American Honda fined USD 632,500 by the CPPA over how it designed its privacy rights flows
Subject: American Honda Motor Co.
What happened
The case arose from the CPPA Enforcement Division’s ongoing review of the data-privacy practices of connected vehicle manufacturers and related technologies.
How it was handled
The Enforcement Division alleged Honda violated the CCPA by: requiring Californians to verify themselves and provide excessive personal information to exercise certain rights, such as the right to opt out of sale or sharing and the right to limit; using an online privacy management tool that failed to present privacy choices in a symmetrical or equal way; making it difficult for consumers to authorise others or organisations ("authorised agents") to exercise rights for them; and sharing consumers’ personal information with ad tech companies without contracts containing the terms necessary to protect privacy.
Outcome
The resolution requires Honda to implement a new and simpler process for Californians to assert their rights; certify its compliance; train employees; consult a user experience designer to evaluate its methods for submitting privacy requests; change its contracting process to ensure appropriate mechanisms protect personal information; and pay a $632,500 fine. The CCPA authorises administrative fines of up to $2,500 per violation and $7,500 per intentional violation, adjusted for inflation, in addition to cease-and-desist orders; the order sets out the number of consumers whose rights were implicated, underscoring that fines apply on a per-violation basis.
What it means for Chinese exporters
- · California fines are calculated per affected consumer per violation, so a single flow defect is multiplied by your user base. When modelling US user growth, model the worst-case fine exposure at that scale rather than looking only at the per-violation cap.
- · Symmetry of choice is an enforceable legal requirement, not a design preference. Accept and decline must be equally reachable: no one-click "accept all" against a three-level "decline". Before launch, check the click count and visual weight of privacy choice interfaces for symmetry and keep screenshots as evidence.
- · Verification must not become a barrier to exercising rights. California does not permit excessive verification for opt-out of sale or sharing, and collecting more information than the request needs is itself a violation. Write the minimum information set per request type into the product spec.
- · Contracts with ad tech partners are checked clause by clause. Chinese companies advertising in the US or integrating attribution SDKs must ensure every data-sharing contract contains the CCPA-required terms (purpose limitation, no resale, cooperation on rights requests) and keep a central register of those clauses.
- · Connected vehicles and smart hardware are an explicit enforcement priority for the agency. Chinese companies building in-vehicle systems, robots or IoT devices should assume they are within a sector sweep and complete a full self-audit of privacy policy, rights entry points and data-sharing contracts in advance.
Related regulations
Sources (1)
- CPPA decision requiring American Honda to pay a USD 632,500 fine for CCPA violationsCalifornia Privacy Protection Agency (CPPA) · published 2025-03-12 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.