• by Wendy Davis  @wendyndavis, March 12, 2025

Car company American Honda Motor has agreed to pay more than $600,000 to settle allegations that it violated the state privacy law in several ways, including by requiring consumers to provide “excessive” personal information in order to opt out of the sale or sharing of their data, California's privacy agency said Wednesday.

The Honda and Acura marketer also allegedly violated California privacy standards by offering an online opt-out tool that was not “symmetrical” because it allowed consumers to consent to the sale or sharing of their information with a single step, but required people to take more than one step to reject the sale or sharing of their data.

Additionally, the auto company allegedly shared data it collected from its online websites with outside ad-tech companies, but failed to prove that it had contracts with those companies governing their use of the data, according to the California Privacy Protection agency.

The agency fined Honda $632,500, and is requiring the company to revise its privacy practices.

A Honda spokesperson said the company cooperated with California regulators and has begun modifying its methods for submitting opt-out requests and managing cookies, and is updating its contract management processes.

The agency said in its settlement order that between July 1, 2023 and September 23, 2023, Honda's online opt-out sites required “at least 119” consumers to provide extraneous information to reject the sharing or sale of their data.

Those sites enable consumers to opt out of the sale or sharing of data about their online activity, as well as data that comes directly from connected cars.

Honda's web-based opt-out form specifically required people to provide a first and last name, street address, city, state, zip code, email and phone number.

“By requiring all of this information, Honda’s webform unlawfully requires consumers to provide more information than necessary to exercise their ... rights to opt-out of sale/sharing of their personal information and to limit the use and disclosure of their sensitive personal information,” the agency alleged.

News of the enforcement action comes nearly two years after the California privacy agency launched an investigation into the data practices of connected car companies.