Ford Fined for CCPA Violations

Another Fine Demonstrating the Importance of Easy Opt Outs

The California Privacy Protection Agency fined Ford $375,703 for violating the CCPA. Ford was penalized for making it difficult for consumers to opt out of the sale or sharing of their personal data. Not providing easy opt-out paths has been a common theme in recent CCPA settlements. Disney settled for $2.75 million for failing to apply opt-out requests across its platforms and for not providing consumers with a method to opt out in its apps. PlayOn Sports settled for $1.1 million for banners that prevented people from using its ticketing platform as intended without agreeing to the use of trackers and the sharing of their data.

Ford’s Opt-out Violations

Ford provided the following interactive form for consumers to opt out of the sale/sharing of their data.

Consumers filled out the required fields, completed the reCAPTCHA, and clicked “submit.” At that point, Ford could have processed the request without any more information. Instead, Ford displayed the message you see below, directing consumers to check their “email for confirmation” and to “click confirm.” Only then would Ford process their requests.

The email, seen below, told consumers Ford had received the request, but before completion, “you must confirm your email and identity by clicking the button below.” Ford further explained that “Once we have confirmed your identity,” it would “respond to your request within the legally required time period.”

If a consumer did not click “Confirm Email,” Ford deemed their request as “expired.” This resulted in Ford not processing dozens of opt-outs within the timeframe required by the CCPA.

CalPrivacy alleged that requiring consumers to confirm their email address before processing a request created unnecessary friction for consumers to exercise their opt-out rights. Ford should have processed consumers’ requests with the information provided through the consumer privacy rights form.

Settlement Details

Along with the financial penalty, Ford has agreed to take the following actions as part of the settlement with the CPPA:

• Provide consumers with methods to exercise their right to opt-out of sale/sharing that are easy and require minimal steps.
• Not require verifiable consumer requests for consumers to exercise their right to opt out of sale/sharing.
• Honor requests within the timeframe required by the CCPA.
• Conduct an audit of the tracking technologies, such as cookies, web beacons, and pixels, on Ford.com, to ensure they are properly configured to honor consumers’ opt-out preference signals, such as the Global Privacy Control.

Read the complete Order of Decision.

At CompliancePoint, we can assist your business to ensure the opt-out functionality on its website meets CCPA requirements. Reach out to us at connect@compliancePoint.com to learn more about our CCPA Compliance Service.