Ford: do not make an opt-out wait for an email confirmation

Read the message your opt-out form shows after "Submit". If it says "One More Step!", you may have the same problem as Ford: the CPPA found that Ford parked opt-out requests until people clicked a confirmation link, and dropped the ones that never did.

California Privacy Protection Agency (CalPrivacy) · CCPA · Board decision 27 February 2026

The problem

People filled in Ford’s privacy rights form, solved a reCAPTCHA and chose "Opt-out of Sharing". Ford then showed "One More Step! Please confirm your Request!" and emailed a link saying "you must confirm your email and identity". Requests without a click were marked "expired", so Ford did not process dozens of opt-outs in time and kept selling or sharing those people’s data (Order, ¶¶ 28–35, 42).

Case record

Regulator: California Privacy Protection Agency; decision by its Board, Chair Jennifer M. Urban ([Order, p. 1](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf))
Case number: ENF23-V-FO-3
Parties: CPPA Enforcement Division v. Ford Motor Company
Counsel: Enforcement Division attorneys Alex Berger and Michael Meyer ([Announcement](https://privacy.ca.gov/2026/03/ford-to-change-practices-pay-fine-for-adding-unnecessary-friction-to-opt-out-process/)); Baker & Hostetler, LLP for Ford ([Order, p. 11](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf))
Laws: CCPA; 11 CCR § 7026(d)
Stage: Stipulated final order adopted by the Board, 27 February 2026; review waived ([¶ 59](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf))
Amount: USD 375,703 administrative fine ([¶ 48](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf))
Source review: 17 October 2026

Ford "neither admits nor denies" the factual findings and does not admit liability (¶ 58). The order also records that Ford "did not intend" to require verification or to include the identity wording in the email (¶ 36).

The problem
Case record
What the regulator found
What the order requires
Technical issue
Timeline
Outcome
What it cost
Why it matters
How Inth catches this
Checks for your own systems
Sources and limits

What the regulator found

What the regulator found
Practice	What the law requires	What the order describes	Source
Verification before opt-out	A business may not require a verifiable consumer request to opt out; "to the extent that the business can comply... without additional information, it shall do so" (11 CCR § 7026(d))	Ford could have processed the form as submitted, but required a click on a "Confirm Email" link first	[¶¶ 24–27, 30–38](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)
Selling after opt-out	Stop selling or sharing once directed (Civ. Code § 1798.120(d))	Unconfirmed requests "expired"; Ford kept selling or sharing for dozens of people, and processed them only after the investigation	[¶¶ 35, 39–43](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)

The form itself asked for name, full address, phone number and relationship to Ford before submission (¶ 28). The order does not challenge those fields; its findings concern the confirmation step that followed. The relevant period is 1 July 2023 to 1 March 2024 (¶ 21).

What the order requires

Paragraphs are from the stipulated final order.

Opt-out methods "that are easy and require minimal steps" (¶ 50(a)).
No verifiable consumer request for opt-outs (¶ 50(b)).
Honour each opt-out to the extent possible within the CCPA’s time limit (¶ 50(c)).
An audit of "the tracking technologies, such as cookies, web beacons, and pixels, on its website, Ford.com", to make sure each honours opt-out preference signals such as Global Privacy Control (¶ 51).
Complete both and confirm in writing within 90 days (¶ 52).

Technical issue

Tools or vendors: Ford’s privacy rights form with reCAPTCHA; an email confirmation flow; tracking technologies on Ford.com, not named.
Where: the web form covering data from Ford’s digital properties and connected vehicle services (¶ 29).
What data: personal information Ford sold or shared, not itemised in the order.
When: after the person submitted an opt-out, for as long as the request sat unconfirmed or expired.
How it came to light: the Enforcement Division’s review of connected-vehicle manufacturers, with a research technologist assisting (Announcement).

Inth’s technical interpretation: the opt-out reused a request pipeline built for access and deletion, where email confirmation guards against impostors. For an opt-out that guard has no purpose: a false opt-out harms nobody, which is why the rules forbid verification. A state machine with an "awaiting confirmation" status and an expiry job turned a reasonable security pattern into an unprocessed request.

Illustrative pattern, not the defendant’s code.

// Bad: opt-out waits for an email click and silently expires
async function submitOptOut(form: OptOutForm) {
  const req = await requests.create({ ...form, type: "opt_out", status: "awaiting_email_confirmation" });
  await mailer.send(form.email, confirmIdentityTemplate(req.id));
}
// nightly job: requests.expire({ status: "awaiting_email_confirmation", olderThanDays: 7 })

Illustrative pattern, not the defendant’s code.

// Fixed: act on what was submitted; the email is a receipt, not a gate
async function submitOptOut(form: OptOutForm) {
  const req = await requests.create({ ...form, type: "opt_out", status: "received" });
  await optOuts.apply({ email: form.email, phone: form.phone }); // what the form already has
  await requests.update(req.id, { status: "honoured" });
  await mailer.send(form.email, receiptTemplate(req.id));
}

Timeline

Timeline
Date	Event
1 July 2023 to 1 March 2024	Relevant period ([¶ 21](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf))
17 February 2026	Ford and the Enforcement Division sign ([Order, pp. 11–12](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf))
27 February 2026	Board adopts the order, effective immediately ([Order, p. 1](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf))
5 March 2026	CalPrivacy announcement ([Announcement](https://privacy.ca.gov/2026/03/ford-to-change-practices-pay-fine-for-adding-unnecessary-friction-to-opt-out-process/))

Outcome

Ford pays USD 375,703 within 30 days of the decision (¶ 48) and each side bears its own fees (¶ 53). The opt-out changes and the Ford.com tracker audit were due within 90 days. There is no multi-year reporting or monitoring term, unlike Honda or Tractor Supply. Ford had already processed the stalled requests during the investigation (¶ 35).

What it cost

What it cost
Item	Amount or term
Administrative fine	USD 375,703 ([¶ 48](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf))
Agency fees	Each side bears its own ([¶ 53](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf))
Tracker audit of Ford.com	One-off, within 90 days ([¶¶ 51–52](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf))
Ongoing reporting	None stated

Why it matters

The head of enforcement compared opt-out friction with checkout friction: unnecessary steps "can discourage consumers from exercising their privacy rights" (Announcement). Like the earlier CPPA orders against Honda and Todd Snyder, it treats a verification step on opt-outs as a violation. Here the step was only an email click, with no ID document or data matching, and that was enough. See unequal choices or identity checks and CCPA.

How Inth catches this

Code audit: data flow mapping shows what the opt-out route collects and where the request goes; it will not judge whether a confirmation email is a verification step, so review request states yourself.
Website audit: checks what loaded against region, consent state, vendor record and policy, so a tracker that still fires for a visitor with a GPC opt-out is recorded with the page and time. That is the substance of the ¶ 51 audit.
Consent banner: in California, Global Privacy Control counts as an opt-out of sale and sharing, so marketing and analytics stay off for that visitor. By default the banner gives Accept and Reject the same weight; it does not cover a separate privacy request form like Ford’s.
Evidence: dated runtime observations and consent records (choice, country, policy).

Limit: Inth does not run your privacy request forms or email flows, and cannot see sales of connected-vehicle data made from the back end.

Checks for your own systems

In the repository

List the status values for an opt-out request. Any "pending confirmation" or "expired" state is a warning.
Find jobs that expire or close privacy requests and exclude opt-outs from them.

In the browser and network

Submit an opt-out and read the next screen and email. Neither should ask for a click to proceed.
Load the site with GPC on and filter for advertising pixels on first load.

With the people responsible

Ask who owns the privacy request vendor’s workflow settings and whether opt-outs share the access and deletion template.
Count how many opt-outs were not completed in the last year, and why.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Ford’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.