Run a free scan

Todd Snyder: check whether your opt-out portal completes requests

You can check whether an opt-out changes data use after submission. Todd Snyder’s 2025 order describes a portal failure that lasted 40 days.

CPPA · CCPA · Stipulated order announced 6 May 2025

Case record

Todd Snyder enforcement facts
FactRecord
AuthorityCalifornia Privacy Protection Agency (CPPA)
EntityTodd Snyder, Inc.
Jurisdiction and lawCalifornia, US · California Consumer Privacy Act (CCPA)
ActionStipulated final order adopted 1 May 2025
Announced6 May 2025
AmountUSD 345,178 administrative fine
Source review16 October 2026

Adopted decision, page 1 · CPPA announcement. Todd Snyder and the California Privacy Protection Agency (CPPA) resolved the allegations through a stipulated order. The parties agreed to its terms.

What happened

The CPPA alleged that the privacy portal failed to process opt-outs from sale or sharing for 40 days. It attributed the failure to oversight and configuration errors. The CPPA also challenged unnecessary data collection and identity checks.

The order called for correct configuration of opt-out controls and employee training. CPPA announcement

Technical behaviour

The cited failure concerned the system behind the portal. The announcement does not give enough technical detail to reproduce the cause of the failure. CPPA account

Inth’s technical interpretation: an opt-out needs proof of completion. A success message or HTTP 200 response does not show whether the choice reached the systems that use it. HTTP 200 is a response code for a successful HTTP request.

Checks for your own systems

In the repository

  • Trace the submission through configuration, queues, vendor interfaces, and the store for privacy choices.
  • Name the owner of each hand-off.
  • Check error paths, retries, and alerts.
  • Set an alert for a privacy choice that fails to arrive on time.

In the browser and network

  • Submit an opt-out with invented data in a test environment.
  • Check the saved choice after reload and navigation.
  • Check whether the data flow follows the choice.
  • Test a vendor outage, invalid configuration, and delayed jobs.
  • Check that the interface reports completion only after the system completes the opt-out.

With the people responsible for data use

  • Name the person who receives each alert.
  • Assign the check after a deployment or vendor change to a named person.
  • Ask the process owner to review mandatory fields and identity checks.
  • Keep a record of checks from submission to completion.

Sources and limits

Source review: 16 October 2026. This page describes the cited action. It does not audit Todd Snyder’s current portal.

The cited material does not establish that a particular software vendor caused the failure. Inth wrote these technical checks. They cannot decide which laws apply or prove compliance with a law or contract.

A browser capture cannot show all server operations. This page does not establish the status of every later legal action.