Privacy & Information Security Law Blog

The authority of the California Privacy Protection Agency (“CPPA”) to examine companies’ conduct prior to the enactment of regulations implementing the California Consumer Privacy Act in 2023 (“2023 CCPA Regulations”) recently has been challenged. On August 6, 2025, the California CPPA announced that it had filed a petition in Sacramento County Superior Court to enforce an investigative subpoena against Fortune 500 rural lifestyle retailer Tractor Supply Company (“Tractor Supply”).

According to the petition, the CPPA issued a subpoena to Tractor Supply in January 2025 requesting information about its privacy practices, including facts about the company’s: (1) processing of consumer rights requests, (2) use of technology to track consumers who visit the company’s website, and (3) relationship with entities who receive consumers’ personal information. The subpoena requested that Tractor Supply provide information covering the period between January 1, 2020, the date when the California Consumer Privacy Act (“CCPA”) became operative, and the present.

Although the subpoena required Tractor Supply to answer questions under oath, the CPPA alleges that the company failed to answer questions about its privacy practices prior to January 1, 2023 – three years after the CCPA’s effective date. According to the petition, Tractor Supply has asserted that the agency’s requested lookback period is overbroad, and that the company’s privacy practices before 2023 fall outside of the scope of the CPPA’s enforcement authority, as the 2023 CCPA Regulations had not yet been in effect.

In response, the CPPA asserts that “although regulations implementing aspects of the law followed over time, including in 2020, 2021, and 2023, any changes in the law do not abrogate the Agency’s authority to investigate possible violations.”

This action marks the first time the CPPA has publicly disclosed an ongoing investigation, and highlights the CPPA’s position that it has the ability to enforce the CCPA prior to the publication of the 2023 CCPA Regulations.