California Burned $4.2M in CCPA Penalties in Six Weeks: What Disney, Ford, and PlayOn Mean for Your Fintech

TL;DR:

• California regulators issued $4.25 million in CCPA penalties across three enforcement actions in six weeks (February–March 2026), targeting opt-out failures at Disney, Ford, and PlayOn Sports.
• The enforcement pattern is clear: siloed opt-out mechanisms, failure to honor GPC browser signals, and unnecessary friction in the opt-out process are now reliably triggering action.
• Fintechs and financial services companies are not fully protected by the GLBA — the exemption covers specific financial data types, not the institution — making California-based data collection a live compliance risk.
• The CPPA’s new Audits Division can examine any CCPA-covered business proactively, without a consumer complaint, and has specifically flagged fintechs and data brokers as high-priority sectors.

California’s privacy enforcement machine ran hot in early 2026. In six weeks, regulators collected $4.25 million in penalties from three household names — Disney, Ford, and PlayOn Sports — and each action was grounded in the same root cause: consumers could not actually exercise the right to opt out of having their data sold or shared.

If your fintech collects behavioral data, location data, device identifiers, or anything beyond the specific financial transaction records protected by GLBA, these enforcement actions are about you. The compliance gap that cost Disney $2.75 million isn’t exotic. It’s an architecture problem that exists at most companies running multi-platform products, and California just handed regulators a detailed enforcement blueprint for finding it.

Here’s what happened, what it means, and what to fix before an auditor shows up.

What the Three Enforcement Actions Actually Found

Disney and ABC: $2.75 Million (February 11, 2026)

California Attorney General Rob Bonta filed and simultaneously settled against Disney DTC, LLC and ABC Enterprises for failures in CCPA opt-out implementation across streaming services, connected TV apps, and mobile platforms. The $2.75 million settlement is the largest CCPA enforcement action in California history.

The core finding: Disney implemented opt-out mechanisms in silos. A consumer who opted out on one platform — say, Disney+ on a web browser — had that opt-out ignored on Disney+ via a connected TV, through a mobile app, or through a third-party streaming integration. Disney could unify consumer identity for advertising purposes but had not built unified identity infrastructure to propagate opt-outs across the same product surface area.

The settlement requires Disney to honor a single opt-out request across all services, devices, and third-party data partners associated with a consumer’s account.

What this establishes: If a business can unify consumer identity for advertising, it must unify that identity for opt-out compliance. The AG’s message was direct — you can’t claim technical limitation as a defense on the same system you use to deliver personalized ads.

Ford Motor Company: $375,000 (March 2026)

The CPPA fined Ford for adding “unnecessary friction” to the opt-out process on its website and connected vehicle platform. The specific violation: Ford required consumers to complete an email verification step before they could opt out of the sale and sharing of their data.

That single additional step — which Ford presumably added to prevent unauthorized opt-outs — made the opt-out flow harder to complete than signing up for an account. The CPPA found this violated CCPA’s requirement that opt-out mechanisms be easy to use and not require unnecessary information beyond what’s needed to process the request.

What this establishes: Identity verification before completing an opt-out is friction that can trigger enforcement. If your opt-out flow asks consumers to re-enter credentials, verify an email, complete a CAPTCHA, or navigate more than a few steps, audit that flow today.

PlayOn Sports: $1.1 Million (March 3, 2026)

PlayOn Sports — a youth and high school sports media platform — received a $1.1 million fine for three distinct violations. First and most significant: PlayOn failed to recognize and honor Global Privacy Control (GPC) signals. Second, PlayOn’s privacy policy had not been updated in over a year and failed to accurately disclose consumers’ CCPA rights. Third, the policy contained misleading statements about whether the company sold personal information.

The children’s data component elevated the violation severity significantly, since intentional violations or those involving minors carry fines of $7,988 per incident rather than $2,663. The CPPA’s late-2025 enforcement sweep specifically targeted GPC compliance; PlayOn was caught in it.

What this establishes: GPC is not optional. Any business that sells or shares personal information must configure its web infrastructure, mobile apps, and tag management systems to detect and honor GPC browser signals as a valid opt-out. Non-recognition is a per-violation CCPA violation — at scale, it compounds fast.

The Pattern and What’s Coming Next

Three actions. Three different violation types. One unifying principle: consumers were systematically unable to exercise their CCPA rights in a meaningful way.

Enforcement is escalating on multiple tracks. The CPPA’s late-2025 joint sweeps specifically targeting GPC compliance produced the PlayOn case. The AG’s most recent investigative focus has expanded into surveillance pricing — examining how businesses use consumer data to price products differently — which has direct implications for credit decisioning, insurance pricing, and personalized financial offers in fintech.

The math on per-violation fines concentrates enforcement attention on large-scale processors. At $2,663 per unintentional violation, a company with 200,000 California consumers who cannot complete an opt-out faces theoretical exposure that drives aggressive settlement postures. Actual settlements are far lower than theoretical maximums, but the underlying calculus shapes enforcement priority.

Most consequentially: the CPPA’s Audits Division, launched in February 2026 under Chief Privacy Auditor Sabrina Boyson Ross, fundamentally changes the enforcement environment. Before February 2026, enforcement was largely reactive — it started with a consumer complaint or a breach disclosure. The Audits Division can initiate examinations without any triggering event, targeting businesses based on sector risk analysis, processing volume, or regulatory priority. Fintechs, data brokers, and businesses with high annual revenue are explicitly identified as high-priority sectors.

What Fintechs Need to Know

The GLBA Exemption Doesn’t Cover Your Entire Data Footprint

This is the most dangerous misconception in financial services privacy compliance. The CCPA includes a GLBA exemption — but it exempts specific data types, not institutions. The exemption applies to personal information collected, processed, sold, or disclosed subject to the GLBA and its regulations. It does not exempt a fintech from CCPA obligations just because part of its business handles GLBA-regulated information.

If your fintech collects behavioral data (browsing patterns, feature usage, time-in-app), device data (device identifiers, IP addresses, location pings), marketing data (email engagement, ad click behavior), or any personal information that flows through your analytics stack or ad-tech infrastructure — that data is not automatically GLBA-exempt.

Disney is a media company. Ford sells cars. PlayOn is a sports platform. None are financial services entities. But the enforcement logic applies identically to fintech: the data you use for product analytics, marketing attribution, and customer engagement is not insulated by your GLBA compliance program.

Your Opt-Out Architecture Probably Doesn’t Scale

Most fintechs built opt-out mechanisms as an afterthought — a link in the privacy policy footer, a toggle in account settings, a response workflow for DSARs. What the enforcement actions reveal is that fragmented opt-out implementations at scale create systematic violation exposure that auditors are now trained to find.

Specific gaps to audit:

GPC Signal Recognition: Test whether your web and app properties actually detect and respond to GPC signals. Browser extensions can simulate a GPC signal to verify detection. If your tag manager, consent management platform, or first-party data infrastructure doesn’t respond to GPC, fix it before the CPPA’s next enforcement sweep identifies your sector.

Cross-Platform Propagation: Map where consumer data flows across your product surface area. If a consumer opts out on your web app, does that preference propagate to your mobile app, email marketing platform, analytics vendor, ad pixels, and every API integration that shares that consumer’s data? If the answer involves any exceptions, you have a Disney-style siloed architecture problem.

Verification Friction: Review your opt-out flow for steps that could be characterized as unnecessary. Email verification, re-authentication, and multi-page forms are all potential enforcement targets. A consumer should be able to opt out with no more friction than submitting a simple web form.

The New Risk Assessment Requirements Are Already Live

The CPPA’s regulations effective January 1, 2026 created significant obligations beyond opt-out mechanisms. If your business uses automated decision-making technology (ADMT) for significant decisions affecting consumers in credit, employment, housing, or education — which covers any AI-based credit scoring, fraud scoring, or customer risk assessment tool — risk assessment obligations are already in force for new deployments.

The cybersecurity audit requirement is staggered by revenue tier (2028–2030), but the audit framework requires controls to be implemented now. The 2028 certification date is when you document completion, not when you start building. For the full technical requirements picture, the CPPA cybersecurity audit and ADMT compliance post covers what financial services teams need to have in place.

Building Opt-Out Compliance That Survives an Audit

A CCPA opt-out compliance program that holds under CPPA scrutiny has three operational components. Most fintechs have implemented only the first.

Discovery and Data Mapping: Identify every touchpoint where you collect personal information from California consumers, and every downstream system where that information flows. This includes your analytics stack, ad pixels, data enrichment vendors, and every API integration that shares consumer data with third parties. You cannot honor opt-outs for data flows you haven’t mapped. This exercise also surfaces your GPC detection gaps and your cross-platform propagation weaknesses.

Mechanism and Technical Controls: Implement opt-out with explicit GPC recognition, cross-platform propagation, and a documented signal-propagation log. Your consent management platform should treat GPC signals as a first-class opt-out trigger — not an afterthought added under enforcement pressure. Test the implementation quarterly: use a test account from a California device or simulate a GPC signal to verify the entire propagation chain.

Operational Response: Build opt-out requests into your DSAR intake workflow with documented completion SLAs. The DSAR response workflow post covers how to handle California consumer requests efficiently across CCPA, GDPR, and state law requirements. Opt-outs and access requests require different responses, and a DSAR system that handles both with clear audit trails is the operational baseline.

For ongoing monitoring, your privacy compliance program should track opt-out request completion rates, GPC signal detection rates (measured technically, not just operationally), and days-to-completion for consumer requests. If you’re not tracking these, you don’t know whether your mechanism works at scale.

The Regulatory Backdrop

These three enforcement actions are the visible output of a multi-year enforcement strategy, not isolated incidents. The CPPA’s 2025 joint sweeps specifically targeted GPC compliance across consumer-facing industries. The Disney action followed an AG investigation into streaming platforms. The Ford action followed the CPPA’s connected vehicle data focus from 2024.

The CPPA has also signaled that surveillance pricing — using behavioral and location data to price products differently by consumer — is its next enforcement focus area. For fintechs and financial services companies using customer data in pricing models, underwriting algorithms, or rate-setting: this enforcement direction is heading toward your business.

For context on how state privacy laws are reshaping the GLBA safe harbor more broadly and why fintechs should not rely on federal exemptions as a default defense, the state privacy laws and GLBA safe harbor erosion post covers the multi-state compliance landscape that financial services teams are navigating.

So What?

California burned through $4.25 million in CCPA enforcement in six weeks in early 2026. Disney. Ford. PlayOn. Each case has a different technical failure, but the pattern is identical: at scale, across platforms, consumers could not actually opt out.

If your fintech uses any data outside GLBA-covered transaction records for analytics, marketing, product personalization, or fraud modeling — and most do — you are operating in the same regulatory environment these companies just exited via settlement.

The CPPA Audits Division is operational and proactively examining high-data-volume businesses. GPC recognition is a live enforcement target. Cross-platform opt-out architecture is a gap auditors are specifically trained to find.

Audit your opt-out implementation now. Test GPC recognition technically, not just operationally. Map your cross-platform data flows. Document the analysis. The settlement amounts are always less than what it costs to remediate under investigation pressure — and the Disney case established that $2.75 million is where CCPA enforcement lands when the violation is systematic and the company should have known better.

Sources: California AG Disney CCPA Settlement · CPPA Ford Enforcement Action · WilmerHale on PlayOn $1.1M Fine · Jones Day on Disney Settlement Details · CPPA 2026 Regulations Overview