SACRAMENTO, CA — The California Privacy Protection Agency Board has issued a decision requiring Ford Motor Company to pay a $375,703 fine and change its practices following a settlement reached by CalPrivacy’s Enforcement Division.
The decision emphasizes that unnecessary friction in the opt-out process violates the California Consumer Privacy Act (CCPA).
Ford vehicles are commonly found on roadways across California. California’s privacy law, the CCPA, gives consumers the right to stop Ford and other businesses from selling and sharing their personal information by opting out. According to the Board’s decision, Ford required consumers to verify their identity before they could opt-out. Ford did so by requiring consumers to verify their email address as part of the opt-out process, resulting in unnecessary friction for consumers seeking to exercise their rights.
The company required consumers to complete an email verification step before they could opt-out of the sale and sharing of personal information collected through its digital properties and connected vehicle services. As a result, Ford did not process opt-out requests unless consumers completed this step. In response to the agency’s investigation, Ford has since processed the opt-out requests that lacked verification.
“Opting out is supposed to be easy,” said Michael Macko, the head of enforcement at CalPrivacy. “Just as unnecessary steps in the checkout process can discourage consumers from completing a purchase, unnecessary steps in the opt-out process can discourage consumers from exercising their privacy rights. We will continue to scrutinize practices that create these kinds of barriers for Californians.”
“The agency has made it a priority to remove obstacles that prevent Californians from exercising their privacy rights,” said Tom Kemp, CalPrivacy’s Executive Director. “This case shows that the Enforcement Division will take all appropriate action when practices fall short of the law’s requirements.”
In addition to paying the fine, Ford must change its business practices by providing consumers with easy methods to submit opt-out requests with minimal steps. Ford must also conduct an audit of the tracking technologies on its website and ensure compliance with opt-out preference signals, including the Global Privacy Control. The matter arose from the Enforcement Division’s review of data privacy practices by connected vehicle manufacturers, similar to the enforcement action last year against American Honda Motor Co.
