Compliance Stuff

For the second time in a week, California privacy regulators announced a significant fine against a business for failing to satisfy California Consumer Privacy Act’s (CCPA) “clear and conspicuous” opt-out requirements. T he California Privacy Protection Agency fined Ford Motor Company $375,000 fine on March 5, finding that the automaker’s process for letting consumers opt out of having their personal information sold or shared created “unnecessary friction” in violation of the CCPA . These back-to-back enforcement actions should serve as a wake-up call for businesses to ensure their opt-out policies can withstand regulators’ scrutiny. What happened in this matter, and what lessons can you learn from the fine? What Happened? The agency found that Ford’s opt-out process required consumers to verify their email address prior to opting out of the sale and/or sharing of their personal information . If consumers did not complete the email verification step, Ford did not process their opt-ou...

Key Takeaways: California’s Delete Request and Opt-Out Platform (DROP) is now finalized and will launch January 1, 2026, enabling consumers to submit a single, authenticated deletion request to all registered data brokers. Data brokers face significant new operational obligations starting August 1, 2026, including mandatory DROP integration, retrieval of requests at least every 45 days, 90-day determination deadlines, and suppression list requirements. Noncompliance can result in penalties of $200 per request, per day. DROP operationalizes the Delete Act and expands consumer privacy rights, requiring data brokers to overhaul how they identify, match, store, and delete personal information, including in situations where they may not traditionally view themselves as data brokers. At the  November 7, 2025  Board meeting for the California Privacy Protection Agency, which recently adopted the public-facing shorthand “ CalPrivacy ,” Board Member Jennifer Urban described the state’...