California’s consumer data privacy law affords consumers the right to prevent companies from selling and sharing their personal information. The California Privacy Protection Agency (“CPPA”) is charged with enforcing the California Consumer Privacy Act (“CCPA”), including its opt-out rules (“CCPA Opt-Out Rule”). In September 2025, the CPPA announced that it would crack down on companies that fail to comply with the CCPA Opt-Out Rule. Recent enforcement actions, including the one discussed in detail below, suggest that the CPPA was not bluffing. In the following paragraphs, we discuss the CPPA’s latest enforcement action and its ramifications for companies that collect California State resident data.
CCPA Opt Out Investigation of Large Motor Vehicle Manufacturer
After investigating Ford Motor Company’s (“Ford”) privacy and CCPA compliance practices, the CPPA’s Enforcement Division determined that Ford had violated the CCPA Opt-Out Rule. According to the CPPA’s findings, Ford provided consumers with notice of the right to opt out online and provided an interactive form for consumers to submit requests to opt out of the sale and sharing of their personal information. Instead of processing opt-out requests upon receipt of these submissions, however, the CPPA found that Ford asked consumers to check their email for confirmation and to click the enclosed link to confirm. Consumers who checked their email found a message stating “you must confirm your email and identity by clicking the button below. Once we have confirmed your identity, we will respond to your request within the legally required time period.” The CPPA determined that this practice violated the CCPA Opt-Out Rule because it impermissibly created additional actions for consumers to take in order to have Ford honor their opt-out requests. To resolve the CPPA’s findings, Ford agreed to: (1) pay a $375,703 fine; (2) provide consumers with methods to submit opt out requests that comply with the statute; (3) conduct an audit of the tracking technologies on its website; and (4) ensure compliance with opt-out preference signal processing.
Ensure That Your Company Is Complying With The CCPA Opt-Out Rule
The enforcement action against Ford is yet another cautionary tale for companies. Unlike the CCPA’s consumer rights to delete, know, and correct the information that companies maintain about them, the CCPA Opt-Out Rule explicitly requires companies to honor opt out requests if they can comply with the request without requesting additional identifying information.
The CPPA has been active in enforcing the CCPA since the beginning of the year and the latest enforcement action is further evidence of that fact. The CCPA is one of many state consumer privacy laws that companies must be cognizant of, and the CPPA’s recent actions demonstrate the urgency with which companies must act to ensure compliance. Federal and state regulatory agencies continue to actively enforce consumer privacy laws, and this trend will only grow with time.
If your business sells or shares the personal information of California consumers, now is the time to reevaluate, among other things, the adequacy of your: (1) company’s Privacy Policy; (2) consumer data sharing practices; (3) consumer consent language; and (4) consumer data election rights compliance practices. To state the obvious, honoring consumer opt outs under the CCPA is just one of the many requirements of a much broader privacy law framework.
The attorneys at Klein Moynihan Turco have decades of experience in advising businesses on federal and state consumer privacy laws, including privacy law compliance and defending businesses in regulatory and privately litigated matters. If you are interested in working with a law firm that operates in this space, please email us at info@kleinmoynihan.com or call us at (212) 246-0900.
The material contained herein is provided for informational purposes only and is not legal advice nor is it a substitute for seeking legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.
Attorney Advertising
Photo by Daniele D’Andreti on Unsplash
Similar Blog Posts:
California Data Broker Registration is Not Optional!
