The California Privacy Protection Agency (CPPA) has taken decisive enforcement action against national clothing retailer Todd Snyder, Inc., highlighting the increasing scrutiny businesses face under the California Consumer Privacy Act (CCPA). In a release published May 6, 2025, the CPPA announced that the retailer will pay a $345,178 fine and make significant changes to its privacy practices following findings of non-compliance with state privacy laws.

According to the CPPA, Todd Snyder failed to properly configure its privacy portal, resulting in a 40-day window during which consumers’ requests to opt out of the sale or sharing of personal information were not processed. This technical lapse was compounded by procedural missteps: consumers were required to submit more information than was necessary to fulfill privacy requests, including needing to verify their identity before opting out.

In addition to the monetary penalty, Todd Snyder has agreed to reconfigure its opt-out mechanism to ensure effective functioning. The company will also provide CCPA compliance training for its employees.

The CPPA emphasized that businesses are responsible for ensuring their privacy management solutions comply with the law and function as intended. Using a consent management platform does not absolve a business from compliance obligations.

“Businesses should scrutinize their privacy management solutions to ensure they comply with the law and work as intended, because the buck stops with the businesses that use them,” said Michael Macko, head of the CPPA’s Enforcement Division. 

This action is part of a broader wave of privacy enforcement. The CPPA recently imposed a $632,500 penalty on American Honda Motor Co. for similar violations and launched the bipartisan Consortium of Privacy Regulators to collaborate with states across the country to implement and enforce privacy laws nationwide.

You can read the CPPA’s press release here: CPPA Announcement