California Consumer Rights Including Opt-Out of Sale and Sharing

What it is

California residents have specific legal rights under CCPA and CPRA, including the right to see, delete, and opt out of the sale or sharing of their personal information, and Ford states it will not discriminate against consumers who exercise these rights.

Why it matters (compliance & governance perspective)

These rights are legally enforceable under California law and give California residents meaningful control over their personal data held by Ford, including the ability to stop data being shared with advertising partners.

Consumer impact (what this means for users)

If you are a California resident, you can exercise your CCPA/CPRA rights by submitting a request to Ford through its privacy portal or by phone, and the policy states Ford will not penalize you for doing so.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision directly implements CCPA requirements as amended by CPRA, enforced by the California Privacy Protection Agency (CPPA) and the California Attorney General. The provision covers the core consumer rights of access, deletion, opt-out of sale and sharing, sensitive personal information limitation, and non-discrimination. CPRA introduced the right to correct inaccurate personal information and the right to limit sensitive personal information use, both of which compliance teams should verify are operationally implemented. GOVERNANCE EXPOSURE: Medium. The provision states these rights exist and provides a contact mechanism, but the operational adequacy of Ford's rights-response process, including response timeframes, identity verification procedures, and the handling of requests from authorized agents, requires independent verification. CPPA enforcement actions have focused on deficient opt-out mechanisms and inadequate response processes. JURISDICTION FLAGS: This provision applies to California residents. Nevada residents have a narrower opt-out right under Nevada's privacy statute. Consumers in other states with enacted privacy laws including Virginia, Colorado, Connecticut, and Texas may have analogous rights that this policy does not explicitly address, creating a potential gap in rights disclosure for non-California consumers. CONTRACT AND VENDOR IMPLICATIONS: Authorized agent requests under CCPA must be honored; Ford's process for verifying and processing authorized agent requests should be documented. If Ford uses third-party vendors to fulfill rights requests, those vendor arrangements should be assessed for adequacy and compliance with CPRA service provider requirements. COMPLIANCE CONSIDERATIONS: The Limit the Use of My Sensitive Personal Information and Do Not Sell or Share My Personal Information links or mechanisms must be prominently placed and functional. Response timelines under CPRA are 45 days with one 45-day extension; teams should audit the end-to-end request fulfillment process. The non-discrimination provision should be assessed against any loyalty program or service differentiation practices to ensure no de facto penalty exists for rights exercise.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Vehicle Telematics and Driving Behavior Data Collection high
• Data Sharing with Dealers and Third-Party Business Partners medium
• Sensitive Personal Information Collection Including Biometrics and Precise Geolocation high
• Data Retention and Deletion Rights medium
• Use of Cookies and Tracking Technologies for Targeted Advertising medium
• Children's Privacy and Minimum Age Restriction low