On March 12, 2025, the California Privacy Protection Agency (“CPPA”) announced a decision and $632,500 fine related to allegations that American Honda Motor Co., Inc. (“Honda”) violated the California Consumer Privacy Act (“CCPA”).

• Collected More Information Than Necessary In Data Subject Rights Request Webform:  The CPPA alleged that Honda’s data subject rights webform “unlawfully require[d] Consumers to provide more information than necessary to exercise their CCPA rights” to opt-out of sale and sharing.  Honda’s data subject rights request webform required consumers to provide eight data elements for all types of requests, even where those requests did not require verification under the CCPA regulations.  Specifically, the CPPA noted that “[a]lthough Honda generally needs only two data points form the Consumer to identify the Consumer within its database, Honda’s verification process for Verifiable Consumer Requests requires the matching of more than two data points.”  Additionally, the CPPA alleged that Honda violated the CCPA by requiring consumers to verify themselves to exercise Requests to Opt-Out of Sale/Sharing and Requests to Limit.

• Authorized Agent Confirmation:  Honda’s data subject rights webform contemplated that authorized agents could submit requests, but the functionality, in practice, required the consumer to verify himself or herself.  Although the CCPA permits a business to ask the authorized agent to provide the consumer’s signed permission, “businesses may not require the Consumer to directly confirm that they have provided the Authorized Agent permission to submit the request.”  In addition, the CPPA noted the CCPA’s prohibition on requiring verification for Requests to Opt-Out of Sale/Sharing and Requests to Limit.

• Cookie Management Tools:  The CPPA alleged that Honda’s use of cookie management tools to opt-out of cross context behavioral advertising did not comply with the CCPA Regulations’ requirements for symmetrical choices.  Specifically, the CPPA alleged that the process to opt-out of sale/sharing through the cookie management tool required more steps than to opt back in.  Additionally, there is a paragraph that discusses website banners with choices that are not equal or symmetrical, although there is no specific allegation that Honda’s website banner violated the CCPA.

• Contracts with Vendors:  The CPPA notes in its Order that “[d]espite Collecting, Sharing, and disclosing Personal Information” with certain advertising technology vendors, “Honda could not produce contracts with these advertising technology companies.”  The CPPA refers to the requirement in Cal. Civ. Code § 1798.100(d) that businesses that Collect and disclose personal information to a third party, service provider, or contractor put in place an agreement that meets certain requirements.

Among other obligations, the Order requires Honda to reform its Opt-Out of Sale/Sharing and Request to Limit request process, change the authorized agent submission process, and change the cookie management tool options.  Notably, the Order requires Honda to consult with a user experience designer “who may be an independent consultant or Honda employee” to evaluate its data subject rights process.   

In its announcement, the CPPA stated that “the investigation arose from the Enforcement Division’s ongoing review of data privacy practices by connected vehicle manufacturers and related technologies.”  Other regulators have also focused on the data privacy practices related to the automotive sector.  In June 2024, the Texas Attorney General announced an investigation into the collection and disclosure of driver personal information by car manufacturers.  This past January, the Attorney General sued Allstate, and its subsidiary, Arity, for allegedly collecting, using and selling the geolocation and movement of Texan drivers.