American Honda’s $632,500 CPPA fine: when opting out is harder than opting in (2025)
At a glance
- Brought by
- Regulator: CalPrivacy (CPPA)Regulator
- Company
- American Honda
- Sector
- Automotive
- Law
- CCPA (California)
- Amount
- $632,500
- Date
- Settled Mar 12, 2025
- Status
- Settled
Summary
In March 2025, CalPrivacy (the California Privacy Protection Agency) fined American Honda $632,500 for making opt-out harder than opt-in, over-verifying privacy requests, and sharing data without the contract terms the CCPA requires.
What happened
Over-verifying meant Honda asked for more personal information than the law permits before it would process a privacy request. The data it shared without the required contract terms went to ad-tech vendors.
The mechanism
The core issue was the choice architecture of the cookie and privacy tool. According to the order, consumers could accept all cookies with one click, but opting out of the cookies required at least two clicks. Rights that should need little or no identity check were gated behind excessive verification.
Why it was preventable
The number of steps to opt out versus opt in is something you can measure directly by walking both paths. So is whether a tool demands more than it should.
In the regulator’s words
Michael Macko, Head of the CPPA’s Enforcement Division, said: “The remedy should fit the problem behavior.”
Timeline
- Mar 12, 2025settled.
Source
Questions
Who fined American Honda?
CalPrivacy, the California Privacy Protection Agency (CPPA), in March 2025. The CPPA is a separate body from the California Attorney General.
What did Honda do wrong?
It made opting out of data sharing take more steps than opting in, which breaks the CCPA’s symmetry-in-choice rule, asked for more personal information than needed to process a request, and shared data without required contract terms.
How is “symmetry in choice” tested?
By walking both paths and counting the steps. If opting out takes more effort than opting in, the choice is not symmetrical.
Related cases
Ford’s $375,703 CPPA fine
Email-verification friction added to opt-out
Todd Snyder’s $345,178 CPPA fine
Opt-outs not processed for 40 days; ID verification required
Sephora’s $1.2M CCPA settlement
Sale not disclosed; GPC opt-out ignored
See what your tags send before it becomes a case
DataTrue runs real journeys on your site in each consent state and reads what each tag sends, field by field. A tag sending what it should not shows up in a test.
- Every page, with coverage scans
- Scheduled runs, with alerts when a result changes
- Full journeys, like checkout and signup, in each consent state
- What each tag sent, field by field
- PII detection with test personas
- iOS and Android app testing
- Pre-publish testing for GTM and Adobe Tags
- REST API, plus Slack and Jira alerts
The full platform, every feature, free for 30 days.
