Most privacy cases against businesses share one problem

California regulators have announced more consumer privacy penalties this year than in all earlier years combined, and the pattern behind the fines is as notable as the total. Five settlements under the California Consumer Privacy Act (CCPA) have been announced so far in 2026, adding up to $17.1 million, more than double the $7.9 million from the nine settlements announced between 2022 and 2025.

Clym reviewed all 14 CCPA settlements announced by the California Attorney General and the California Privacy Protection Agency, known as CalPrivacy, since the program's first case in 2022. One problem came up more often than any other: a broken or missing way for people to opt out of having their personal data sold or shared.

The totals use the dollar amount in each agency's announcement through Sept. 29, 2026, and exclude fines for failing to register as a data broker, which have been five-figure amounts, according to the IAPP.

One Settlement Drove Most of the Total

The biggest settlement is $12.75 million from General Motors, announced May 8 by the attorney general, several county prosecutors, and CalPrivacy. State officials said the company sold the names, contact information, location, and driving data of hundreds of thousands of Californians to data brokers without giving notice. "Californians must have confidence that they know what data is being collected, how it is used, and what their opt-out rights are," San Francisco District Attorney Brooke Jenkins said at the time. It's the largest CCPA penalty on record, and it was subject to court approval when announced.

That one settlement makes up about three-quarters of this year's total. The other four settlements announced in 2026 average about $1.09 million, roughly a quarter more than the average settlement before this year.

Why Does It Keep Coming Back to Opt-Outs?

Look past the record total, and a single problem shows up again and again. Of the 14 CCPA settlements Clym reviewed, 12 involved how a business handled requests to opt out of the sale or sharing of personal data, by far the most common issue regulators have cited since the program began.

Some companies had no working opt-out at all: mobile game maker Jam City had no compliant opt-out in any of its 21 apps. Others made the option difficult to find or use. Clothing retailer Todd Snyder left its opt-out request page broken for 40 days and required identity verification to use it. Ford paid $375,703 in March after CalPrivacy found it required an extra email verification step before processing an opt-out. "Opting out is supposed to be easy," CalPrivacy's head of enforcement, Michael Macko, said of the Ford case. "Unnecessary steps in the opt-out process can discourage consumers from exercising their privacy rights."

Several companies also ignored Global Privacy Control, the browser setting that's supposed to send an opt-out signal automatically without a person having to find a settings page, an issue regulators flagged as far back as the first settlement in 2022. A few cases also involved children's or teenagers' data, including a settlement over a mobile game that collected and shared kids' information without parental consent.

The Fines Reach Well Beyond Big Tech

These cases aren't limited to household names or one industry. Carmakers alone (Honda, Ford, and General Motors) account for more than half of every dollar collected since 2022. Honda's $632,500 settlement centered on a cookie banner that took two clicks to decline tracking but only one to accept it. CalPrivacy, the newer of the two regulators, has brought six of the 14 settlements, typically for smaller amounts against businesses like Todd Snyder; its largest so far is $1.35 million.

Any covered business that sells or shares California visitors' personal data, including through ordinary advertising tools on a website or app, has to offer a working opt-out and honor it. Retailers, restaurants, medical offices, and app makers all run the kinds of websites and apps these cases involved, and the law allows fines of up to $2,663 per violation, or $7,988 for each intentional violation.

Regulators Say the Fines Are Only Going Up

In remarks reported by the IAPP in April, Macko said fines under the law "could become a cost of doing business if they're not higher" and called the size of fines "an area to watch." The record $12.75 million settlement was announced five weeks later. CalPrivacy has also announced more than a dozen actions against data brokers that failed to register on time, including one in August against a broker that also required part of a Social Security number just to process an opt-out.

What California’s Privacy Enforcement Means for Businesses

The settlements reviewed by Clym show that some of the most common enforcement issues involve how businesses handle consumer privacy choices in practice, not simply what their privacy policies say.

For businesses subject to the CCPA, the cases highlight several areas worth reviewing:

• Opt-out choices work consistently across devices, browsers, and versions of an app
• Global Privacy Control and similar browser signals are recognized automatically
• Opt-out process doesn’t introduce unnecessary steps, such as identity verification or email confirmation
• How consent is handled when collecting or sharing data from children and teenagers
• Data broker registration requirements apply and are being met
• Opt-out requests are carried through to third parties that also receive the consumer’s data

The enforcement record suggests that privacy controls alone are not enough. Regulators have repeatedly focused on whether those controls actually work as intended when consumers try to exercise their rights.

This story was produced by Clym and reviewed and distributed by Stacker.