[Enforcement library](/enforcement)

# Todd Snyder: check whether your opt-out portal completes requests

You can check whether an opt-out changes data use after submission. Todd Snyder’s 2025 order describes a portal failure that lasted 40 days.

CPPA · CCPA · Stipulated order announced 6 May 2025

- Case record
- What happened
- Technical behaviour
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Authority | California Privacy Protection Agency (CPPA) |
| Entity | Todd Snyder, Inc. |
| Jurisdiction and law | California, US · California Consumer Privacy Act (CCPA) |
| Action | Stipulated final order adopted 1 May 2025 |
| Announced | 6 May 2025 |
| Amount | USD 345,178 administrative fine |
| Source review | 16 October 2026 |

[Adopted decision, page 1](https://www.cppa.ca.gov/pdf/20250501_snyder_order.pdf) · [CPPA announcement](https://www.cppa.ca.gov/announcements/2025/20250506.html). Todd Snyder and the California Privacy Protection Agency (CPPA) resolved the allegations through a stipulated order. The parties agreed to its terms.

## What happened

The CPPA alleged that the privacy portal failed to process opt-outs from sale or sharing for 40 days. It attributed the failure to oversight and configuration errors. The CPPA also challenged unnecessary data collection and identity checks.

The order called for correct configuration of opt-out controls and employee training. [CPPA announcement](https://www.cppa.ca.gov/announcements/2025/20250506.html)

## Technical behaviour

The cited failure concerned the system behind the portal. The announcement does not give enough technical detail to reproduce the cause of the failure. [CPPA account](https://www.cppa.ca.gov/announcements/2025/20250506.html)

Inth’s technical interpretation: an opt-out needs proof of completion. A success message or HTTP 200 response does not show whether the choice reached the systems that use it. HTTP 200 is a response code for a successful HTTP request.

## Checks for your own systems

### In the repository

- Trace the submission through configuration, queues, vendor interfaces, and the store for privacy choices.
- Name the owner of each hand-off.
- Check error paths, retries, and alerts.
- Set an alert for a privacy choice that fails to arrive on time.

### In the browser and network

- Submit an opt-out with invented data in a test environment.
- Check the saved choice after reload and navigation.
- Check whether the data flow follows the choice.
- Test a vendor outage, invalid configuration, and delayed jobs.
- Check that the interface reports completion only after the system completes the opt-out.

### With the people responsible for data use

- Name the person who receives each alert.
- Assign the check after a deployment or vendor change to a named person.
- Ask the process owner to review mandatory fields and identity checks.
- Keep a record of checks from submission to completion.

## Sources and limits

[CPPA announcement, 6 May 2025](https://www.cppa.ca.gov/announcements/2025/20250506.html) · [Adopted decision and stipulated final order](https://www.cppa.ca.gov/pdf/20250501_snyder_order.pdf).

Source review: 16 October 2026. This page describes the cited action. It does not audit Todd Snyder’s current portal.

The cited material does not establish that a particular software vendor caused the failure. Inth wrote these technical checks. They cannot decide which laws apply or prove compliance with a law or contract.

A browser capture cannot show all server operations. This page does not establish the status of every later legal action.

Related: [Honda and unequal choices](/enforcement/honda) · [Healthline and ineffective opt-outs](/enforcement/healthline).

Explore [Code audit](/code-audit) and [Website audit](/website-audit).