Business Vantage Point Blog

In its first major enforcement action, the California Privacy Protection Agency recently settled with American Honda Motor Co., a California corporation with its principal place of business in the state, for alleged violations of the California Consumer Privacy Act (CCPA) related to the company’s implementation of programs addressing rights granted consumers by the CCPA. Honda agreed to change its business practices and to pay a $632,500 fine.

This settlement is the first time the agency has settled with a public company over alleged violations of consumer rights. The agency has previously settled with a number of data brokers for the failure to register with the agency. (See, i.e., “CPPA Settles with First Set of Data Brokers” (November 14, 2024); “CPPA's Enforcement Division Inks Settlement with Fifth Data Broker” (January 29, 2025).) Prior to the creation of the agency, the California Attorney General enforced the CCPA and settled with a number of public companies.

The Settlement

The California Privacy Protection Agency’s Enforcement Division alleged the following conduct by Honda violated California consumers’ privacy rights:

• Placing excessive burdens on the exercise of certain privacy rights.
• The configuration of an online privacy management tool.
• Obstructing consumers’ use of authorized agents to exercise privacy rights on their behalf.
• Entering into contracts that failed to appropriately protect consumer privacy rights.

Under the CCPA, consumers in California have certain rights to direct how a business uses and/or retains their data, including the right to know, the right to delete, the right to opt out of the sale or sharing of their personal information, the right to correct, the right to limit the use of their information for certain purposes (such as targeted advertising), and the right to non-discrimination. Honda chose to use a single form to manage contact with consumers wishing to exercise their rights under the CCPA. The agency alleged that Honda’s use of a uniform process to address requests under the CCPA unduly burdened consumers. The agency argued that the right to opt out of the sale or sharing of personal information, and to limit the use or disclosure of a consumer’s personal information, should not be subject to the same verification requirements as, say, the right to delete.

Honda faced a similar issue with its method for consumers to authorize an agent to make a request on their behalf. Honda’s program required the consumer to directly confirm they had authorized their agent to make any kind of request related to the exercise of their rights. The agency’s position was that Honda made it too difficult for consumers’ agents to opt out of the sale or sharing and to limit the use or disclosure of their clients’ personal information.

Honda used a well-known compliance vendor for privacy solutions to provide a cookie management tool for its websites. This tool allowed consumers to manage the use of cookies (split into necessary, performance, functional and advertising cookies) on Honda’s websites. The tool required a consumer to opt out by toggling each category of cookies to “inactive” and then clicking a button to confirm the selection. However, a consumer could opt back in by clicking a single button (“Allow All”). The agency argued that by allowing the consumer to opt in through a single button press but requiring the consumer to select each individual category to opt out, the conduct violated the CCPA by making the process to opt out more burdensome than the option to opt in. The agency further opined in the settlement that a banner that provided a choice between accepting all cookies and a second screen allowing consumers to opt out would be asymmetric and that an equal or symmetrical choice would need to be between “Accept All” and “Decline All.” Because many websites require certain cookies from the user, such a choice would need to be phrased as something closer to “Decline All but Necessary Cookies” to make the appropriate disclosure.

Finally, with respect to the contractual issues, Honda sold, shared and/or disclosed consumers’ personal information collected through its websites to advertising companies that used it for advertising and marketing purposes. Under the CCPA, Honda was required to have contracts with these companies that identify the limited and specified purposes for which consumers’ personal information could be used and that would require the advertising companies to afford consumers the same level of protection under the CCPA that Honda required. According to the settlement, Honda failed to make the necessary contractual arrangements with its partners.

The agency is authorized to impose a fine of $2,500 for each violation (or $7,500 for each intentional violation) of the CCPA. The agency tied $382,500 of the $632,500 total fine to 153 consumers who were identified as having been impacted by the verification and/or authorization requirements. The agency did not attempt to explain how it calculated the remaining $250,000 as an appropriate penalty for the other conduct described in the settlement.

Takeaways

The CCPA regulates the conduct of any entity meeting at least one of three thresholds: (1) has more than $25 million gross annual revenue; (2) annually buys, sells or shares the personal information of at least 100,000 consumers or households; or (3) derives more than 50% of its annual revenues from selling or sharing consumers’ personal information. Honda met the first two thresholds of the CCPA’s test. With its principal place of business located in California (and a considerable volume of business in the state), Honda also provided the CCPA with a target comfortably inside its jurisdictional reach.

The settlement demonstrates that the agency is taking a very granular approach in identifying what it believes to be violations of the CCPA. Most of the violations alleged to have taken place in this settlement stem from the configuration of privacy rights on Honda’s website. For example, a website designer may find it convenient to use a single form for the exercise of any privacy right, but the agency is taking the position that coding shortcuts violate California law and there need to be different forms for different rights. Cookie banners and configuration systems need to be scrutinized to determine if exercising a right requires more clicks than waiving it. One of Honda’s remedial undertakings is to consult a user experience (UX) designer to evaluate its methods for submitting privacy requests. Honda also agreed to certify its compliance, provide additional training to its employees, and to make changes to its contracting process.

As the country’s first dedicated privacy organization, the agency is well aware of the focus and attention its enforcement actions garner. In fact, the mission statement for the agency promises to “vigorously enforce the law against businesses that violate consumers’ privacy rights.” As the agency continues to develop, we expect the number of enforcement actions to increase. The net effect of this settlement is that personnel with responsibilities for privacy compliance (whether in the form of internal specialists or outside counsel) need to not only examine whether they are providing a means through which California consumers can exercise their rights, but also must carefully evaluate how consumers utilize these methods.