CalPrivacy said Ford made people verify their email address before it would act on a request to opt out of the sale or sharing of their data, which added needless friction. Ford was ordered to pay $375,703. It must also simplify its opt-out process, audit the tracking technologies on its website, honour opt-out preference signals including Global Privacy Control, and process the opt-out requests it had earlier rejected.
On 5 March 2026, the California Privacy Protection Agency, known as CalPrivacy, announced a decision of its Board ordering Ford Motor Company to pay $375,703 and change its practices. The decision followed a settlement reached with the agency's Enforcement Division.
The agency said Ford required people to verify their email address before it would process a request to opt out of the sale or sharing of their personal information, across its websites and its connected vehicle services. If people did not complete that step, the agency said, Ford did not process the request. CalPrivacy described this as needless friction in a process that is meant to take little effort. "Opting out is supposed to be easy," said Michael Macko, the agency's head of enforcement.
Under the order, Ford must pay $375,703 and give people easy ways to submit opt-out requests, with minimal steps. It must also audit the tracking technologies on its website and honour opt-out preference signals, including Global Privacy Control, the setting some browsers send on every visit. The agency said Ford has since processed the opt-out requests that had not been verified. The announcement does not say how many requests were affected or over what period.
Nothing was stolen or leaked in this case. It turned on a single extra step: an email check placed between a person and the choice they had already made.
It is not the first case of its kind. In March 2025 the same agency settled with American Honda Motor Co. for $632,500, after alleging that Honda made people verify themselves and provide too much personal information before they could use certain privacy rights.
The questions apply to any site that sells or shares data for advertising: how many steps an opt-out takes, whether any of them ask for more than the request needs, whether the site responds to a browser's Global Privacy Control signal, and whether the advertising tags on the page actually stop once someone has said no.
Why it matters for your siteEach extra step in an opt-out flow is friction, and this order counted it.
The transcript
Three hundred seventy-five thousand, seven hundred and three dollars. That's what Ford Motor Company was ordered to pay California's privacy agency, CalPrivacy, in March 2026. The order followed a settlement with the agency's enforcement team.
So what was it accused of? CalPrivacy said that when people asked Ford to stop selling or sharing their personal information, Ford first made them verify their email address. And if they didn't finish that step, the agency said, Ford didn't act on the request.
Why does that matter? The agency said the extra step added needless friction, across Ford's websites and its connected vehicle services. Its head of enforcement, Michael Macko, put it simply: opting out is supposed to be easy.
And what did it pay? Three hundred seventy-five thousand, seven hundred and three dollars. Ford must also give people easy ways to opt out, with minimal steps, audit the tracking tools on its website, and honour the opt-out signals browsers send, including Global Privacy Control. The agency said Ford has since processed the requests it had held back.
Notice what this was not. No hacker. No leaked data. Just one extra step, an email check, standing between a person and their opt-out.
And it's not alone. In 2025, the same agency settled with Honda for six hundred thirty-two thousand, five hundred dollars. It alleged that Honda made people verify themselves and hand over too much personal information before they could use their privacy rights.
Every step in an opt-out now counts. Does the link work? Does it ask for more than it needs? Does the site hear a browser's opt-out signal, and do the ad tags actually stop?
That's what Tolbrook checks. We go through your site the way a shopper would, and show you what we find, with the evidence.
Read our sector reviews at tolbrook dot com slash reports. Find it. Fix it. Watch it.
Each summary is ours, drawn from the public announcement it links to. Allegations are the regulator’s own, and a settlement usually comes without any admission. This page reports what was announced. It is not legal advice, and it says nothing about any site we audit.
Find these problems before anyone else does
The digital compliance problems behind actions like these are the ones we look for. We find them on your site and show you exactly where each one sits.