PlayOn Sports Fined for CCPA Violations

The California Privacy Protection Agency (CPPA) fined PlayOn Sports $1.1 million for CCPA violations. PlayOn Sports designs platforms for high schools to sell and manage digital tickets, stream events, track scores, player bios, stats, etc. The company’s GoFan service is the official ticketing platform for the California Interscholastic Federation, the governing body for high school sports in the state. PlayOn Sports was fined for failing to allow users to opt out of tracking technologies and targeted advertising, along with other CCPA violations, which are detailed below.

Failing to Provide an Effective Method to Opt Out of the Sale/Sharing of Data

PlayOn’s digital platforms collected personal information using cookies and similar tracking technologies to deliver targeted advertisements, among other things. The company sold and shared the personal Information with advertising, social media, and analytics partners. PlayOn’s webpages disclosed this through notice banners (see below).

These notice banners required consumers to click “Agree” to the use of tracking technologies and provided no other way to close the notice banner without clicking on “Agree.” When using PlayOn’s GoFan ticketing platform on a mobile device, the notice banner covered the portion of the screen that allowed consumers to “use” or redeem the ticket (see below). This forced consumers to click “Agree” on the notice banner before they could use their tickets. This highlights the critical need for UX resources to be involved in the design and implementation of these initiatives. Further, once consumers agreed, there was no method to opt out beyond what is covered later in this blog.

PlayOn’s use of tracking technologies constituted the sale and sharing of personal information under the CCPA. The only method PlayOn offered for opting out of the sale or sharing of personal data was via a toll-free telephone number or email address. In its privacy policy, PlayOn Sports told consumers they should opt out directly with third parties via the Network Advertising Initiative (NAI) and the Digital Advertising Alliance (DAA). Its failure to provide an effective opt-out method violated the law.

Insufficient Privacy Notices

The CCPA requires businesses to provide a privacy policy that informs consumers about:

• The rights they have regarding their personal information
• The information necessary for them to exercise those rights
• How to exercise their right to opt-out
• How an opt-out preference signal will be processed
• How Consumers can use an opt-out preference signal

Privacy policies must be updated at least annually, posted online, and accessible through a conspicuous link. PlayOn Sports did not update its privacy policy for approximately 18 months (July 2022 to February 2024). Their privacy policy did not inform consumers of their right to opt-out of the sharing of their data. It also claimed that PlayOn did not sell consumers’ data. PlayOn also failed to inform consumers how to exercise their right to opt out of Sale/Sharing, including via an opt-out preference signal.

A business that sells or shares personal information must also provide Notice of Right to Opt-out of Sale/Sharing by either posting a “Do Not Sell or Share My Personal Information” or “Your Privacy Choices” link. The link must either take consumers to a webpage that provides all the required information or immediately recognize the opt-out. PlayOn’s “Your Privacy Choices” link failed to include all the required information and directed consumers to PlayOn’s deficient opt-out methods (phone number and email mentioned above).

PlayOn also did not configure its platforms to recognize and honor requests sent using an opt-out preference signal.

Read the complete Order of Decision.

2026 CCPA Fines

The PlayOn penalty is the second CCPA enforcement of 2026. In February, Disney was fined $2.75 million for various violations, including:

• Not applying opt-out requests across its multiple platforms
• Not honoring opt-out requests communicated by opt-out preference signals, such as the Global Privacy Control (GPC)
• Not providing consumers with a method to opt out on its apps

CompliancePoint offers Cookie Management Services to help businesses avoid similar penalties. We can also help with all aspects of CCPA compliance. Reach out to us at connect@compliancepoint.com to learn more.

To learn more about state privacy law enforcement priorities, watch our State Privacy Laws – What Regulators are Looking For podcast below.