Ford’s $375,703 CPPA fine: extra steps that made opting out harder (2026)
At a glance
- Brought by
- Regulator: CalPrivacy (CPPA)Regulator
- Company
- Ford Motor Company
- Sector
- Automotive
- Law
- CCPA (California)
- Amount
- $375,703
- Date
- Settled Mar 5, 2026
- Status
- Settled
Summary
In March 2026, CalPrivacy fined Ford $375,703 for requiring email verification as an extra step before it would stop selling or sharing personal information, friction the agency said discouraged consumers. The order also requires Ford to audit the tracking technologies on Ford.com.
What happened
The CPPA found the email step was unnecessary friction. This is a website opt-out case, separate from the General Motors connected-car data-sales case.
The mechanism
The opt-out worked, and it was gated behind a step the law does not require. The audit the order requires names the technologies to check: cookies, web beacons, and pixels, each for whether it honors opt-out signals like GPC.
Why it was preventable
The number of steps in an opt-out is measurable, the same way you would measure friction in a checkout flow. And the tracking-technology audit the order now requires is the standard live check.
In the regulator’s words
Michael Macko, Head of the CPPA’s Enforcement Division, said: “Opting out is supposed to be easy. Just as unnecessary steps in the checkout process can discourage consumers from completing a purchase, unnecessary steps in the opt-out process can discourage consumers from exercising their privacy rights.”
Timeline
- Mar 5, 2026settled. Tracking-technology audit due within 90 days.
Source
Questions
Who fined Ford, and for what?
CalPrivacy, the California Privacy Protection Agency (CPPA), fined Ford $375,703 in March 2026 for adding unnecessary friction to the opt-out process by requiring email verification.
Is this the same as the General Motors case?
No. This is a website opt-out case about Ford.com. The General Motors matter is a separate connected-car data-sales case.
What does the order require Ford to do now?
Among other terms, Ford has to audit the tracking technologies on Ford.com, named as cookies, web beacons, and pixels, and check each one honors opt-out signals like GPC, within 90 days.
Related cases
American Honda’s $632,500 CPPA fine
Asymmetric opt-out; excessive verification
Todd Snyder’s $345,178 CPPA fine
Opt-outs not processed for 40 days; ID verification required
PlayOn Sports’ $1.1M CPPA fine
Tracking required to use a ticket; opt-out signals ignored
See what your tags send before it becomes a case
DataTrue runs real journeys on your site in each consent state and reads what each tag sends, field by field. A tag sending what it should not shows up in a test.
- Every page, with coverage scans
- Scheduled runs, with alerts when a result changes
- Full journeys, like checkout and signup, in each consent state
- What each tag sent, field by field
- PII detection with test personas
- iOS and Android app testing
- Pre-publish testing for GTM and Adobe Tags
- REST API, plus Slack and Jira alerts
The full platform, every feature, free for 30 days.
