Articles

March 13, 2025

Hudson Cook Enforcement Alert: California Privacy Protection Agency Takes CCPA Enforcement Action Against Auto Maker for Alleged Violations of Consumer Privacy Rights

Erik Kosa, Mark D. Metrey and Julia K. Whitelock

HIGHLIGHTS:

  • Major privacy settlement shows California Privacy Protection Agency ("CPPA") is ramping up enforcement.
  • While this action is part of a larger privacy sweep against manufacturers with connected vehicle technology, the privacy violations at issue are not unique to auto manufacturers and can apply across industries.
  • The Company will pay a $632,500 administrative fine and implement corrective measures to ensure compliance with California's privacy laws.

CASE SUMMARY:

On March 7, 2025, the CPPA finalized a Stipulated Order against an automobile manufacturer (the "Company") alleging multiple violations of the California Consumer Privacy Act ("CCPA") . The CPPA alleged that the Company collected more data than it needed, made it difficult for consumers to use authorized agents to act on their behalf to assert their rights under the CCPA, made it difficult for consumers to understand how to control what information was being collected, and failed to maintain contracts with advertising technology vendors containing adequate privacy protections.

The CPPA alleged the Company unlawfully required consumers to provide more information than necessary to process requests to opt out of personal data sales and sharing by imposing improper identity verification requirements on opt-out requests. The Company generally only needed two data points to verify a consumer's identity in its database. However, the Company's online privacy request process required consumers to verify their identity by providing their first name, last name, address, city, state, zip code, preferred method to receive updates, email, and phone number before submitting requests to opt out of data sales or limit the use of their sensitive personal information. While the CCPA requires identity verification before exercising access or deletion rights, it prohibits businesses from requiring verification for opt-out requests to ensure that consumers can limit certain uses of their data easily. In addition, the CPPA alleged the Company improperly required consumers to confirm their authorized agents' requests, though not required by the CCPA.

The CPPA also penalized the Company for lacking a symmetrical means of turning advertising cookies on and off, requiring two steps to turn off a cookie and only one step to turn it back on. Finally, the CPPA claimed the Company failed to maintain contracts with advertising technology vendors that complied with the CCPA's requirements, putting consumer data at risk. The CCPA requires contracts with specific terms to be in place with service providers to protect consumer personal information.

SETTLEMENT TERMS:

Without admitting or denying liability, the Company agreed to pay an administrative fine in the amount of $632,500 and implement compliance reforms, including:

  • Modifying its consumer privacy request procedures to ensure compliance with CCPA requirements, including eliminating improper verification for opt-out requests;
  • Updating its cookie management system to provide a "Reject All" option and ensure symmetry in consumer choice;
  • Implementing required contracts with third-party advertising technology vendors to comply with the CCPA's requirements; and
  • Providing employee training on CCPA compliance and reporting updates to the CPPA.

This enforcement action is part of a larger trend by state regulators aggressively pursuing violations of law involving consumer data.

RESOURCES:

You can review all of the relevant court filings and press releases at the CPPA's Enforcement Page.

Enforcement Alerts by Hudson Cook, LLP, written by the attorneys in the firm's Government Investigations, Examinations and Enforcement and Litigation practice groups, are provided to keep you informed of federal and state government enforcement actions and related actions that may affect your business. Please contact our attorneys if you have any questions regarding this Alert. You may also view articles, register for an upcoming CFPB Bites monthly webinar or request a past webinar recording on our website.

Hudson Cook, LLP provides articles, webinars and other content on its website from time to time provided both by attorneys with Hudson Cook, LLP, and by other outside authors, for information purposes only. Hudson Cook, LLP does not warrant the accuracy or completeness of the content, and has no duty to correct or update information contained on its website. The views and opinions contained in the content provided on the Hudson Cook, LLP website do not constitute the views and opinion of the firm. Such content does not constitute legal advice from such authors or from Hudson Cook, LLP. For legal advice on a matter, one should seek the advice of counsel.