FedEx has agreed to pay a $2.975 million fine and overhaul its website privacy practices after California’s privacy regulator found it had broken the California Consumer Privacy Act (CCPA).
The California Privacy Protection Agency’s board approved the settlement on 6 November 2026. It covers conduct between July 2023 and October 2025.
According to the agency, FedEx’s websites used cookies and tracking pixels that shared visitors’ device and user identifiers with ad-tech companies, including Meta, LinkedIn, Google and Adobe, for targeted advertising.
At the same time, FedEx’s privacy policy told consumers that it did not sell or share their personal information. The regulator found that statement to be inaccurate.
The company also had no “Do Not Sell or Share My Personal Information” link and failed to honour opt-out signals such as Global Privacy Control, so tracking continued even after consumers had opted out.
Under the order, FedEx must scan its websites for trackers every quarter, keep compliant contracts with third parties, test its opt-out systems regularly and complete the required changes within 210 days. These obligations last three years.
FedEx did not admit liability. A spokesperson said the matter “did not involve any customer shipping records or sensitive personal data,” and that the company is working to address the concerns.
The case comes about 14 months after California, Colorado and Connecticut jointly targeted businesses that were ignoring Global Privacy Control signals.
For companies everywhere, including in India under the DPDP Act, the message is clear: what a privacy policy promises must match how a website actually handles data.
