Use of Cookies and Tracking Technologies for Targeted Advertising

What it is

Ford uses cookies and web tracking tools to follow your online activity across the web and uses that information to target ads to you.

Why it matters (compliance & governance perspective)

Cross-site tracking for targeted advertising is subject to opt-out rights under CPRA and is the type of data sharing that California residents can stop by using the Do Not Sell or Share mechanism or enabling Global Privacy Control.

This document changed recently

Clause Stability Mostly Stable

Change history

Consumer impact (what this means for users)

Ford's tracking technologies may follow your browsing activity beyond ford.com to build an advertising profile, and under California law you can opt out of this tracking through Ford's privacy settings or by enabling a Global Privacy Control signal in your browser.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Cross-context behavioral advertising based on tracking data is defined as sharing under CPRA, triggering opt-out rights equivalent to data sale. The CPPA has jurisdiction over this practice for California residents. The FTC's guidelines on online advertising and behavioral tracking apply at the federal level. Global Privacy Control signals must be honored as valid opt-out requests under CPRA, and Ford's technical compliance with GPC should be verified. GOVERNANCE EXPOSURE: Medium. The use of pixel tags, web beacons, and third-party advertising cookies is a standard industry practice, but CPRA's treatment of advertising data sharing as equivalent to data sale means opt-out mechanisms must be functional and GPC signals must be respected. The CPPA has flagged non-compliance with GPC as an enforcement priority. JURISDICTION FLAGS: California CPRA creates the most immediate compliance obligation for advertising tracking. Colorado CPA and Connecticut CTDPA also require opt-out rights for targeted advertising. The EU ePrivacy Directive and GDPR would apply to any tracking of EU users, though this policy is stated as U.S.-focused. CONTRACT AND VENDOR IMPLICATIONS: Third-party advertising technology vendors placing cookies or pixels on Ford's properties should be assessed as third parties under CPRA rather than service providers, which affects the contractual framework required. The list of advertising technology vendors should be disclosed in a cookie policy and updated regularly. COMPLIANCE CONSIDERATIONS: Ford should maintain an up-to-date cookie disclosure listing all tracking technologies and third-party recipients. The OneTrust consent management platform visible in the site code should be configured to honor opt-out and GPC signals. Teams should audit whether the consent categories presented to users accurately reflect all tracking purposes, and whether the opt-out experience is as accessible and prominent as the opt-in experience.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Vehicle Telematics and Driving Behavior Data Collection high
• Data Sharing with Dealers and Third-Party Business Partners medium
• Sensitive Personal Information Collection Including Biometrics and Precise Geolocation high
• California Consumer Rights Including Opt-Out of Sale and Sharing medium
• Data Retention and Deletion Rights medium
• Children's Privacy and Minimum Age Restriction low

Related Analysis

• OpenAI Changed Its Privacy Policy 4 Times in One Week. Here Is What Actually Changed.

  Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.