[Enforcement library](/enforcement)

# Ford: do not make an opt-out wait for an email confirmation

Read the message your opt-out form shows after "Submit". If it says "One More Step!", you may have the same problem as Ford: the CPPA found that Ford parked opt-out requests until people clicked a confirmation link, and dropped the ones that never did.

California Privacy Protection Agency (CalPrivacy) · CCPA · Board decision 27 February 2026

## The problem

People filled in Ford's privacy rights form, solved a reCAPTCHA and chose "Opt-out of Sharing". Ford then showed "One More Step! Please confirm your Request!" and emailed a link saying "you must confirm your email and identity". Requests without a click were marked "expired", so Ford did not process dozens of opt-outs in time and kept selling or sharing those people's data ([Order, ¶¶ 28–35, 42](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)).

- The problem
- Case record
- What the regulator found
- What the order requires
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Regulator | California Privacy Protection Agency; decision by its Board, Chair Jennifer M. Urban (\[Order, p. 1\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)) |
| Case number | ENF23-V-FO-3 |
| Parties | CPPA Enforcement Division v. Ford Motor Company |
| Counsel | Enforcement Division attorneys Alex Berger and Michael Meyer (\[Announcement\](https://privacy.ca.gov/2026/03/ford-to-change-practices-pay-fine-for-adding-unnecessary-friction-to-opt-out-process/)); Baker & Hostetler, LLP for Ford (\[Order, p. 11\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)) |
| Laws | CCPA; 11 CCR § 7026(d) |
| Stage | Stipulated final order adopted by the Board, 27 February 2026; review waived (\[¶ 59\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)) |
| Amount | USD 375,703 administrative fine (\[¶ 48\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)) |
| Source review | 17 October 2026 |

Ford "neither admits nor denies" the factual findings and does not admit liability ([¶ 58](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)). The order also records that Ford "did not intend" to require verification or to include the identity wording in the email ([¶ 36](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)).

## What the regulator found

| Practice | What the law requires | What the order describes | Source |
| --- | --- | --- | --- |
| Verification before opt-out | A business may not require a verifiable consumer request to opt out; "to the extent that the business can comply... without additional information, it shall do so" (11 CCR § 7026(d)) | Ford could have processed the form as submitted, but required a click on a "Confirm Email" link first | \[¶¶ 24–27, 30–38\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf) |
| Selling after opt-out | Stop selling or sharing once directed (Civ. Code § 1798.120(d)) | Unconfirmed requests "expired"; Ford kept selling or sharing for dozens of people, and processed them only after the investigation | \[¶¶ 35, 39–43\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf) |

The form itself asked for name, full address, phone number and relationship to Ford before submission ([¶ 28](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)). The order does not challenge those fields; its findings concern the confirmation step that followed. The relevant period is 1 July 2023 to 1 March 2024 ([¶ 21](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)).

## What the order requires

Paragraphs are from the [stipulated final order](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf).

- Opt-out methods "that are easy and require minimal steps" (¶ 50(a)).
- No verifiable consumer request for opt-outs (¶ 50(b)).
- Honour each opt-out to the extent possible within the CCPA's time limit (¶ 50(c)).
- An audit of "the tracking technologies, such as cookies, web beacons, and pixels, on its website, Ford.com", to make sure each honours opt-out preference signals such as Global Privacy Control (¶ 51).
- Complete both and confirm in writing within 90 days (¶ 52).

## Technical issue

- **Tools or vendors:** Ford's privacy rights form with reCAPTCHA; an email confirmation flow; tracking technologies on Ford.com, not named.
- **Where:** the web form covering data from Ford's digital properties and connected vehicle services ([¶ 29](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)).
- **What data:** personal information Ford sold or shared, not itemised in the order.
- **When:** after the person submitted an opt-out, for as long as the request sat unconfirmed or expired.
- **How it came to light:** the Enforcement Division's review of connected-vehicle manufacturers, with a research technologist assisting ([Announcement](https://privacy.ca.gov/2026/03/ford-to-change-practices-pay-fine-for-adding-unnecessary-friction-to-opt-out-process/)).

**Inth's technical interpretation:** the opt-out reused a request pipeline built for access and deletion, where email confirmation guards against impostors. For an opt-out that guard has no purpose: a false opt-out harms nobody, which is why the rules forbid verification. A state machine with an "awaiting confirmation" status and an expiry job turned a reasonable security pattern into an unprocessed request.

Illustrative pattern, not the defendant's code.

```ts
// Bad: opt-out waits for an email click and silently expires
async function submitOptOut(form: OptOutForm) {
  const req = await requests.create({ ...form, type: "opt_out", status: "awaiting_email_confirmation" });
  await mailer.send(form.email, confirmIdentityTemplate(req.id));
}
// nightly job: requests.expire({ status: "awaiting_email_confirmation", olderThanDays: 7 })
```

Illustrative pattern, not the defendant's code.

```ts
// Fixed: act on what was submitted; the email is a receipt, not a gate
async function submitOptOut(form: OptOutForm) {
  const req = await requests.create({ ...form, type: "opt_out", status: "received" });
  await optOuts.apply({ email: form.email, phone: form.phone }); // what the form already has
  await requests.update(req.id, { status: "honoured" });
  await mailer.send(form.email, receiptTemplate(req.id));
}
```

## Timeline

| Date | Event |
| --- | --- |
| 1 July 2023 to 1 March 2024 | Relevant period (\[¶ 21\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)) |
| 17 February 2026 | Ford and the Enforcement Division sign (\[Order, pp. 11–12\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)) |
| 27 February 2026 | Board adopts the order, effective immediately (\[Order, p. 1\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)) |
| 5 March 2026 | CalPrivacy announcement (\[Announcement\](https://privacy.ca.gov/2026/03/ford-to-change-practices-pay-fine-for-adding-unnecessary-friction-to-opt-out-process/)) |

## Outcome

Ford pays USD 375,703 within 30 days of the decision ([¶ 48](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)) and each side bears its own fees ([¶ 53](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)). The opt-out changes and the Ford.com tracker audit were due within 90 days. There is no multi-year reporting or monitoring term, unlike [Honda](/enforcement/honda) or [Tractor Supply](/enforcement/tractor-supply). Ford had already processed the stalled requests during the investigation ([¶ 35](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)).

## What it cost

| Item | Amount or term |
| --- | --- |
| Administrative fine | USD 375,703 (\[¶ 48\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)) |
| Agency fees | Each side bears its own (\[¶ 53\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)) |
| Tracker audit of Ford.com | One-off, within 90 days (\[¶¶ 51–52\](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)) |
| Ongoing reporting | None stated |

## Why it matters

The head of enforcement compared opt-out friction with checkout friction: unnecessary steps "can discourage consumers from exercising their privacy rights" ([Announcement](https://privacy.ca.gov/2026/03/ford-to-change-practices-pay-fine-for-adding-unnecessary-friction-to-opt-out-process/)). Like the earlier CPPA orders against [Honda](/enforcement/honda) and [Todd Snyder](/enforcement/todd-snyder), it treats a verification step on opt-outs as a violation. Here the step was only an email click, with no ID document or data matching, and that was enough. See [unequal choices or identity checks](/enforcement/issues/unequal-choices-or-identity-checks) and [CCPA](/enforcement/laws/ccpa).

## How Inth catches this

- **Code audit:** data flow mapping shows what the opt-out route collects and where the request goes; it will not judge whether a confirmation email is a verification step, so review request states yourself.
- **Website audit:** checks what loaded against region, consent state, vendor record and policy, so a tracker that still fires for a visitor with a GPC opt-out is recorded with the page and time. That is the substance of the ¶ 51 audit.
- **Consent banner:** in California, Global Privacy Control counts as an opt-out of sale and sharing, so marketing and analytics stay off for that visitor. By default the banner gives Accept and Reject the same weight; it does not cover a separate privacy request form like Ford's.
- **Evidence:** dated runtime observations and consent records (choice, country, policy).

Limit: Inth does not run your privacy request forms or email flows, and cannot see sales of connected-vehicle data made from the back end.

## Checks for your own systems

### In the repository

- List the status values for an opt-out request. Any "pending confirmation" or "expired" state is a warning.
- Find jobs that expire or close privacy requests and exclude opt-outs from them.

### In the browser and network

- Submit an opt-out and read the next screen and email. Neither should ask for a click to proceed.
- Load the site with GPC on and filter for advertising pixels on first load.

### With the people responsible

- Ask who owns the privacy request vendor's workflow settings and whether opt-outs share the access and deletion template.
- Count how many opt-outs were not completed in the last year, and why.

## Sources and limits

- [Order of decision and stipulated final order, 27 February 2026](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision-Ford-Motor-Co.pdf)
- [CalPrivacy announcement, 5 March 2026](https://privacy.ca.gov/2026/03/ford-to-change-practices-pay-fine-for-adding-unnecessary-friction-to-opt-out-process/)

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Ford's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Honda](/enforcement/honda) · [Todd Snyder](/enforcement/todd-snyder) · [General Motors](/enforcement/general-motors) · [Unequal choices or identity checks](/enforcement/issues/unequal-choices-or-identity-checks)