CCPA fines in 2026: the opt-out cases behind them

CCPA fines are set per violation: up to $2,663 for each one, and up to $7,988 for each intentional violation or each one involving the data of consumers a business knows are under 16. Those are the amounts in force since 1 January 2025, after the inflation adjustment the law makes every other year. Two bodies enforce them: the California Attorney General, through civil penalties in court, and the California Privacy Protection Agency, which now calls itself CalPrivacy, through administrative fines. The 2026 cases about websites and apps mostly come down to one thing: an opt-out that didn’t do what the law asks.

This post covers how the amounts are worked out, who enforces them, and the four company cases of 2026: Disney, Ford, PlayOn Sports and General Motors. Then the data broker decisions of the summer, what the cases share, and a check you can run on your own “Do Not Sell or Share” link from your phone. For the how-to on the whole law, the CCPA compliance checklist is the place to go. This one’s about the cases.

How CCPA fines are calculated

The amounts sit in two sections of the California Civil Code. Section 1798.155 gives CalPrivacy administrative fines for each violation. Section 1798.199.90 gives the Attorney General civil penalties of the same size, recovered in court, along with an injunction. The statute still prints $2,500 and $7,500 “as adjusted”, and the adjusted figures are on CalPrivacy’s thresholds page:

Period	Each violation	Each intentional violation, or one involving known under-16s
Until 31 December 2024	$2,500	$7,500
From 1 January 2025	$2,663	$7,988

CCPA penalties are capped per violation, and neither section puts a ceiling on the total. So the real question in any case is how many violations there were. The Ford order shows how the Agency counts: Ford broke the opt-out rule each time Ford required a consumer to submit a verifiable consumer request. Every request and every sale after a request can be a count of its own.

The amounts move with California’s consumer price index. CalPrivacy’s announcement of the 2025 figures says In January of every odd-numbered year, the Agency must make this adjustment, so the next figures are due in January 2027. When a court sets the amount, section 1798.199.90 adds that The court may consider the good faith cooperation of the business.

The 30-day cure period is gone. In 2022 the Attorney General’s complaint against Sephora still said it hadn’t cured within the 30 days then allowed. The Attorney General’s enforcement page now says: As of January 1, 2023, the CCPA no longer requires notice of a violation or an opportunity to cure before filing an enforcement action.

Who enforces the CCPA

CCPA enforcement is split between two offices, and they use different words for the same kind of money.

• The Attorney General sues in state court. The 2026 cases ended in stipulated judgments: the company agrees, a judge signs, and the money is a civil penalty. Disney’s judgment was entered without trial or any finding of fact and without Disney admitting liability.
• CalPrivacy investigates through its Enforcement Division and brings administrative actions. Its Board decides them, and it may issue a decision by settlement without a hearing. The orders carry factual findings, and the money is an administrative fine. On older pages you’ll see the agency called CPPA, so a search for CPPA enforcement turns up the same decisions.

They also work together. The General Motors case was brought by the Attorney General with four county district attorneys and CalPrivacy’s support. Outside California, Vermont became the latest member of the Consortium of Privacy Regulators on 4 August 2026, which makes a dozen regulators sharing work on state privacy laws.

The 2026 cases

These are the CCPA enforcement actions against companies that the Attorney General and CalPrivacy announced in 2026, taken from their own pages.

Company	Enforcer	Announced	Amount	What it was about
Disney	Attorney General	11 February 2026	$2.75 million	Opt-outs that stopped at one service or one device
PlayOn Sports	CalPrivacy	3 March 2026	$1.10 million	An “Agree” banner over the ticket, no opt-out of its own, no GPC
Ford	CalPrivacy	5 March 2026	$375,703	An email confirmation step before an opt-out counted
General Motors	Attorney General, four district attorneys, CalPrivacy	8 May 2026	$12.75 million	Driving data sold to data brokers without notice

Disney (Attorney General, February 2026)

The Disney CCPA settlement, announced on 11 February 2026, has Disney paying $2.75 million in civil penalties. The Attorney General called it the largest CCPA settlement so far. It came out of a January 2024 sweep of streaming services. The office said its investigation found a gap in each of the ways Disney offered to opt out:

• The toggle in its websites and apps applied only to the streaming service you were watching, and often only to the device you were holding.
• The webform stopped sharing through Disney’s own ad platform, but selling and sharing carried on with certain third-party ad-tech companies whose code Disney had embedded in its sites and apps. Many of its connected TV apps had no opt-out inside the app at all.
• Global Privacy Control only counted for the device that sent it, even when the person was logged in.

Attorney General Rob Bonta put it this way: businesses can’t force people to go device-by-device or service-by-service.

The judgment says what has to change. When someone who’s logged in opts out, GPC included, it applies across every Disney streaming service tied to the account. When they’re not logged in, it applies to that browser, app or device and any profile Disney links to it, pseudonymous ones too. People get a way to confirm their opt-out went through. The third parties Disney sold or shared the data with must be told. And for three years Disney runs a programme that checks all of this and reports to the Attorney General every year.

Ford (CalPrivacy, March 2026)

The CalPrivacy Board adopted the Ford order on 27 February 2026, and the Agency announced it on 5 March: a $375,703 fine. It’s the smallest of the four. The lesson is the clearest, though.

Ford’s privacy rights form asked for a name, an address and a phone number, and had a reCAPTCHA. The Agency didn’t object to the form. It objected to what came after. Once you sent it, Ford showed One More Step! and emailed you to say you must confirm your email and identity by clicking the button below. Between 1 July 2023 and 1 March 2024, requests from people who didn’t click were marked as expired. Dozens weren’t processed in time, and Ford kept selling or sharing those people’s data.

The rule is section 7026(d) of the CCPA regulations. A business can’t demand a verified request before an opt-out, and to the extent that the business can comply with a request to opt-out of sale/sharing without additional information, it shall do so. The order notes Ford didn’t mean to require verification, and it processed the expired requests once the investigation started. Ford neither admitted nor denied the findings.

Michael Macko, CalPrivacy’s head of enforcement: Opting out is supposed to be easy. He compared it to a checkout, where unnecessary steps in the opt-out process can discourage consumers from exercising their privacy rights. Ford now has to offer opt-outs with minimal steps and no verification. It also has to audit the tracking technologies on ford.com so they honour Global Privacy Control, and confirm all of it in writing within 90 days.

PlayOn Sports (CalPrivacy, March 2026)

PlayOn Sports runs GoFan, a ticketing platform about 1,400 California schools use for games, dances and plays. CalPrivacy announced a $1.10 million fine on 3 March 2026, the Board’s first decision about students and schools. According to the decision, which covers 2023 and 2024:

• GoFan’s banner said the site used trackers such as the Meta Pixel, and its only button was “Agree”. There was no other way to close it. On a phone the banner covered the part of the screen you used to show your ticket, so getting into the game meant agreeing first.
• The only ways to opt out were a phone number and an email address, and those didn’t reach the trackers on the site. The privacy policy sent people to the industry opt-out pages of the Network Advertising Initiative and the Digital Advertising Alliance instead.
• The sites didn’t recognise opt-out preference signals.
• The privacy policy went unchanged from July 2022 to February 2024 and said PlayOn didn’t sell personal information.

PlayOn admitted only the paragraphs describing its business and neither admitted nor denied the rest. The Agency gave it credit for changes made in December 2024, before it heard from the investigators: it started honouring GPC, offered both accept and reject on the banner, and rewrote the policy. It still has to carry out risk assessments, write disclosures people can follow, set up proper opt-outs and get opt-in consent before selling or sharing the data of 13 to 15 year olds. Macko again: Students trying to go to prom or a high school football game shouldn’t have to leave their privacy rights at the door.

General Motors (Attorney General and partners, May 2026)

This one’s a connected-car case, not a website one, so I’ll keep it short. On 8 May 2026 the Attorney General and the district attorneys of San Francisco, Los Angeles, Napa and Sonoma counties announced $12.75 million in civil penalties against GM. The release calls it the largest CCPA penalty to date and the first data minimisation case.

As alleged in the complaint, from 2020 to 2024 GM sold the names, contact details, location and driving behaviour of hundreds of thousands of Californians, collected through OnStar, to two data brokers, Verisk and LexisNexis Risk Solutions. Nobody was told. GM’s privacy policy said it didn’t sell driving or location data. It also kept the data long after OnStar had used it, which the Attorney General says went against the purpose limitation and data minimisation rules added in 2023. Bonta: companies can’t just hold on to data and use it later for another purpose. GM can’t sell driving data to consumer reporting agencies for five years, has to delete the driving data it kept within 180 days unless people consent, and has to run a privacy programme that reports to the enforcers.

For a website, the part that carries over is the privacy policy. The sentence saying “we don’t sell” is the one the case turned on.

The data broker decisions of August and September

CalPrivacy spent late summer on data brokers. On 11 August it fined LocateSmarter $116,490 for registering late and, the Agency alleged, asking Californians for the last four digits of their Social Security number before they could opt out. That was its first CCPA decision against a data broker. Cybba ($52,400, 13 August) and SalesIntel Research ($36,400, 1 September) were fined for missing the registration deadline. On 3 September, Enforcement Advisory 2026-01 warned brokers that wrong details in the registry cost $200 a day. If you’re not a broker, LocateSmarter is the one to remember: an opt-out that asks for more than it needs.

What the CCPA fines of 2026 have in common

Of the four company cases, three (Disney, Ford and PlayOn) turn on an opt-out that didn’t work the way the law asks. The fourth, GM, is about sales nobody was told about. That’s my own count from the enforcers’ pages, and it points to five things.

1. The opt-out has to reach everywhere you track the person. Disney’s stopped at one service or one device. The regulations treat a GPC signal as an opt-out for that browser or device and any profile linked to it, pseudonymous ones included.
2. It can’t ask for more than it needs. Ford asked for an email confirmation, LocateSmarter for part of a Social Security number. Section 7026 says opt-out methods shall be easy for consumers to execute, shall require minimal steps.
3. Global Privacy Control counts as an opt-out. The Attorney General’s GPC page says it must be honoured as a valid request. It’s been there in the cases on our record for years. Sephora in 2022 didn’t process GPC opt-outs, according to the Attorney General. Healthline in 2025 kept sharing data with some ad partners even for people who opted out. And Tractor Supply in 2025 had no effective opt-out, GPC included, CalPrivacy alleged. Since 1 January 2026 the updated rules also ask a business to show on its website whether it has processed the signal.
4. The opt-out has to reach the ad partners. When someone opts out, the business has to tell the third parties it sold or shared their data with. Disney’s webform left them out. PlayOn sent people to industry pages to opt out with each ad company themselves. And a cookie banner doesn’t do the job alone: the regulations say a cookie tool is not by itself an acceptable method for submitting requests to opt-out of sale/sharing.
5. The privacy policy has to say it. PlayOn’s and GM’s both said they didn’t sell. The cases say they did.

If you’re wondering whether any of this means a cookie banner in the US, the cookie consent post covers that. For ad tags on health pages, the Hims & Hers lawsuit is the one to read. And for the European side of this run, see GDPR fines and the UK’s first CMA fines on website sales tactics.

Check your Do Not Sell or Share link from a phone

You don’t need a tool for this. You need a phone, a laptop and ten minutes. None of it is legal advice: if you’re not sure whether what your site does counts as selling or sharing, that’s a question for a California privacy lawyer.

1. Find the link. Open your home page on your phone in a private tab and scroll to the footer. Look for “Do Not Sell or Share My Personal Information” or “Your Privacy Choices”. If your site sells or shares and neither is there, that’s the first fix.
2. Count the steps. Tap it and count every tap and field until you’re opted out. Anything beyond what you need to stop the selling, like an email confirmation, a login or an ID check, is the Ford pattern.
3. See where it leads. If the link only opens a cookie banner, or a page that sends visitors to industry opt-out sites, that’s the PlayOn pattern. The opt-out has to be yours and it has to cover selling and sharing.
4. Use it, then look at what loads. On a laptop, open your site and check the site information panel next to the address bar, which lists the cookies and site data the page set. Opt out, clear them, reload, and see whether the advertising names come back.
5. Try a second device. If your site has accounts, opt out on your phone while logged in, then log in on the laptop. Does it say you’re opted out there too? That’s the Disney test.
6. Send the signal. In Firefox, turn on Tell websites not to sell or share my data, or use one of the other browsers the Attorney General names, DuckDuckGo or Brave. Visit your site. Does it show that the signal was honoured, and do the ad tags stay away?
7. Read your privacy policy. Does it say plainly whether you sell or share personal information, and how you handle the GPC signal? PlayOn’s said “we don’t sell”, and so did GM’s.

Peeky reads the public pages of your site, and these are the CCPA violations the 2026 cases turned on. For US-02 he reads whether the Do Not Sell or Share link is there and where it leads. For US-03 he reads whether your site responds when a browser sends the Global Privacy Control signal. For US-04 he reads what your privacy policy says about selling and sharing, and whether that matches what your pages load.

Questions people ask

How much are CCPA fines?

Since 1 January 2025, up to $2,663 for each violation and up to $7,988 for each intentional violation or one involving the data of consumers the business knows are under 16, as adjusted by CalPrivacy. The limit is per violation, so the counts add up. In 2026 Ford paid $375,703, Disney $2.75 million and General Motors $12.75 million.

What are the penalties for CCPA violations?

Two kinds, the same size. The Attorney General asks a court for civil penalties and an injunction under section 1798.199.90. CalPrivacy imposes administrative fines under section 1798.155. The orders also make companies change things: Ford has to audit the trackers on its website, and Disney has to run a three-year monitoring programme and report to the Attorney General every year.

Who enforces the CCPA?

The California Attorney General and the California Privacy Protection Agency, which now calls itself CalPrivacy (older pages say CPPA). The Attorney General goes to court; CalPrivacy's Board decides administrative cases. They also work together: the General Motors case was brought with four county district attorneys and CalPrivacy's support.

What was the Disney CCPA settlement about?

Opt-outs that didn't carry across Disney's services and devices. The Attorney General said a toggle often applied to one service on one device, the webform left third-party ad-tech partners out, and Global Privacy Control only counted for the device. Disney agreed to pay $2.75 million and make opt-outs work account-wide, without admitting liability.

Does the CCPA still give businesses time to fix a violation?

No. The Attorney General's enforcement page says that since 1 January 2023 the law no longer requires notice or an opportunity to cure before an action is filed. Fixing things early still helps: CalPrivacy credited PlayOn Sports for changes it made before the investigation reached it, and a court may weigh good faith cooperation when it sets a penalty.