California's privacy regulator fined two retailers a combined $977,678 in 2025, and in both cases the part that failed was the one nobody was watching: the mechanism that tells a website to stop selling a shopper's data. Honda's own cookie tool let a visitor accept tracking in one click and made them click twice to refuse it. Todd Snyder's consent banner rendered, then vanished, for 40 straight days, and nobody on staff noticed until a regulator did. Starting January 1, 2027, a new California law puts that exact mechanism on autopilot inside every browser sold in the state, which means the same quiet failure these two companies got caught for is about to run at the scale of every visitor, not just the handful who bothered to click.
What CalPrivacy actually found
The California Privacy Protection Agency, now branded CalPrivacy, adopted a stipulated final order against American Honda Motor Co. on March 7, 2025 (Case No. ENF23-V-HO-2) and against Todd Snyder, Inc. on May 1, 2025 (Case No. ENF23-M-TO-26). Read side by side, the two orders describe the same category of failure from opposite directions.
| Honda | Todd Snyder | |
|---|---|---|
| Case number | ENF23-V-HO-2 | ENF23-M-TO-26 |
| Fine | $632,500 | $345,178 |
| Core opt-out failure | Cookie tool took one click to accept tracking, two to refuse it; Global Privacy Control wasn't honored for known, logged-in consumers | Consent banner rendered and instantly disappeared for 40 days, blocking both manual opt-outs and incoming Global Privacy Control signals |
| Also cited for | Treating a non-verifiable opt-out request as if it needed identity verification; requiring authorized agents' consumers to confirm the agent's authority directly with Honda | The same unlawful verification standard, applied through one form that demanded a photo of a government ID to process every request type, opt-outs included |
Honda's order names the arithmetic directly: from July 1 to September 23, 2023 alone, at least 119 consumers were asked for more information than the law allows just to opt out, and at least 20 were denied outright for failing a verification step California law says opt-outs cannot require. Todd Snyder's order is just as specific about its own 40-day window: "In the circumstances where the banner instantaneously disappeared, it was impossible for Consumers to submit their Requests to Opt-out of Sale/Sharing," and the same misconfiguration meant "Consumers' Requests to Opt-out of Sale/Sharing submitted through Opt-out Preference Signals, such as the Global Privacy Control, were not processed."
The pattern: opt-out was built like an afterthought, not a right
California's regulations require what they call symmetry in choice: the path to a more privacy-protective option can't take more clicks or more effort than the path to a less protective one. Honda's cookie tool failed that test on its face, one click for "Allow All," two for turning off advertising cookies, which the order treats as exactly the kind of asymmetry the rule was written to catch.
The verification failure in both cases is a distinct, arguably more common mistake. California law splits privacy requests into two kinds: Requests to Know, Correct, or Delete, which a business is allowed to verify because a wrong disclosure could hurt someone, and Requests to Opt-Out of Sale/Sharing or Limit, which the law says cannot be gated behind verification at all, because the harm from an imposter opting someone else out is close to nothing. Both companies built one intake path for every request type and applied delete-and-correct-grade scrutiny, including Todd Snyder asking for a photo of a government ID, to a right the statute says has to stay frictionless.
Why this gets harder to hide after January 2027
Global Privacy Control works today because a subset of browsers and browser extensions send it automatically for the people who've turned it on, a small, self-selecting, privacy-conscious slice of traffic. That's exactly why Todd Snyder's misconfiguration ran quietly for 40 days: only a fraction of visitors were sending the signal, and fewer still noticed it wasn't working.
That changes on January 1, 2027, when the California Opt Me Out Act (AB 566), signed by Governor Newsom in October 2025 and sponsored by CalPrivacy itself, requires every web browser offered in California to build in its own opt-out preference signal, branded OOPS, as a standard feature rather than an opt-in extra. CalPrivacy's own 2025 annual report describes the intent plainly: instead of opting out at hundreds of sites individually, a consumer flips one browser setting and "you're protected everywhere." Once that setting ships as a default rather than a niche download, the same backend gap that sat undetected in Todd Snyder's consent tool for 40 days stops being a quiet failure affecting a sliver of visitors and starts being a live, continuous test running against a browser-default share of California traffic from day one. CalPrivacy's enforcement pipeline is already staffed to notice: its first sectoral audit, opened in mid-2026, shows the agency actively looking for exactly this kind of gap rather than waiting for a complaint to land.
What "built to survive an automatic signal" actually requires
Honda's remedy terms double as a punch list, because CalPrivacy wrote them as specific engineering fixes rather than general promises. The order requires Honda to separate its opt-out and limit intake from its verified-request intake entirely, add a "Reject All" button carrying the same one-click weight as its existing "Allow All," extend Global Privacy Control handling to known, logged-in consumers rather than only anonymous cookies, and bring in a UX designer to A/B test the result. Todd Snyder's order adds the piece Honda's doesn't: an explicit requirement to monitor and validate that the opt-out mechanism keeps working, not just that it worked on the day it shipped.
That last point is the one most engineering teams skip. A consent-management platform is usually treated as marketing infrastructure, owned by whoever configured it once, with no uptime check of its own. Todd Snyder's banner broke for 40 days specifically because nobody had that monitor in place; the order says the company "would have known that Consumers could not exercise their CCPA rights if the company had been monitoring its Website." The contract requirement Honda also fell short of, producing no signed terms with the ad-tech vendors receiving its consumers' data, is the same category of gap: a control everyone assumes exists until an investigation asks for the paperwork.
A worked example
Picture a 60-person direct-to-consumer apparel brand running its site on a consent-management platform a marketing hire configured three years ago, before that hire moved on. An unrelated platform update quietly changes how the tool maps an incoming Global Privacy Control signal to the internal flag that's supposed to stop the sale of a visitor's data, so the signal arrives, gets acknowledged, and never actually flips the flag. Nobody notices, because nobody owns that surface the way someone owns checkout uptime. Today, that gap sits quietly against the small share of visitors running a GPC-enabled browser or extension. After January 1, 2027, the same gap sits against every California visitor whose browser ships the setting on, which turns a nobody-noticed configuration drift into a compliance exposure with no maximum size.
What to check before a browser does the testing for you
- Confirm a Global Privacy Control or OOPS signal actually flips the internal "do not sell" flag for a signed-in, known consumer, not only for an anonymous cookie, the exact gap Honda's order names.
- Route opt-out and limit requests through their own intake, separate from anything that asks for a name-and-address match, so a verification step never quietly attaches itself to a right that can't require one.
- Put a monitoring check on the consent banner and opt-out mechanism itself, the same way a company already monitors checkout, so a silent 40-day outage becomes a same-day alert instead.
- Confirm every vendor receiving personal information has the specific contract terms California's regulations require in writing, not assumed from a platform's standard terms of service.
- Count the clicks: if accepting tracking takes one and refusing it takes two, that gap is the first thing an audit or a plaintiff's lawyer will test.
Nothing here requires guessing at what regulators want; both orders spell out the fix in the same paragraphs that describe the violation. If your team hasn't tested what actually happens when a Global Privacy Control signal hits your known-consumer flow, get in touch and we'll scope that check against your specific setup, or start with how a pre-use notice and opt-out should actually work if the mechanism itself needs rebuilding before 2027 rather than just testing. Our team treats this as the same kind of fixed-scope engineering review as an ADMT readiness pass, not an open-ended retainer.
Sources
- California Privacy Protection Agency: Stipulated Final Order, In the Matter of American Honda Motor Co., Inc., Case No. ENF23-V-HO-2 (March 7, 2025)
- California Privacy Protection Agency: Stipulated Final Order, In the Matter of Todd Snyder, Inc., Case No. ENF23-M-TO-26 (May 1, 2025)
- California Privacy Protection Agency (CalPrivacy): 2025 Annual Report (February 2026)