Ford’s Opt-Out Obstacle Course, and the Fine Print America Lives In

I have read enough government orders in stale, fluorescent-lit rooms to recognize the genre. The cover page is always courteous. The facts are not. Somewhere in the middle sits the modern American ritual: a right that exists on paper, and a process designed to make you too tired to use it.

This week’s civics lesson comes from California, where the California Privacy Protection Agency (CPPA) finalized a case against Ford. No sirens, no scandal. Just a speed bump installed on purpose and labeled “customer service.”

What California says Ford did, and what Ford agreed to do

On March 5, 2026, the CPPA Board issued an order adopting a stipulated final order with Ford Motor Company. The order sets an administrative fine of $375,703, payable within 30 days of the order’s effective date.

The core issue: what the CPPA called “unnecessary friction” in the opt-out process under the California Consumer Privacy Act (CCPA).

According to the decision, the relevant period was July 1, 2023 to March 1, 2024. During that span, Ford’s opt-out for sale or sharing of personal information required an additional email verification step before Ford would process the request. Translation: you opted out, then got told to go prove it in your inbox.

The CPPA says a business may not require that kind of identity verification for an opt-out of sale or sharing. The order requires Ford to:

• Modify its methods so opting out is easy and involves minimal steps.
• Stop requiring verifiable consumer requests for opt-out.
• Audit tracking technologies on Ford.com to ensure they honor opt-out preference signals like the Global Privacy Control.
• Confirm completion of those actions within 90 days.

Ford agreed to be bound by the order while neither admitting nor denying the factual findings, and it waived certain rights to further administrative review. The legal equivalent of: we’ll comply, and we’d like to keep the Q&A to a minimum.

The Orwell check: “friction” is a polite word for deterrence

“Friction” sounds like physics. Accidental. Two surfaces meet, whoops, your rights get scuffed. In real life, friction is a choice. Companies do not add steps to the things they want you to complete.

The Paine test: does the process expand liberty or concentrate power?

Opt-out rights are small pieces of self-government: a way to tell a large institution, “no.” When extra hoops delay that “no,” it is not just bad design. It is control sliding uphill.

You can raise the practical objection: identity verification prevents fraud. Sometimes. But this order draws a key line under the CCPA framework: some rights may require a verifiable consumer request, and opting out of sale or sharing is not supposed to.

The tradeoff: a patchwork of rules in a national market

Ford operates across state lines. Data moves across state lines. But privacy rights and enforcement are increasingly state-bounded. Until Congress passes a serious, enforceable federal privacy law with real guardrails, states will keep filling the vacuum, one settlement at a time.

Ford is paying a fine and changing its process. Good. Now Corporate America should ask a basic question before it calls the next obstacle “verification” or “security”: if opting out is a right, why does it look like a dare?