Skip to main contentHonda: check how much work your privacy choices demand
You can compare the work that each privacy choice demands. Honda’s 2025 order covers identity checks, unequal choices, and contracts for ads.
Case record
| Fact | Record |
|---|---|
| Authority | California Privacy Protection Agency (CPPA) |
| Entity | American Honda Motor Co., Inc. |
| Jurisdiction and law | California, US · California Consumer Privacy Act (CCPA) |
| Action | Stipulated final order adopted 7 March 2025 |
| Announced | 12 March 2025 |
| Amount | USD 632,500 administrative fine |
| Source review | 16 October 2026 |
Adopted decision, page 1 · CPPA announcement. Honda and the California Privacy Protection Agency (CPPA) agreed to a stipulated order. The order contains agreed factual findings.
The parties resolved the action without a trial.
What happened
The CPPA resolved claims about unnecessary identity checks and unequal privacy choices. Other claims concerned barriers for authorised agents and contracts that lacked necessary terms with companies that serve ads.
Honda agreed to simplify its privacy process. It also agreed to a review of the user experience, staff training, and changes to its contract process. CPPA announcement
Technical behaviour
The order describes a shared form that demanded identity checks for opt-out requests and requests to limit sensitive personal information use. It distinguished these rights from requests to know, delete, or correct personal information.
The order records 2 steps to turn cookies for ads off. The interface used 1 step to turn them on again. Stipulated order, paragraphs 33–43 and 53–65
Inth’s technical interpretation: each type of privacy request needs its own rules for fields and identity checks. The complete choice path matters. The first screen does not show later errors, extra steps, or the result on a return visit.
Checks for your own systems
In the repository
- Trace the field rules for each type of privacy request.
- Find the identity checks and conditions that block submission.
- Check the separate rules for authorised agents.
- Check whether account-recovery rules add unnecessary barriers.
In the browser and network
- Compare opposite choices from the same initial state.
- Record the steps, mandatory fields, and errors for each choice.
- Test access with the keyboard.
- Check whether the choice persists on a return visit.
- Use invented records in a test environment to trace submission through acknowledgement and completion.
With the people responsible for data use
- Ask privacy counsel and the process owner to justify each field for the relevant privacy right.
- Compare destinations for ads with the signed contracts.
- Check the contract terms separately from the interface.
Sources and limits
Source review: 16 October 2026. This page describes the cited 2025 action. It does not audit Honda’s current interface or establish the status of every later legal action.
Inth wrote these technical checks. They cannot decide which laws apply or prove compliance with a law or contract. A browser capture cannot show all server operations.
An authorised agent acts for another person in a privacy request. The interface alone cannot prove the terms of a signed contract.
Related: Todd Snyder and portal reliability · Sephora and GPC.
Explore Consent banner and Website audit.