Ford Fined $375,000 for Adding Friction to Consumer Opt-Out Process Under CCPA

Summary

The California Privacy Protection Agency ordered Ford Motor Company to pay $375,703 and overhaul its opt-out process in March 2026. CalPrivacy found that Ford required consumers to verify their email address before processing opt-out requests-a step regulators deemed unnecessary and unlawful under the CCPA.

Key Details

Ford displayed a "One More Step!" message after consumers submitted opt-out requests, directing them to check their email for a confirmation link. Consumers who did not click the link had their requests ignored. Ford continued to sell or share their personal information despite receiving the initial opt-out submission.

CalPrivacy's Enforcement Division classified this email verification step as "unnecessary friction" violating CCPA requirements for minimal-step opt-out submission. The case emerged from CalPrivacy's multi-year enforcement sweep of connected vehicle manufacturers launched in 2023-the same initiative that produced a $632,500 action against American Honda in 2025.

Under the settlement, Ford must process all previously unfulfilled opt-out requests, provide CCPA-compliant low-friction opt-out methods, audit all tracking technologies on its website, and honor opt-out preference signals including the Global Privacy Control.

Why This Matters

The Ford decision establishes that adding confirmation steps to opt-out flows-even common ones like email verification-can violate the CCPA. Any business inserting intermediate steps between a consumer's opt-out request and its processing faces enforcement risk.

CalPrivacy has now fined two major automakers in consecutive years, confirming that connected vehicle data practices remain a priority enforcement target. The auto industry collects extensive personal data through vehicle telematics, apps, and dealer interactions.

With the 10-state Consortium of Privacy Regulators coordinating enforcement priorities, businesses operating across multiple states should expect similar scrutiny of their opt-out mechanisms beyond California.

For businesses using digital consent and opt-out forms, this ruling makes the compliance requirement concrete: opt-out must be processed upon submission, with no added verification steps or confirmation hurdles that could delay or block the request.

Sources

• CalPrivacy - Ford to Change Practices, Pay Fine for Adding Unnecessary Friction to Opt-Out Process
• Hunton Andrews Kurth - CalPrivacy Reaches Settlement with Ford Motor Company
• National Law Review - Ford Settlement Highlights Simple Practice: Opt-Outs Must be Easy