On March 12, 2025, the California Privacy Protection Agency (CPPA) announced a settlement with American Honda Motor Co., resolving allegations that the company violated the California Consumer Privacy Act (CCPA) and requiring Honda to pay a $632,500 fine. The announcement marks the Agency’s most far-reaching enforcement action, and the first to stem from the CPPA’s July 2023 announcement that it was reviewing the data privacy practices of connected vehicle manufacturers and related technologies.
The fine has two components. Honda was fined $382,500 for its alleged violation of 153 consumers’ opt-out and other CCPA rights. This amount works out to $2,500 per consumer – the maximum allowed under the CCPA for non-intentional violations. The CPPA’s Order does not explain how it determined the remaining $250,000 of the fine.
The CPPA’s Order alleges Honda violated the CCPA in several ways, including by: (1) requiring Californians to verify their identities before requesting to opt out of the sale or sharing of their personal information, or to limit the use of their sensitive personal information (the “right to limit”); (2) making it unduly difficult for consumers to exercise their privacy rights through authorized agents; (3) failing to offer consumers “symmetry in choice” over advertising cookies; and (4) sharing consumers’ personal information with advertising technology companies without mandatory contract provisions in place.
Below, we break down what you need to know about the CPPA’s order.
Submitting Requests to Opt-Out of Sale/Sharing and Requests to Limit the Use of Sensitive Personal Information. The CPPA alleged Honda required users to provide excessive amounts of information (e.g., name, address, email, and phone number) to opt out of sale or sharing, or limit the use of sensitive personal information.
Before honoring a consumer’s request to know, correct, or delete their personal information under the CCPA, businesses may verify the consumer’s identity by collecting limited additional information to confirm a consumer is who they say they are. However, the CCPA prohibits businesses from requiring consumers to verify their identity for opt-out or right to limit requests.
Honda allegedly required consumers to provide their name, address, email, and other pieces of personal information to submit any privacy request. The CPPA took issue here, arguing that requiring this information in order to process opt-out and right to limit requests impaired consumers’ ability to exercise their CCP rights.
Processing Requests to Opt-Out of Sale/Sharing and Requests to Limit Submitted by Authorized Agents. The CPPA also alleged that Honda interfered with consumers’ ability to use authorized agents. Specifically, according to the CPPA, Honda required the authorized agent to provide the email or mailing address of the consumer so that Honda could seek proof from the consumer that that the agent had permission to act on their behalf.
As the Order explains, the CCPA sets different limits on the proof that businesses may seek in connection with authorized agent requests. For requests to delete, correct, or know, businesses may require authorized agents to provide proof that the consumer gave the agent permission to submit the request, or the business may ask the consumer directly to confirm that they authorized the agent to act for them. For opt-out and right to limit requests, however, businesses may only ask the authorized agent for written permission signed by the consumer; businesses may not ask consumers to confirm that they authorized the agent to make these requests.
Submitting Requests to Opt-Out of Sale/Sharing through a Cookie Consent Management Tool. The CPPA also alleged Honda’s cookie consent management tool did not offer symmetry in opt-out and opt-in choices.
This claim is based on the CCPA requirement that methods to submit privacy rights requests must be easy to understand and execute, and must provide “symmetry in choice” – i.e., making a more “privacy-protective” choice cannot be more difficult than choosing a “less privacy-protective” option.
Citing this requirement, the CPPA faulted Honda for providing a cookie consent interface that required two steps to turn off advertising cookies – moving a slider and then clicking “Confirm My Choices” – only one step to turn advertising cookies back on.
Contracts with Adtech Vendors. Finally, the CPPA alleged that Honda did not enter into legally required written contracts to sell, share, or disclose personal information to advertising technology vendors. Terms required in these contracts include limits on the uses and purposes for which data is processed, as well as requirements for these entities to provide the same level of privacy protection as required of businesses by the CCPA.
Although Honda sold, shared, or disclosed personal information with advertising technology companies, the CPPA alleged that Honda “could not produce” contracts with those vendors to the Agency and concluded that Honda failed to meet the requirement for written contracts.
Non-Monetary Relief. In addition to paying a fine, Honda agreed to make several changes to its privacy compliance program, including modifying its CCPA request process so that consumers need only provide the minimum amount of information necessary to make opt-out and right to limit requests. The settlement also orders Honda to modify its contract management and tracking process, and to consult a user experience designer to evaluate its methods for submitting CCPA requests.
***
The Honda Order is consistent with CCPA compliance themes the Agency has previously highlighted, including the importance of clear consumer choice mechanisms, data minimization in consumer requests, and strong partner contracting and due diligence efforts. While this is the most extensive enforcement action by the CPPA so far, it almost certainly will not be the last.
[View source.]
