# Regulatory Environment — Retail & Consumer Goods

_Last updated: 2026-08-17_

## FTC & antitrust

- FTC actively reviewing large retail M&A; Kroger/Albertsons blocked (2024) signals aggressive retail antitrust stance [unsourced]
- FTC Safeguards Rule: Financial data protection requirements for retailers offering credit — impacts Staples Business Advantage [unsourced]
- FTC price transparency enforcement: Shrinkflation labeling, drip pricing, junk fee crackdown [unsourced]

## Data privacy (CCPA + state patchwork)

- California Consumer Privacy Act (CCPA/CPRA): Broad consumer rights over retail customer data; enforcement active [unsourced]
- ~20 states have enacted or are enacting consumer privacy laws; retail compliance is a patchwork [unsourced]
- Biometric data laws (Illinois BIPA): Computer vision/facial recognition in stores at legal risk in IL — relevant to THD/Lowe's store tech [unsourced]
- **SE angle:** Microsoft Purview for data governance, Azure Policy for compliance automation, Defender for compliance posture

## Payment security (PCI-DSS)

- PCI-DSS v4.0 effective March 2025: New requirements for e-commerce script security, stronger authentication, expanded scope [unsourced]
- All named retailers handle cardholder data — PCI-DSS compliance is non-negotiable [unsourced]
- **SE angle:** Microsoft Defender for Cloud (PCI-DSS blueprint), Azure PCI-DSS workbook, GitHub Advanced Security for payment app code scanning

## Food & beverage regulation (Coca-Cola System)

- FDA Food Safety Modernization Act (FSMA) Rule 204: Enhanced supply chain traceability requirements effective 2026 — tech investment required [unsourced]
- FDA nutrition labeling changes: Ongoing updates to Nutrition Facts panels [unsourced]
- Sugar/beverage taxes: Local/state taxes in several jurisdictions affecting Coke pricing and formulation decisions [unsourced]
- **SE angle:** Azure supply chain traceability (Fabric + IoT), D365 SCM for FSMA compliance workflows

## Trade tariffs & customs (2025)

- Broad tariff increases on imported goods from China, Vietnam, Bangladesh, etc. impacting retail merchandise costs [unsourced]
- Retailers with heavy import dependence most exposed: TJX (~20% merchandise from Asia), Staples (imported office/tech products) [unsourced]
- CPG ingredient costs affected by agricultural commodity tariffs (aluminum cans, sugar, corn syrup) [unsourced]
- **SE angle:** D365 SCM for landed cost modeling and tariff scenario planning; Azure AI for supply chain diversification analysis

## Environmental / ESG

- SEC climate disclosure rules: Implementation uncertain due to litigation; Scope 1/2 now required for large accelerated filers [unsourced]
- EU CSRD (Corporate Sustainability Reporting Directive): Applies to US companies with EU operations — all 5 named accounts have EU exposure [unsourced]
- Packaging reduction mandates (EU EPR, US state rules): Affects Coca-Cola System packaging strategy [unsourced]
- **SE angle:** Microsoft Sustainability Manager (Cloud for Sustainability), Azure for Scope 3 data aggregation across supplier network