the Global Privacy Control (GPC). And visitors who switched off the tracking toggles in its cookie preferences window still had some of their data flowing to ad-tech companies. (FedEx neither admitted nor denied the findings.)
CalPrivacy isn’t done with the GPC. The same week the FedEx order was signed, its board voted unanimously to start formal rulemaking on updated opt-out signal rules that name the GPC outright.
Best,
Arlo
New From Osano
Blog: FedEx’s $2.975M CCPA Fine: What CalPrivacy Found and How to Check Your Own Site
Find out what CalPrivacy found on fedex.com, what the stipulated order requires FedEx to fix, and a quick checklist for auditing your own site for the same problems.
In Case You Missed It...
Engineering Blog: “Talking TCF, GPP, and US Privacy for Real.”
Osano’s engineers explain why they built their own encoders for the TC, GPP, and US Privacy strings instead of relying on the IAB’s open-source reference libraries. The post covers a single Kotlin Multiplatform codec shared across the SDKs and a test suite that checks every generated string against the IAB’s own libraries, byte for byte.
Top Privacy Stories of the Week
Five More States Join the FTC’s Case Against Hims & Hers
Arizona, Florida, Nebraska, Ohio, and Wisconsin have joined the FTC’s lawsuit against telehealth company Hims & Hers, alongside Utah and California. The amended complaint alleges Hims told consumers it kept their health information private while sharing it with advertising platforms, including Meta and Snap. It also claims Hims charged for prescriptions almost immediately after intake and made subscriptions hard to cancel.
FedEx Pays $2.975M After Its Trackers Contradicted Its Privacy Policy
California’s privacy agency fined FedEx $2.975 million after finding that ad-tech trackers on fedex.com shared visitors’ identifiers for targeted advertising, while the company’s privacy policy said it didn’t sell or share personal information. The order also says the site ignored opt-out preference signals like GPC, and that switching off the cookie preference toggles didn’t stop some data from reaching ad-tech companies. FedEx neither admitted nor denied the findings but agreed to quarterly tracker scans and testing for the next three years.
PJ&A Settles Over Breach That Exposed 13.3M People’s Health Data
New York, Connecticut, Michigan, and New Jersey settled with medical transcription firm Perry Johnson & Associates and related companies over a 2023 breach that exposed data on 13.3 million people. Attackers got in with an employee’s credentials because remote access didn’t require multifactor authentication. The companies’ software logged the intrusion but wasn’t set to alert anyone, so PJ&A learned about it when the hackers reached out two months later. The companies owe at least $300,000 in penalties, with $9.7 million more due if they break the deal’s terms.
Europe’s Regulators Put AI Hiring Tools Under the Microscope
The European Data Protection Board picked automated decision-making in recruitment, including AI-driven candidate screening tools, as the topic of its sixth coordinated enforcement action. The focus is the GDPR right not to be subject to decisions based solely on automated processing, along with the related right of access. Data protection authorities will opt in over the coming weeks, ahead of a launch in 2027.
West Virginia Sues Snap over My AI and Kids’ Data
West Virginia’s attorney general sued Snap, alleging the company misled parents and children about Snapchat’s safety. The privacy claims center on My AI: the suit says the chatbot can access a child’s location even with Ghost Mode on, and that kids’ My AI conversations go to OpenAI, with their contents shared with Microsoft Advertising for ad targeting. Utah brought similar My AI claims against Snap in 2025.
Like What You See in the Privacy Insider newsletter?
There's more to explore:
🛠️ The Osano Engineering Blog
Learn what we're building, why, and how! New posts released monthly here.
📱 The Osano Subreddit
Join our official subreddit to stay up to date on the latest news, analysis, guidance, and content from Osano!
📖 The Privacy Insider: How to Embrace Data Privacy and Join the Next Wave of Trusted Brands
The book inspired by this newsletter: Osano CEO, Arlo Gilbert, covers the history of data privacy and how companies can start building a privacy program from the ground up. More details here.
If you’re interested in working at Osano, check out our Careers page!
