Privacy CompliancePrivacy Notices
How Often Must a Privacy Policy Be Updated? California Says Every 12 Months.
Regulators differ on minimum privacy notice update requirements. California requires an update at least once every 12 months, and Florida requires one at least annually. In 2025, California fined Tractor Supply $1.35 million for a policy that had not been updated in more than two years.
By Alex Proctor
Published September 23, 2026
Summary
When a regulator examines a privacy notice, the first thing they look at is the date of the last update. California requires a business to update its policy at least once every 12 months, whether or not its practices have changed. In September 2025, California's privacy agency fined Tractor Supply $1.35 million over a policy that had not been updated since November 2021. Florida also requires annual updates, and seven other states require a dated notice.
What Does California Require?
The privacy notice update rule sits in Civil Code section 1798.130. A business has to describe consumers' rights and its data practices and "update that information at least once every 12 months." The notice must cover the categories of personal information collected in the preceding 12 months, whether it was sold or shared, and who received it. Any update requires a review of these factors, not only a new date.
Which Changes Require an Update Sooner?
The 12-month rule is a bare minimum. A privacy policy has to change whenever the practices it describes change, because regulators test each statement against what the business does. Common changes that necessitate updates may include:
- A new advertising, analytics, or social media tag on the website
- A new category of personal information collected, or a new purpose for it
- A new vendor or type of recipient that receives personal information
- A new use of AI, including training a model on personal data
- A change to the request form, email address, or other method for exercising rights
- A new state law that adds a right or a required disclosure
These types of changes necessitate immediate changes to privacy notices and should not be saved for the next annual review. The new tag example is one I see regularly. Companies add new technology to websites without realizing that it has implications for the privacy notice as it describes sale, sharing, and web tracking in general.
What Happened to Tractor Supply?
Tractor Supply is the largest rural lifestyle retailer in the country, with more than 2,500 stores. In September 2025, the California Privacy Protection Agency fined it $1.35 million, which was the largest fine in the agency's history at that point. The investigation started with a complaint from one consumer in Placerville, California.
The order is specific about the issues surrounding the privacy notice update dates. It says the policy was posted in September 2018, updated in November 2021, and not updated again until after the company learned of the investigation in 2024. The statute allows 12 months between updates, and the gap ran past two years. The agency cited section 1798.130(a)(5) for that finding.
The order covers other violations as well, including the consumer rights the policy failed to list, insufficient notice to job applicants, opt-out preference signals it did not honor, and vendor contracts missing required terms.
Which States Require a Date on the Notice?
California's privacy law sets a schedule, and its regulations also require the date of the last update. Florida requires an update at least annually, although its law reaches only a handful of the largest companies.
Seven other states require one of those items. Colorado, New Hampshire, Minnesota, Montana, Connecticut, and Vermont require the date of the last update, and New Jersey requires an effective date and the change process, which the business must follow.
| State and law | Requirement | Since |
|---|---|---|
| CaliforniaCalifornia Consumer Privacy Act |
| 2020 |
| FloridaFlorida Digital Bill of Rights |
| 2024 |
| ColoradoColorado Privacy Act |
| 2023 |
| New HampshireNew Hampshire Privacy Act |
| 2025 |
| New JerseyNew Jersey Data Privacy Act |
| 2025 |
| MinnesotaMinnesota Consumer Data Privacy Act |
| 2025 |
| MontanaMontana Consumer Data Privacy Act |
| 2025 |
| ConnecticutConnecticut Data Privacy Act |
| 2026 |
| VermontVermont Data Privacy and Online Surveillance Act |
| 2028 |
Statutes and regulations as of September 2026.
The remaining states do not set a schedule or require a date. Every one of them still requires the notice to be accurate, so a policy that describes outdated practices is a problem in all 20 states, even where no rule mentions the date.
Is Changing the Date Enough?
No. A full review is needed. Changing the date without doing a review only masks the problem, because a regulator who reads the policy will compare it with the tags running on the site and the request forms and opt-out links it points to.
What Should an Annual Review Cover?
The review should compare each factual statement in the policy with what the business does today. This may include the tags running on the site, the vendors receiving data, the categories of information collected, and the request methods the policy lists, all of which can change over a year. The consumer rights section should also be checked against the current list of state laws, because those laws change quickly. For example, three new state laws took effect in January 2026 alone.
I recommend a quarterly review rather than the annual minimum, because business operations and state laws change more often than once a year. With an annual review, an inaccurate statement can remain posted for up to a year before anyone notices. A quarterly review limits that exposure to about 90 days.
Questions
Does the 12-month rule apply to businesses outside California?+
Yes. It applies to any business the California Consumer Privacy Act covers, wherever it is located. That means a for-profit business that handles the personal information of California residents and meets one of the law's thresholds, such as about $26.6 million in annual revenue or the personal information of 100,000 or more consumers or households. Tractor Supply is based in Tennessee.
Is updating the privacy notice once a year enough?+
Oftentimes, no. The 12-month rule is a backstop. The actual requirement, in California and in every other state, is that the notice accurately describes current data practices. When a business adds a new tag, vendor, or use of personal data, the notice needs to be updated, regardless of when it was last reviewed.
Does the privacy notice have to show a last-updated date?+
In several states, yes. California, Colorado, Minnesota, Montana, and New Hampshire require the date of the last update, Connecticut requires the month and year, and Vermont will require the month and year in 2028. New Jersey requires an effective date instead. Elsewhere it is not required, but nearly every notice shows one, and regulators read it.
Briefings are informational and do not constitute legal advice.
Is your privacy notice accurate?
I'll check what it says against what your site does.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.