CCPA in 2026: What California's Record Enforcement Actions Mean for Your Shopify Store

On May 8, 2026, California announced a $12.75 million settlement with General Motors, the largest CCPA penalty in the law's history. GM had been selling driving and location data from hundreds of thousands of OnStar subscribers to insurance data brokers without adequate consent, according to the Attorney General's complaint.

That's the headline number. But if you run a Shopify store, the GM case isn't really the one that should worry you. The smaller settlements from earlier this year are.

The Quick Recap on Who's Covered

CCPA, as expanded by the CPRA, applies if your business meets any one of three criteria: you process personal data of 100,000 or more California consumers a year, you process data of 50,000 or more California consumers, households, or devices, or you earn 50% or more of your revenue from selling California consumer data. Most independent Shopify sellers who trigger CCPA do so through the 100,000 consumer threshold, and that number counts website visitors and email subscribers, not just completed purchases.

What Actually Got Companies Fined

California has two separate bodies enforcing CCPA: the Attorney General's office and the California Privacy Protection Agency. Both have been active in 2026, and the smaller cases they've brought are far more relevant to a Shopify store than the GM headline.

Disney: $2.75 Million

On February 11, 2026, the Attorney General announced a $2.75 million settlement with Disney. The core problem wasn't a missing opt-out button. Disney had one. The issue was that clicking it only worked on one device or one service at a time. A consumer who opted out on Disney+ could still have their data sold through Hulu or ESPN+ on a different device, even while logged into the same account.

Ford: $375,703

In March 2026, the California Privacy Protection Agency fined Ford for requiring consumers to verify their email address before an opt-out request would be processed. Under CCPA, businesses aren't allowed to require identity verification for a simple opt-out of sale or sharing. The verification step meant valid requests went unprocessed. Regulators called this "unnecessary friction," a phrase that's now becoming its own enforcement standard.

PlayOn Sports: $1.1 Million

Also in March 2026, the same agency fined PlayOn Sports, which runs digital ticketing for high school sporting events. Its cookie banner let visitors click "agree" to close it, but offered no equally simple way to reject. On mobile, the banner blocked ticket access entirely unless a visitor accepted tracking, a detail regulators found especially concerning given how many students use the platform.

Tractor Supply: $1.35 Million

In September 2025, the same agency settled with Tractor Supply after a single consumer complaint. The company's "Do Not Sell My Personal Information" link led to a webform that didn't actually stop the sale or sharing of data in practice. Having a link isn't enough if it doesn't functionally work.

Global Privacy Control: The Detail Most Stores Miss

Global Privacy Control, usually shortened to GPC, is a browser-level signal available in Firefox, DuckDuckGo, Brave, and as an extension on other browsers. When a consumer has it enabled, their browser automatically tells every website they visit to treat that visit as an opt-out request, without the consumer having to click anything on your site.

Businesses subject to CCPA are required to detect and honor this signal. As of January 1, 2026, new regulations go a step further: your site must now visibly confirm that the signal was received and processed, typically with a message like "Opt-Out Request Honored" displayed to the visitor. Simply having a "Do Not Sell or Share My Personal Information" link on your homepage is no longer treated as sufficient on its own.

What the Penalties Actually Are

Beyond the individual settlements, it's worth knowing the statutory numbers regulators are working from. Updated CCPA civil penalties currently sit at $2,663 per violation, rising to $7,988 for violations found to be intentional. Every case above resolved as a negotiated settlement rather than the maximum statutory penalty, but the numbers show how quickly this can escalate once an investigation starts.

A Practical Checklist

• Confirm your site actually detects the GPC browser signal, not just a manually clicked opt-out link
• Display a visible confirmation when an opt-out signal is honored
• Make sure opt-out requests apply across a consumer's full account, not just the browser or device that sent the signal
• Never require email verification or login before processing a simple opt-out of sale or sharing
• Make sure your cookie banner offers an equally simple reject option, not just accept

Check Your California Exposure

All information in this article is sourced from official announcements by the California Attorney General's office and the California Privacy Protection Agency, published at oag.ca.gov and privacy.ca.gov. Regulens is informational only and this article is not legal advice. Speak to a licensed privacy attorney about your specific compliance situation.

Regulens scores California as part of its four-pillar readiness check, reflecting the state's active enforcement posture toward consumer privacy rights. Your store's privacy readiness is calculated based on your inputs and current policy documents.

Free to check, takes three minutes, no credit card needed. Not legal advice. Informational only.

Check your store's California privacy readiness at getregulens.com