The agency alleged that Honda asked for too much personal information before letting people use their privacy rights, and that its online privacy-choice tool made accepting easier than declining. It also alleged that Honda put obstacles in front of authorized agents and shared data with ad tech firms without the required contracts. Honda agreed to pay $632,500, simplify its request process, bring in a UX designer, train staff and revise its contracts.
On 12 March 2025, the California Privacy Protection Agency, known as CalPrivacy, announced a decision of its Board ordering American Honda Motor Co. to pay $632,500 and change its business practices under the California Consumer Privacy Act. The case came from the agency's Enforcement Division and its review of the privacy practices of connected vehicle makers.
The agency alleged that Honda required Californians to verify themselves and provide too much personal information before they could use privacy rights such as opting out of the sale or sharing of their data. It also alleged that Honda's online privacy management tool did not offer privacy choices in a symmetrical or equal way, so that accepting was easier than declining.
The agency made two further allegations. It said Honda made it difficult for people to use authorized agents to exercise their privacy rights on their behalf. And it said Honda shared personal information with advertising technology companies without contracts that carried the privacy protections the agency said were needed.
Under the order, Honda agreed to pay $632,500 and to adopt a new and simpler process for Californians to use their privacy rights. It agreed to consult a user experience designer on how people submit privacy requests, to train its employees and to change its contracting process. "The remedy should fit the problem behavior," said Michael Macko, head of the agency's Enforcement Division. The agency said the outcome reflected Honda's early cooperation.
Nothing was stolen or leaked in this case. It turned on how a privacy choice was presented, and how many steps stood between a person and saying no.
It is not the last case of its kind. In March 2026, the same agency ordered Ford Motor Company to pay $375,703, after saying Ford made people verify their email address before it would act on a request to opt out of the sale or sharing of their data.
Why it matters for your site‘Accept’ and ‘decline’ must be equally easy to find and use.
The transcript
Six hundred thirty-two thousand, five hundred dollars. That's what American Honda was ordered to pay California's privacy agency, CalPrivacy, in March 2025, after a settlement with the agency's enforcement team.
So what was it accused of? The agency said Honda made people verify themselves, and hand over too much personal information, before they could opt out of the sale or sharing of their data. And it said Honda's online privacy tool didn't offer the choices equally. Saying yes was easier than saying no.
It didn't stop there. The agency also said Honda made it hard for people to use an authorized agent to act for them. And that it shared personal information with ad tech companies without contracts holding the privacy terms the agency said were needed.
And what did it pay? Six hundred thirty-two thousand, five hundred dollars. Honda also agreed to a new, simpler way for people to use their privacy rights, to consult a user experience designer on how requests are made, to train its staff, and to change how it writes its contracts. The agency's head of enforcement, Michael Macko, said the remedy should fit the problem behavior.
Notice what this was not. No hacker. No leaked data. Just a privacy tool where yes came easier than no.
And it's not alone. In March 2026, the same agency ordered Ford to pay three hundred seventy-five thousand, seven hundred and three dollars. It said Ford made people verify their email before it would act on an opt-out.
Look at your own choices. Is saying no as easy as saying yes? Does an opt-out ask for more than it needs? And when someone says no, do the ad tags actually stop?
That's what Tolbrook checks. We go through your site the way a shopper would, and show you what we find, with the evidence.
Read our sector reviews at tolbrook dot com slash reports. Find it. Fix it. Watch it.
Each summary is ours, drawn from the public announcement it links to. Allegations are the regulator’s own, and a settlement usually comes without any admission. This page reports what was announced. It is not legal advice, and it says nothing about any site we audit.
Find these problems before anyone else does
The digital compliance problems behind actions like these are the ones we look for. We find them on your site and show you exactly where each one sits.