Penalty Amount
$375,703
The California Privacy Protection Agency (CalPrivacy) settled with Ford Motor Company requiring the company to pay a $375,703 fine and change its practices. Ford violated the CCPA by requiring consumers to complete an email verification step before they could opt-out of the sale and sharing of their personal information collected through digital properties and connected vehicle services. In addition to the fine, Ford must provide easy methods to submit opt-out requests with minimal steps, audit its tracking technologies, and ensure compliance with opt-out preference signals including Global Privacy Control.
Ford must pay a $375,703 fine and change its business practices by providing consumers with easy methods to submit opt-out requests with minimal steps. Ford must also conduct an audit of the tracking technologies on its website and ensure compliance with opt-out preference signals, including the Global Privacy Control. Ford has already processed the opt-out requests that lacked verification in response to the agency's investigation.
In-house legal teams should review their client's privacy notice and opt-out mechanisms to ensure the opt-out process does not include unnecessary verification steps that create friction. Contracts with vendors handling opt-out requests should include requirements to process opt-out requests promptly without imposing additional verification beyond what the CCPA requires. Legal teams should also verify that their entity's systems honor opt-out preference signals like Global Privacy Control (GPC) and ensure proper technical implementation across all digital properties, particularly for connected devices or vehicles that collect personal information.
Entity
Ford Motor Company
Industry
AutomotiveOfficial Press Release
https://privacy.ca.gov/2026/03/ford-to-change-practices-pay-fine-for-adding-unnecessary-friction-to-opt-out-process/
Order of Decision Ford Motor Co
https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf
California Attorney General Enforcement Page
https://oag.ca.gov/privacy/privacy-enforcement-actions
"Ford Motor Company"
"$375,703 fine"
"California Consumer Privacy Act (CCPA)"
"Ford required consumers to verify their identity before they could opt-out. Ford did so by requiring consumers to verify their email address as part of the opt-out process, resulting in unnecessary friction for consumers seeking to exercise their rights."
"In addition to paying the fine, Ford must change its business practices by providing consumers with easy methods to submit opt-out requests with minimal steps. Ford must also conduct an audit of the tracking technologies on its website and ensure compliance with opt-out preference signals, including the Global Privacy Control."
$376K
The California Privacy Protection Agency settled with Ford Motor Company for $375,703 after finding that Ford violated the CCPA by requiring email verification for opt-out requests, creating unnecessary friction. Ford must implement easier opt-out methods, conduct a website audit, and comply with global privacy controls.
$19.2M
Ford Motor Company agreed to a $19.2 million multistate settlement for falsely advertising the fuel economy of 2013–2014 C-Max hybrids and the payload capacity of 2011–2014 Super Duty pickup trucks. The settlement requires Ford to cease deceptive advertising practices and pay penalties to participating states.
The California Privacy Protection Agency announced that the California State Legislature approved the Expanding Privacy Rights Act (SB 923), which expands the CCPA's right to delete to cover all non-exempt personal information a business holds about a consumer, including data originally collected from third parties. The bill also requires online-only businesses with a direct relationship to consumers to provide online methods, such as webforms, for submitting access, deletion, and correction requests, and expressly permits businesses to retain suppression lists so deleted information stays deleted. The bill, authored by Senator Becker and sponsored by CalPrivacy, now goes to the Governor for consideration.
A bipartisan coalition of 33 state attorneys general, led by Minnesota AG Keith Ellison, began trial against Meta Platforms, Inc., alleging the company knowingly designed and deployed harmful features on Facebook and Instagram that drive children and teens to use the platforms compulsively, while falsely assuring parents and the public that its platforms were safe for young users. The states also allege Meta illegally collected personal information from children under 13 without parental consent, violating COPPA. The trial opened before Judge Yvonne Gonzalez Rogers in the U.S. District Court for the Northern District of California, with the states seeking monetary penalties and injunctive relief.
A coalition of 12 state attorneys general, led by Colorado AG Phil Weiser, obtained a temporary restraining order from a federal court in California to halt the proposed $110 billion merger of Warner Bros. Discovery, Inc. by Paramount Skydance Corporation. The lawsuit alleges the merger violates Section 7 of the Clayton Act by substantially lessening competition in film distribution, anticipated blockbuster film distribution, and licensing cable TV channels.
The California Privacy Protection Agency (CalPrivacy) joined a coalition of 18 Attorneys General and state agencies in opposing the proposed SECURE Data Act, a federal privacy bill that would preempt stronger state privacy laws like the CCPA. The coalition argues the bill would weaken consumer privacy protections, limit enforcement remedies, and undermine California's Delete Request and Opt-out Platform (DROP).