California privacy regulator fines FedEx $2.975 million over advertising data

The California Consumer Privacy Act gives residents the right to stop businesses from selling or sharing their personal information, and California has required companies to honor opt-out preference signals, including the browser-based Global Privacy Control, since 2020. Those rules reach the cookies and pixels that power cross-context behavioral advertising, the tracking that follows a visitor across websites. For a company that runs a consumer-facing website alongside a business-to-business operation, the obligation touches nearly every page.

The California Privacy Protection Agency, known as CalPrivacy, announced on November 10, 2026 that its Board had ordered Federal Express Corporation, the shipping and logistics company, to pay a $2.975 million administrative fine and to adjust its business practices. The decision resolved claims that the company violated the CCPA through the cookies, pixels and opt-out controls attached to its digital properties.

CalPrivacy's Enforcement Division alleged that FedEx falsely stated it did not sell or share personal information when it participated in cross-context behavioral advertising. The Board's decision further stated that the company failed to honor opt-out preference signals, that its webform for CCPA requests did not apply to online tracking technologies, and that its cookie controls, which were supposed to address those tracking technologies, did not work properly.

The underlying order carries Case No. ENF25-073-TS-FE and was signed on November 6, 2026, with the Board adopting it as its decision effective immediately. FedEx signed on November 1, 2026 through Albert C. Chin, its Director and Global Head of Privacy, with Cassandra Gaedt-Sheckter of Gibson, Dunn and Crutcher as counsel. CalPrivacy's Enforcement Division signed on November 2, 2026 through Acting Deputy Director Lara Kehoe Hoffman and attorneys Lisa B. Kim and Michael Meyer.

Key Facts

CalPrivacy stated in its stipulated final order, adopted on November 6, 2026, that the fine is set at $2,975,000 and must be paid within 30 days of the effective date. The conduct at issue covers July 1, 2023 to October 27, 2025. The non-monetary terms run for three years, with required system changes completed within 210 days and annual publication of the company's request metrics.

At the center of the case are cookies and pixels from Meta, LinkedIn, Google, Adobe and other ad-tech companies placed on FedEx's digital properties. The order states that these tools made unique device and user identifiers available for targeted advertising, and that some ad-tech firms also engaged in cookie syncing to match identifiers across sites. The order names Meta, LinkedIn, Google and Adobe directly while leaving room for the other ad-tech companies that received identifiers from those properties.

FedEx's privacy policy stated: "We do not sell or share your Personal Information, including the Personal Data of children under the age of 16, as those terms are defined under California law and have not done so in the previous twelve months." The order says FedEx provided no "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link and did not explain how it processes opt-out preference signals.

The order also found that FedEx failed to configure its properties to detect and honor the Global Privacy Control. Even after visitors toggled off "Analytical" and "Tracking" cookies, the company continued to make some visitors' personal information available to certain ad-tech companies, according to the decision.

Beyond the money, FedEx must inventory online tracking technologies quarterly, meet configuration requirements so contractual instructions are followed, and test opt-out compliance and CCPA request methods quarterly. It must maintain an effective "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link on its websites and mobile applications, and any cookie notice used for opt-out requests must explicitly address how the cookie control applies to sales or sharing and include an active link to where consumers can exercise that choice.

Analysis

CalPrivacy framed the outcome as a straightforward application of a settled right. "The time for implementing appropriate disclosures and functionality for opt-out preference signals has long passed," said Lara Kehoe Hoffman, Acting Deputy Director of Enforcement. "We will vigorously enforce compliance with this important and long-standing privacy right enjoyed by all Californians."

Tom Kemp, Executive Deputy Director, said the decision confirms the CCPA protects Californians from online surveillance "even in a business-to-business (B2B) setting." That framing matters because FedEx is not a media company or an ad network. It is a delivery business whose website happens to host marketing pixels, and the agency treated the resulting data flows as sales or sharing under the statute.

Bloomberg Law reported on November 10, 2026 that FedEx will pay the $2.975 million to resolve claims it illegally shared customers' personal information with Meta Platforms Inc., Alphabet Inc.'s Google and others through tracking technologies on its site. Cassandre Coyer of Bloomberg Law wrote on November 10, 2026 that for years the delivery company had installed tracking tools such as cookies and pixels from Meta, LinkedIn Corp., Google and Adobe on its website to share customers' personal data with them.

What this really means is that the notice and choice model at the heart of California privacy law now depends on engineering, not paperwork. A privacy policy sentence denying that data is sold, paired with a cookie banner that does not actually stop the pixels, is no longer a defensible combination in California. The order does not require FedEx to abandon advertising technology; it requires the company to know what sits on its sites, to make the controls operational, and to prove through quarterly testing that an opt-out changes what happens behind the page. The settlement also carries limits: FedEx admits the truth of paragraphs 1 through 5 of the order but otherwise neither admits nor denies the findings and does not admit liability.

Why It Matters

Opt-out preference signals are only useful if they are machine readable and honored by default. California has required businesses to honor them since 2020, and the Global Privacy Control sends that signal from the browser. When a company fails to configure its properties to detect GPC, every visitor who relies on it is silently opted back in. The FedEx order treats that failure as a violation, not a technicality.

The ad-tech supply chain compounds the problem. Cookies and pixels from multiple vendors, plus cookie syncing to match identifiers across sites, mean a single marketing tag can move a user's identifier through several companies. A business that cannot inventory those tags cannot honestly describe what it does with personal information, and the required quarterly inventory is designed to close that gap. Quarterly testing is the enforcement mechanism the order prefers, because it checks repeatedly that an opt-out produces the result the law promises rather than accepting a one-time fix.

For other companies, the practical lesson is that cookie banners are now audit evidence. The order requires that any cookie notice used for opt-out requests explicitly address how the control applies to sales or sharing and link to where consumers can exercise the choice. That is a design requirement, and it applies to mobile applications as well as websites.

Next Up

FedEx has 30 days to pay the $2,975,000 and 210 days to complete the required system changes, with three years of testing, reporting and annual publication of request metrics ahead. The company must also keep an effective "Your Privacy Choices" or "Do Not Sell or Share My Personal Information" link live on its sites and apps.

CalPrivacy said in its November 10, 2026 announcement that it has also reached a $12.75 million settlement with General Motors over connected-vehicle data sharing, a $1.35 million decision against Tractor Supply Company and a $1.10 million decision against PlayOn Sports. The FedEx order adds shipping and logistics to that list, and the first annual metrics FedEx must publish will show how far the agency's reading of the law travels.