[et_pb_section fb_built=”1″ admin_label=”section” _builder_version=”4.17.3″ custom_padding=”0px|||||” global_colors_info=”{}”][et_pb_row admin_label=”row” _builder_version=”4.17.3″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” custom_padding=”0px||0px||false|false” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text admin_label=”Text” _builder_version=”4.17.3″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” custom_padding=”0px||0px|||” global_colors_info=”{}”]<\/p>\n
Under the California Consumer Privacy Act, or <\/span>CCPA<\/span><\/a>, sending data to Meta or Google through a tracking pixel counts as a “sale” (even without an exchange of money) which means it requires your website to have a valid opt-out mechanism. Sephora ($1.2M) and Tractor Supply ($1.35M) were both fined over their lack of compliance with this mechanism. Compliant retailers need three things in place: a consent banner, recognition of Global Privacy Control (GPC) signals, and most importantly validation that their tags actually honor both the banner and the GPC signals. DataTrue tests the third piece, which most programs skip.<\/span><\/p>\n [\/et_pb_text][et_pb_text admin_label=”Text” _builder_version=”4.17.3″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” custom_margin=”||||false|false” locked=”off” global_colors_info=”{}”]<\/p>\n Do you actually know what your marketing pixels are actually telling ad networks about your customers?\u00a0 I\u2019ve sat in more meetings than I can count where smart, well-intentioned marketers and privacy teams at major brands believe that they have this covered. They have a <\/span>Consent Management Platform (CMP)<\/span><\/a>, the banner is on their website, it records their users choices, and shows that it\u2019s working. The problem is that the story doesn\u2019t end there.<\/span><\/p>\n Even just yesterday I had a meeting with a client where DataTrue found some new PII squeaking through from a Meta tag, likely because someone on their marketing agency team made a modification. Without DataTrue flagging it, who knows how long they would have been leaking PII to Meta in violation of the CCPA. Instead they moved to fix the problem within 24 hours.<\/span><\/p>\n The CCPA has a very specific and broad definition of what constitutes a \u201csale\u201d of data. It doesn\u2019t have to be malicious, it just isn\u2019t integrated into your consent framework. That simple act of your Meta or Google pixel sending browsing behavior or user identifiers to the ad platforms qualifies, and if your user has opted out, that data transmission has to completely stop.<\/span><\/p>\n For Sephora and Tractor Supply, it didn’t stop. And they paid a combined $2.55 million in fines to prove it.<\/b> These aren\u2019t outliers, they\u2019re just the ones that got a bill. This is no longer some sort of theoretical risk or best practice, it\u2019s the operational reality that needs a real technical solution, and simply having a consent banner isn\u2019t the be all \/ end all of the solution.<\/span><\/p>\n Your consent banner is a promise. It\u2019s a tool that asks a question, and records the answer, but it by itself is not proof that your systems actually respected the answer. The disconnect happens somewhere after that choice that the user makes with the ongoing behavior of your tags. The case with PlayOn proved it yet another time. Their CMP recorded the user\u2019s rejection accurately, but certain tags kept firing anyway. That\u2019s exactly where the liability sat.<\/span><\/p>\n For enterprise retailers getting this right requires the three distinct layers of protection. Too many\u00a0 companies only have the first one.<\/span><\/p>\n The details matter, so let\u2019s be specific about what went wrong in the cases that we\u2019ve mentioned above.<\/span><\/p>\n Sephora ($1.2M):<\/b> The California Attorney General determined that Sephora was allowing third-party ad tech companies to collect data on user behavior. This was considered an exchange of data for a business benefit (such as better ad targeting) and was deemed a \u201csale\u201d under the CCPA. Sephora failed to notify their customers about this \u201csale\u201d and didn’t provide a clear opt-out mechanism. They also failed to honor GPC signals. The fine wasn\u2019t for having pixels, it was for having pixels that acted in a way that constituted an unmanaged and unconsented sale of personal information.<\/span><\/p>\n Tractor Supply ($1.35M): <\/b>This case was even more focused than Sephora\u2019s. Tractor Supply had a CMP banner, but their website and tags weren\u2019t configured to listen for or to honor any GPC signals. California residents who had GPC enabled in their browsers were still being tracked by third-party analytics and advertising tools. The state made it very clear: honoring a GPC signal is not optional. It\u2019s a legally binding opt-out signal, and ignoring it is a direct and big fine worthy violation.<\/span><\/p>\n Understand, that for these, and the growing number of other fines that California has levied, weren’t some kind of exotic technical failure. They were very basic failures to connect the user’s expressed privacy choice to the actual reality of what the company\u2019s tags were doing. It\u2019s a gap that can only be found with active testing. For more on this, you can read about <\/span>the technical gap in most consent platforms<\/span><\/a> and the details of <\/span>how a Meta Pixel can transmit PII.<\/span><\/a><\/p>\n You cannot, effectively, manually check every tag on every page of your website(s) after every code release. Sometimes you aren\u2019t even aware a change was pushed, or that your marketing agency made a change that wasn\u2019t even on your website. It\u2019s simply not possible at the scale of modern retail. The only viable solution is to have automated testing that simulates user journeys under different consent states, including with GPC enabled, and that validates exactly which tags fire and what data they send and to whom.<\/span><\/p>\n This testing in a perfect world also needs to happen in a pre-production environment, before a code change even goes live. That\u2019s how you can catch an accidental regression that re-enables a pixel or breaks your consent logic. DataTrue is built to do exactly this. It acts like a user, visits your staging site, and provides a clear, timestamped audit trail of what happened, proving that your tags honored the choices you promised they would. Beyond that, it can scan and watch your your website and tags daily, even hourly, to see if something new starts slipping through, and letting you know immediately so you can move to fix the problem as quickly as possible.<\/span><\/p>\n Does CCPA apply to my company if we aren’t based in California?<\/b><\/p>\n Yes. CCPA applies to any business that collects data from California residents, as well as meets certain revenue and data processing thresholds. Given the nature of eCommerce, if you do business in the United States, you almost certainly have California customers and must comply.<\/span><\/p>\n Is turning off our pixels the only way to be compliant?<\/b><\/p>\n No, and for most retailers, that simply isn\u2019t a realistic option. Compliance isn’t about stopping your marketing; it’s about making it consensual. The goal is to ensure your pixels and tags only collect and transmit data when you have a user’s valid consent, or when they have not opted out.<\/span><\/p>\n Our CMP vendor told us their banner makes us CCPA compliant. Is that true?<\/b><\/p>\n A CMP is absolutely a necessary tool, but it is not a complete compliance solution on its own. It manages the front-end collection of consent. It does not, however, typically audit or guarantee that all of your back-end systems are correctly honoring that consent on an ongoing basis. As the PlayOn and Tractor Supply cases show, regulators are focused not on what your banner says, but on what your tags actually do.<\/span><\/p>\n What’s the difference between GPC and a cookie banner opt-out?<\/b><\/p>\n A cookie banner opt-out is a choice that a user makes on your specific site (think the banners that pop up when you load a new site) while GPC is a universal signal sent by the user’s browser to every site they visit, communicating their preference not to be tracked or have their data sold. Under the CCPA, you are legally required to treat the GPC signal as a valid opt-out request without forcing the user to interact with your banner at all.<\/span><\/p>\n Necessary \u201cAsk Your Lawyer\u201d Disclaimer: DataTrue is not providing you legal advice. This content explains the technical mechanisms and factual enforcement history. It does not constitute a legal interpretation or compliance guidance. Readers should consult their own qualified legal counsel for advice specific to their situation.<\/b><\/p>\n Your banner is asking your customers questions and they expect you to honor their answers. Are you absolutely certain your technology is?<\/span><\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" Sephora and Tractor Supply paid a combined $2.55M in CCPA fines over their tracking pixels. A consent banner alone didn’t save them, and it won’t save you. Here’s why compliance takes three layers\u2014and why the one almost everyone skips is the one that actually matters.<\/p>\n","protected":false},"author":14,"featured_media":227142,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[57],"tags":[],"class_list":["post-227132","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-privacy-compliance"],"yoast_head":"\nWhy Your Banner Isn’t Enough<\/b><\/h2>\n
\n
\n
\n
The Sephora and Tractor Supply Fines: A Technical Breakdown<\/b><\/h2>\n
How to Close the Gap<\/b><\/h2>\n
Frequently Asked Questions<\/b><\/h2>\n