CCPA Radar
CCPA Radar tracks publicly announced enforcement actions, settlements, and penalty decisions under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). Its purpose is to provide a clear, practical view of how California regulators interpret and enforce privacy obligations in real cases.
The radar brings together key information on enforcement trends, including the regulator, the organization involved, the amount of the penalty, the legal basis of the violation, and the core compliance issues identified in each matter. By presenting these cases in one place, CCPA Radar helps privacy, legal, compliance, and security teams better understand which failures most often lead to regulatory action.
More than a list of fines, CCPA Radar is designed as a working compliance resource. It shows how regulators approach topics such as opt-out mechanisms, dark patterns, children’s data, privacy notices, vendor contracts, and the technical implementation of consumer rights. This makes it easier to translate enforcement activity into concrete lessons for internal privacy governance and risk management.
Jam City, Inc.
Public penalty
USD 1.4 million
Date
November 21, 2025
Core issue
No compliant in-app opt-outs; sale/sharing of teens' data without required consent
Main public findings
California DOJ stated that Jam City did not offer CCPA-compliant opt-outs in any of its 21 mobile apps and that some games shared or sold data of consumers aged 13 to 16 without the affirmative consent required by the CCPA.
Tractor Supply Company
Public penalty
USD 1.35 million
Date
September 30, 2025
Core issue
Privacy notice failures; job-applicant privacy rights; GPC/opt-out failures; missing contract safeguards
Main public findings
CPPA announced that Tractor Supply failed to maintain a compliant privacy policy, failed to notify California job applicants of their privacy rights, failed to provide an effective opt-out including for Global Privacy Control, and disclosed personal information without contracts containing required privacy protections.
Todd Snyder, Inc.
Public penalty
345,18 USD
Date
May 6, 2025
Core issue
Opt-out requests not processed; excessive request burden; unnecessary verification
Main public findings
CPPA announced that Todd Snyder failed to process consumer opt-out requests for 40 days, required more information than necessary from consumers, and required identity verification before allowing them to opt out of sale/sharing.
Tilting Point Media LLC
Public penalty
500,00 USD
Date
June 17, 2024
Core issue
Children's data; lack of parental consent; non-neutral age screen; misconfigured SDKs
Main public findings
California DOJ and the Los Angeles City Attorney announced that the SpongeBob: Krusty Cook-Off mobile app collected and shared children's data without required parental consent. The investigation also found that the age screen was not neutral and that third-party SDKs were misconfigured.
Ford Motor Company
Public penalty
375,70 USD
Date
March 5, 2026
Core issue
Opt-out friction; unnecessary verification
Main public findings
CPPA announced that Ford required consumers to provide additional information, including email verification, before processing opt-out requests, even though those requests could have been processed without that extra step.
The Walt Disney Company
Public penalty
USD 2.75 million
Date
February 11, 2026
Core issue
Opt-out not effective across devices and streaming services
Main public findings
California DOJ alleged that Disney failed to fully effectuate consumers' requests to opt out of sale/sharing across all devices and streaming services linked to their accounts. DOJ described the settlement as the largest CCPA settlement in California history at the time of the announcement.
Sling TV LLC / Dish Media Sales LLC
Public penalty
530,00 USD
Date
October 30, 2025
Core issue
Burdensome opt-out process; inadequate children's privacy safeguards
Main public findings
California DOJ announced that Sling TV failed to provide an easy-to-use opt-out method and that the settlement arose from the DOJ's streaming-services and connected-TV sweep. DOJ also said the company needed to improve protections relating to children.
Healthline Media LLC
Public penalty
USD 1.55 million
Date
July 1, 2025
Core issue
Failure to allow opt-out of targeted advertising; insufficient third-party protections; handling of sensitive health-related inferences
Main public findings
California DOJ stated that Healthline failed to allow consumers to opt out of targeted advertising and shared data with third parties without CCPA-mandated privacy protections, including data suggesting that a person may have a serious health condition.
American Honda Motor Co.
Public penalty
632,50 USD
Date
March 12, 2025
Core issue
Consumer-rights request handling failures; asymmetrical choice design; barriers to authorized agents; missing contract safeguards
Main public findings
CPPA announced that Honda would pay USD 632,500 and change its business practices after claims that it violated the CCPA. The public materials describe issues including requiring verification or excessive information for certain requests, asymmetrical privacy choices, difficulties for authorized agents, and insufficient contractual protections with ad-tech recipients.
DoorDash, Inc.
Public penalty
375,00 USD
Date
February 21, 2024
Core issue
Sale through a marketing cooperative without proper notice and opt-out
Main public findings
California DOJ announced that DoorDash sold California customers' personal information through participation in a marketing cooperative without providing notice or an opportunity to opt out. DOJ treated participation in that cooperative as a sale under the CCPA.
PlayOn Sports
Public penalty
USD 1.10 million
Date
March 3, 2026
Core issue
Ineffective opt-out mechanisms; targeted advertising; minors' data
Main public findings
CPPA announced that PlayOn used tracking technologies for targeted advertising, failed to provide an effective first-party opt-out method, failed to honor opt-out preference signals, and had compliance issues affecting consumers aged 13 to under 16.