In the first quarter of 2026, California regulators issued over $4 million in fines against companies for privacy violations. Disney, PlayOn Sports, Ford, Tractor Supply — four companies, four enforcement actions, one common thread: the opt-out existed, but it didn't work.
Not "didn't work" as in missing from the website. The buttons were there. The privacy policies described the rights. The problem was in the gap between what the interface showed and what the technology actually did.
What Regulators Actually Tested
This is the part worth paying attention to: regulators didn't review privacy policies. They tested mechanisms.
California's enforcement posture has shifted from documentation review to technical verification. The question is no longer "do you have an opt-out?" It's "when a consumer uses it, does data sharing actually stop?"
In each of the Q1 2026 cases, the answer was no — in different ways.
Disney — $2.75 million
Disney's opt-out mechanism didn't apply across its own properties. When a consumer submitted an opt-out request, Disney honored it for the specific device or platform where the request was made — but continued sharing data with third-party advertising partners across its other apps and websites. The CCPA requires businesses to apply an opt-out across a known consumer's entire relationship with the business when they're logged in. Disney applied it per device instead.
The company also failed to honor GPC signals at all on some properties, and many of its connected TV apps had no in-app opt-out mechanism — pointing users to a web form that didn't actually stop data sharing from those apps.
PlayOn Sports — $1.1 million
PlayOn ran tracking technologies — third-party cookies, persistent trackers, advertising pixels — on ticketing pages used by parents buying tickets to school sporting events. The consumers on those pages included parents of students. The opt-out mechanism had dark patterns: the interface was structured so that consumers were pushed toward accepting data sale and sharing rather than declining it. Privacy rights workflows were incomplete or improperly implemented.
The CPPA also noted that opt-out steps must be symmetric — a "decline all" option must be as accessible as "accept all." PlayOn's interface didn't meet that standard.
Ford — $375,000
Ford required an email verification step before processing opt-out requests. Under CCPA regulations, companies may not require identity verification for opt-out of sale or sharing requests. Adding an extra step — even one that seems routine — constitutes a barrier that makes the opt-out process harder than the opt-in process. That asymmetry is itself a violation.
Tractor Supply — $1.35 million
The company's privacy choices interface didn't translate into actual opt-out signals to downstream data recipients. Advertising tracking technologies continued firing and sharing data with ad networks even when consumers had indicated they didn't want their data sold or shared. The interface and the technology were not connected.
The Pattern Across All Four Cases
Four companies. Four different implementations. The same regulatory finding: the mechanism didn't do what it said it would do.
Regulators are specifically targeting what they call "DSR friction" — steps in the opt-out process that discourage consumers from completing it. Excessive verification requirements, mechanisms that don't stop web-based tracking, and opt-out flows that are harder to complete than opt-in flows all qualify.
A broken opt-out mechanism is treated the same as no mechanism at all. That's not a legal interpretation — it's stated directly in California enforcement decisions.
There's also a broader enforcement coordination dimension to watch. In late 2025, California, Colorado, and Connecticut launched a joint GPC sweep — regulators from multiple states testing the same technical mechanism at the same time. Multi-state enforcement coordination makes the reach of opt-out requirements significantly wider than California alone.
What January 2026 Changed
The CCPA regulations that took effect January 1, 2026 codified something that had been implicit in earlier enforcement: opt-out steps must be no more difficult than opt-in steps. This applies to the design of consent interfaces, not just the underlying technology.
If your cookie banner has a prominent "Accept All" button and a buried "Manage Preferences" link with three additional screens to decline tracking — that design is now a documented compliance gap, not just a UX choice.
The same logic applies to GPC signals. California requires businesses to treat a GPC signal as a valid opt-out request from a known consumer and apply it across their entire relationship with that consumer. Honoring it only on one device, or only on the specific site where it was detected, doesn't meet the standard.
The Practical Checklist
Based on Q1 2026 enforcement findings, these are the specific technical questions worth asking:
Does your opt-out actually stop data sharing? Not in the interface — in the technology. Are advertising pixels, third-party cookies, and tracking scripts disabled when a consumer opts out?
Is opt-out applied account-wide? If a logged-in consumer submits an opt-out on one property, does it propagate across all your properties and apps?
Are you honoring GPC signals? Is your implementation detecting the Sec-GPC header and treating it as an opt-out for all known consumers, not just for anonymous sessions?
Does opt-out require verification? Any email confirmation, account login, or multi-step process before an opt-out is processed is likely a violation.
Is your opt-out interface symmetric? "Accept all" and "decline all" need to be equally accessible. A prominent accept button and a buried decline option doesn't pass the test anymore.
Are you auditing tracking technologies regularly? Regulators required Disney, PlayOn, and Ford to maintain comprehensive inventories of tracking tools and conduct ongoing audits. That expectation is now part of what settlement terms look like — which means it's likely what regulators will look for before enforcement too.
A Note on Dark Patterns
The January 2026 regulations made the legal treatment of dark patterns explicit. An opt-out flow designed so that declining requires more effort than accepting — more clicks, more screens, smaller buttons, buried links — is no longer a gray area. It's a violation of the requirement that consumers be able to exercise their rights without unnecessary barriers.
This applies to cookie consent interfaces, privacy preference centers, and any other mechanism where consumers interact with data choices. The standard isn't whether the option exists — it's whether a reasonable consumer could find and use it without friction.