Retailer Todd Snyder ordered to pay after a misconfigured consent tool left opt-outs waiting 40 days

$345,178

The agency alleged that Todd Snyder’s privacy portal was set up wrongly, so opt-out requests went unprocessed for 40 days. It also alleged that the company asked for more information than needed and made people verify their identity before opting out. Todd Snyder was ordered to pay $345,178, reconfigure its opt-out tools and train staff. The agency stressed that using a third-party consent platform does not shift the company’s own responsibility.

On 6 May 2025, the California Privacy Protection Agency, now known as CalPrivacy, announced that its Board had issued a decision against Todd Snyder, Inc., a national clothing retailer. The decision resolved allegations by the agency's Enforcement Division under the California Consumer Privacy Act, and centred on how Todd Snyder handled people's privacy requests.

The Enforcement Division alleged that Todd Snyder did not oversee or properly configure the technical set-up of its privacy portal. As a result, according to the agency, requests from consumers to opt out of the sale or sharing of their personal information went unprocessed for 40 days. The agency also alleged that the company asked consumers for more information than it needed to process their privacy requests, and made them verify their identity before they could opt out of the sale or sharing of their information.

Todd Snyder was ordered to pay $345,178. It will also change its practices, including properly configuring the ways people submit and manage opt-out preferences, and training its employees on the Act. The agency said the allegations about verification echo an Enforcement Advisory it issued the year before, warning businesses against collecting excessive information from people using their privacy rights.

None of this involved a hacker or a leaked database. It came down to a privacy tool that, by the agency's account, was not set up to work as intended. Michael Macko, head of the agency's Enforcement Division, said businesses should scrutinise their privacy management tools, "because the buck stops with the businesses that use them."

Todd Snyder is not the only case on this theme. In March 2025, the same agency ordered American Honda Motor Co. to pay $632,500. It alleged that Honda asked for too much personal information before letting people use their privacy rights, and that its online privacy-choice tool made accepting easier than declining.

For any website, the questions are the same. When a shopper asks to opt out, does the request actually go through, and how quickly? What does the form ask for, and is all of it needed? And does anyone check that the privacy tool works as intended?

Why it matters for your siteBuying a consent management platform does not move responsibility for how it is set up.

The transcript

Three hundred and forty-five thousand, one hundred and seventy-eight dollars. That's what California's privacy agency ordered Todd Snyder to pay, in a decision announced in May 2025. Todd Snyder is a national clothing retailer.

So what was it accused of? The agency alleged that Todd Snyder didn't set up its privacy portal properly. So when shoppers asked it to stop selling or sharing their personal information, those requests went unprocessed for forty days.

The agency also alleged that it asked people for more information than it needed to handle their requests. And that it made them prove who they were before they could opt out.

And what did it pay? Three hundred and forty-five thousand, one hundred and seventy-eight dollars, by order of the agency's board. Todd Snyder must also set up its opt-out tools properly, and train its employees on California's privacy law.

Notice what this was not. No hacker. No leaked database. Just a privacy tool that wasn't set up right, and requests left waiting. The agency's enforcement head said the buck stops with the businesses that use these tools.

And it's not alone. Two months earlier, in 2025, the same agency ordered Honda to pay six hundred and thirty-two thousand, five hundred dollars. It alleged that Honda asked for too much information before people could use their privacy rights.

Regulators now look for exactly that gap: between the choice a brand says it gives its shoppers, and what its website actually does. Most brands can't say whether their opt-out works, or how long a request takes to go through.

That's what Tolbrook checks. We go through your site the way a shopper would, and show you what we find, with the evidence.

Find it. Fix it. Watch it.

Opt-out signalsSource: California Privacy Protection Agency

Each summary is ours, drawn from the public announcement it links to. Allegations are the regulator’s own, and a settlement usually comes without any admission. This page reports what was announced. It is not legal advice, and it says nothing about any site we audit.

Find these problems before anyone else does

The digital compliance problems behind actions like these are the ones we look for. We find them on your site and show you exactly where each one sits.

Order a report

All news