Ford Motor Company will pay nearly $376,000 to settle an investigation by CalPrivacy over what the regulator described as an unnecessarily burdensome opt-out process that violated the California Consumer Privacy Act (CCPA). The enforcement action marks the second penalty CalPrivacy announced this week and the second to emerge from its ongoing sweep of connected-vehicle manufacturers.
The Violation
According to CalPrivacy, Ford created unnecessary friction for consumers seeking to opt out of the sale and sharing of personal information collected through its digital properties and connected vehicles. Specifically, Ford required consumers to verify their identity before they could exercise their opt-out rights—a step the agency deemed an unlawful barrier. The company also failed to process opt-out requests until consumers completed an email verification step. In response to the investigation, Ford has since processed the opt-out requests that had gone unaddressed due to the verification requirement.
Required Remediation
Under the terms of the resolution, Ford must overhaul its opt-out process to ensure consumers can exercise their rights with minimal steps. The company is also required to audit the tracking technologies deployed on its website and verify compliance with the Global Privacy Control (GPC) and other opt-out preference signals. Ford has not publicly commented on the matter.
Regulatory Context
CalPrivacy enforcement head Michael Macko emphasized the agency’s position that opting out should be simple, drawing an analogy to how unnecessary steps in a checkout process can deter customers from completing a purchase. Executive Director Tom Kemp echoed the priority, noting that removing obstacles to consumer privacy rights is a core focus for the agency. Reducing opt-out friction is also the subject of an upcoming CalPrivacy rulemaking.
The Ford action follows a $1.1 million fine against PlayOn Sports announced days earlier and is the second result of CalPrivacy’s connected-vehicles sweep, which began in July 2023. That sweep previously resulted in a $632,500 penalty against Honda last year. Together, these actions signal an increasingly active enforcement posture by CalPrivacy as it works to hold companies accountable for CCPA compliance in the growing connected-vehicle space.
How long before this process trickles down to other companies in the vehicle supply chain? Automotive dealerships, rental car companies, automotive auction houses, and finance companies should take this as an early warning shot.
Conclusion
Now is the time to get your opt-out process in compliance. Reach out to Troutman Amin LLP if you want assistance in ensuring your policies comply with your legal obligations.
CIPAWorld 