CCPA Opt-Out Enforcement: What Regulators Fined Companies for When Opt-Outs Failed

The table lists the actions found in the regulators' announcements opened for this article. Amounts and dates are as stated in each announcement. PlayOn Sports is the exception: the agency's own page could not be opened, so that row rests on a WilmerHale summary.

This is a list of what was opened and read. It is not a complete register of privacy enforcement. The Attorney General's announcements also mention settlements with DoorDash in February 2024 and Tilting Point Media in June 2024, which concerned notice of sale and children's data. The privacy agency has brought separate actions against data brokers under a different statute.

Several of the Attorney General's settlements were described as proposed or subject to court approval when announced. This article did not check the court dockets for final approval.

Sephora came first. The Attorney General alleged that Sephora failed to tell people it was selling their personal information, failed to process requests to opt out made through user-enabled global privacy controls, and did not cure the violations within the 30-day period then allowed. The announcement explains that letting third parties track shoppers in exchange for advertising benefits was a sale under the Act.

Healthline was announced on 1 July 2025 as the largest settlement under the Act to that date. The complaint alleged that Healthline continued to share data with some advertising third parties after people opted out, that it had assumed without verifying that those third parties had agreed to an industry contractual framework, and that its consent banner 'did not disable tracking cookies, despite purporting to do so'. The banner allegation was pleaded under the Unfair Competition Law as deception.

Sling TV, announced in October 2025, arose from a sweep of streaming services. The announcement says Sling TV combined cookie preferences with the opt-out even though turning off cookies was insufficient, made logged-in customers fill out a web form with information it already had, and offered no opt-out within its apps on living-room devices. Jam City followed a month later. The Department of Justice found the company 'did not offer CCPA compliant opt-outs in any of its 21 mobile apps'.

Disney, announced on 11 February 2026 at $2.75 million, is the largest. The Attorney General alleged three separate failures. Opt-out toggles applied only to the streaming service in use and often only to that device. The web form stopped sharing through Disney's own advertising platform while sharing continued with third-party ad-tech companies whose code was embedded in its sites and apps. Global Privacy Control opt-outs were limited to the device used, even when the person was logged in.

Honda, on 12 March 2025, was about friction. The agency alleged that Honda required people to verify themselves and provide excessive personal information to opt out, used an online privacy management tool that did not offer choices 'in a symmetrical or equal way', made it difficult to use authorized agents, and shared personal information with ad-tech companies without producing the required contracts.

Todd Snyder, on 6 May 2025, was about configuration. The agency alleged the retailer failed 'to oversee and configure properly the technical infrastructure of its privacy portal', so opt-out requests went unprocessed for 40 days. The agency's head of enforcement said the buck stops with the businesses that use privacy management tools.

Tractor Supply, on 30 September 2025, was the agency's largest fine at $1.35 million. The decision found no effective mechanism to opt out of selling and sharing, 'including through opt-out preference signals such as Global Privacy Control', along with privacy policy and job-applicant notice failures and missing contract terms. The agency says the investigation began with a complaint from one consumer in Placerville, California.

For PlayOn Sports, WilmerHale reports that the agency announced a $1.1 million fine on 3 March 2026. According to that summary, the company relied on outside industry opt-out tools in place of its own, failed to recognize and process opt-out preference signals, and required people on mobile to click 'Agree' to tracking before they could redeem digital tickets they had already bought.

The second column lists the cases where the regulator described the pattern. The third gives the rule as it appears in section 7026 of the published regulations, or the regulator's own statement in the announcement.

Most of these cannot be seen by looking at the site. The banner, the link and the form look the same whether or not they work. They show up only when someone sends an opt-out and watches what the site does next.

Sweeps account for several. Sephora followed an enforcement sweep of online retailers. Sling TV and Disney came out of a sweep of streaming services and connected televisions announced in January 2024. Honda arose from the agency's review of connected vehicle manufacturers.

A complaint can be enough. The agency opened the Tractor Supply investigation after one consumer complained.

The most recent sweep is aimed at the signal itself. On 9 September 2025 the privacy agency and the Attorneys General of California, Colorado and Connecticut announced a joint sweep of businesses that may not be processing opt-out requests submitted through Global Privacy Control. The announcement says the coalition was contacting those businesses and asking them to comply. No outcomes from that sweep were found in the research.

The agency's Honda announcement states its authority: an administrative fine of up to $2,500 for each violation, or $7,500 for each intentional violation, plus an increase for inflation, in addition to ordering a business to stop the practice. The announcements do not explain how each total was calculated.

The non-monetary terms can cost more than the fine. Tractor Supply agreed to scan its digital properties to inventory tracking technologies and to have a corporate officer or director certify compliance annually for four years. Honda must consult a user experience designer to evaluate its methods for submitting privacy requests, train employees and change its contracting process. Healthline must maintain a compliance program that includes auditing its contracts for required privacy terms.

Sephora's announcement records one change in the law itself. Businesses once had 30 days to cure a violation after notice, and the Attorney General noted that this right was expiring.

Hunton reports that Connecticut's Attorney General announced the first settlement under the Connecticut Data Privacy Act on 8 July 2025, with TicketNetwork paying $85,000. The allegations were a privacy notice that was largely unreadable and rights mechanisms that were misconfigured or inoperable. Hunton notes that a cure notice had been sent in November 2023 and that the company did not resolve the issues until well after the cure period.

Connecticut's and Colorado's Attorneys General both joined the September 2025 sweep. In that announcement the Connecticut Attorney General said the office was putting violators on notice.

The research for this article did not cover enforcement in Texas, Oregon or other states with privacy laws, and no federal action is included. The picture outside California is incomplete.

The checks below are taken from the facts of the nine actions. Passing them does not mean a site meets the law. Failing one means the site shares a fact pattern with a case that ended in a penalty.

In the Todd Snyder announcement the agency said businesses should scrutinize their privacy management tools to ensure they work as intended. A dated record of each test is the evidence that the checking happened.

• With Global Privacy Control on and no banner interaction, list the advertising tags that still load.
• Opt out through the banner or link, then check the next three pages as well as the first.
• Opt out while signed in, then sign in on another device and confirm the opt-out followed the account.
• Submit the opt-out form and confirm it asks for no identity documents and nothing the business already holds.
• Open each app, including television apps, and find the opt-out without leaving the app.
• Confirm the opt-out stops third-party code embedded in the site, beyond your own advertising platform.
• After any change to the consent tool or tags, run the same tests again and keep the dated results.