Ford Fined $375,000 for Adding Friction to Consumer Opt-Out Process Under CCPA

Summary

The California Privacy Protection Agency ordered Ford Motor Company to pay $375,703 and overhaul its opt-out process in March 2026. CalPrivacy found that Ford required consumers to verify their email address before processing opt-out requests-a step regulators deemed unnecessary and unlawful under the CCPA.

Key Details

Ford displayed a "One More Step!" message after consumers submitted opt-out requests, directing them to check their email for a confirmation link. Consumers who did not click the link had their requests ignored. Ford continued to sell or share their personal information despite receiving the initial opt-out submission.

CalPrivacy's Enforcement Division classified this email verification step as "unnecessary friction" violating CCPA requirements for minimal-step opt-out submission. The case emerged from CalPrivacy's multi-year enforcement sweep of connected vehicle manufacturers launched in 2023-the same initiative that produced a $632,500 action against American Honda in 2025.

Related reading: OCR Expands HIPAA Enforcement Beyond Risk Analysis to Target Risk Management Failures explains the next step for teams working on this workflow.

Under the settlement, Ford must process all previously unfulfilled opt-out requests, provide CCPA-compliant low-friction opt-out methods, audit all tracking technologies on its website, and honor opt-out preference signals including the Global Privacy Control.

Why This Matters

The Ford decision establishes that adding confirmation steps to opt-out flows-even common ones like email verification-can violate the CCPA. Any business inserting intermediate steps between a consumer's opt-out request and its processing faces enforcement risk.

CalPrivacy has now fined two major automakers in consecutive years, confirming that connected vehicle data practices remain a priority enforcement target. The auto industry collects extensive personal data through vehicle telematics, apps, and dealer interactions.

With the 10-state Consortium of Privacy Regulators coordinating enforcement priorities, businesses operating across multiple states should expect similar scrutiny of their opt-out mechanisms beyond California.

For businesses using digital consent and opt-out forms, this ruling makes the compliance requirement concrete: opt-out must be processed upon submission, with no added verification steps or confirmation hurdles that could delay or block the request.

Sources

• CalPrivacy - Ford to Change Practices, Pay Fine for Adding Unnecessary Friction to Opt-Out Process
• Hunton Andrews Kurth - CalPrivacy Reaches Settlement with Ford Motor Company
• National Law Review - Ford Settlement Highlights Simple Practice: Opt-Outs Must be Easy