FedEx Pays $2.975 Million Over GPC, a Cookie Banner and a "We Don't Share" Policy

FedEx's privacy policy said it didn't sell or share personal information, while its website loaded pixels from Meta, LinkedIn, Google and Adobe. California's privacy regulator has now put a price on that gap: $2.975 million. If your privacy policy was written before your tag manager filled up, this one is worth reading closely.

What Happened

The CalPrivacy Board adopted a stipulated final order against Federal Express Corporation on November 6, 2026, and the agency announced it on November 10. FedEx must pay the administrative fine within 30 days of the Board's November 6 decision. It neither admits nor denies the findings and does not admit liability.

According to the order, which covers July 2023 through October 2025, fedex.com ran cookies and pixels that made device and user identifiers available to ad tech companies for targeted advertising, and some of those companies synced identifiers with each other. No shipping data was involved. The agency treated this as "sharing" under the CCPA, and it heads off the obvious B2B defense: people browse on the same devices for work and home, so a business visitor's identifiers still feed consumer ad profiles.

Against that sharing, the order lists these failures:

• The privacy policy denied selling or sharing, and never explained how FedEx processed opt-out preference signals.
• There was no "Do Not Sell or Share" or "Your Privacy Choices" link, only a "Cookie Consent" link in the footer.
• The site didn't detect or honor Global Privacy Control, so sharing continued for visitors whose browsers sent the signal.
• The privacy request webform said outright that it didn't cover cookies or tracking, and sent people to the cookie panel. Switching off "Analytical" and "Tracking" there still left some visitors' data flowing to some ad tech companies, and the panel never said how it related to sale or sharing, which § 7026(a)(4) requires before a cookie tool can count as an opt-out method.

The order points out that California has required businesses to honor signals like GPC since August 2020. Lara Kehoe Hoffman, the agency's acting deputy director of enforcement, put it bluntly: the time for implementing disclosures and opt-out preference signal functionality "has long passed."

What Website Owners Should Do

The remedies run for three years, and they read like a checklist anyone can borrow. FedEx must scan its sites at least quarterly to keep an inventory of trackers that sell or share, then test its opt-out setup in staging and production every quarter and whenever a new tracker goes live. It also needs CCPA-compliant contracts with every third party it shares with, a working opt-out link, cookie controls that explicitly address sale and sharing, and annual publication of the request metrics in § 7102.

A smaller site can run the cheap version this week. Put your privacy policy's sale/share sentence next to the tags in your tag manager; if an ad pixel fires, "we don't share" is probably wrong. Then open your site in a browser that sends GPC and watch the network tab for ad requests. Last, click your own banner's reject button or toggles and check whether those requests actually stop. A banner that closes politely while pixels keep loading is a big part of what FedEx just paid for.

Where Privisy Fits

Most of the failures in this order show up from outside the site, which is where a Privisy audit looks. It flags a policy that denies selling or sharing while the scan observes marketing trackers, checks for the Do Not Sell or Share link and the policy's opt-out preference signal disclosure, reloads pages with GPC on to see which trackers keep firing, and clicks a detected banner's reject control to confirm marketing cookies and requests stop with it. Each finding names the regulation it falls under. As the order's quarterly testing implies, a pass today says little about the site after next month's tag release, so rerun it after changes.