close
close
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Enforcement · Administrative fine

CPPA fines retailer Todd Snyder $345K for blocking consumer opt-out requests

CCPA/CPRA California

The California Privacy Protection Agency ordered clothing retailer Todd Snyder to pay $345,178 after its privacy portal blocked consumer opt-out requests for 40 days and required excessive identity verification for privacy requests. The company must also overhaul its opt-out mechanisms and train employees on CCPA compliance.

Why it matters Six weeks of a broken opt-out portal turned into a $345,178 CPPA fine.
Read the primary source
California Privacy Protection Agency (CalPrivacy)
Open source

Published by Editorial on Sep 23, 2026. Not independently re-checked against the primary source — read it via the link above.

Related actions

Settlement / consent order

Meta pays $459M to settle Cambridge Analytica privacy claims with four states

Meta Platforms, Inc.

California

$459,300,000Settled

Eight years after Cambridge Analytica broke, states are still collecting on it. This time it's $459 million, folded into an even larger settlement over Meta's design choices for kids.

Primary source
Settlement / consent order

California AG fines GM and OnStar $12.75M for selling driver data

General Motors LLC / OnStar

CA Unfair Competition LawCCPA/CPRA California

$12,750,000Settled

Connected-vehicle data is squarely in scope, and data minimization is now being enforced. Collect only what a stated purpose needs, and get real consent before selling location or behavior data.

Primary source
Administrative fine

CPPA fines PlayOn Sports $1.1M for forcing tracking consent on school ticketing platform

PlayOn Sports, Inc. (GoFan)

CCPA/CPRA California

$1,100,000Settled

A first: California's privacy regulator drew a direct line from a school sports ticketing app to a company's ad-tracking practices, and fined it accordingly.

Primary source

Summaries are DataGrail’s wording, not statutory text; amounts and outcomes come from the linked primary source.

This summary is DataGrail's own plain-language account, written for privacy practitioners. It is not legal advice. For the authoritative text, follow the primary-source link above.