Key parties are CalPrivacy (enforcer), PlayOn Sports (violator serving youth sports for ticketing/streaming/fundraising), and CCPA legislation, which prohibits selling/sharing minors' (13-15) data without opt-in consent and mandates accessible opt-outs. The Stipulated Final Order requires PlayOn to pay the fine within 30 days, implement compliant opt-outs, conduct quarterly tracker scans and board-reviewed risk assessments (addressing coercive consent for events), post annual consumer request metrics for three years, and secure CCPA-compliant third-party contracts.[1][5][7][9] This is CalPrivacy's first CCPA action involving student privacy and its second-largest fine (after Tractor Supply's $1.35M).[3][4][11]
The violations occurred from January 1, 2023, to December 31, 2024, amid CalPrivacy's expanding 2026 enforcement on opt-outs/trackers, following new CCPA regulations effective January 1, 2026, amid prior cases like Honda and Todd Snyder. PlayOn's platform captured student/parent data in a "captive audience" context (e.g., required for tickets), heightening risks for vulnerable minors.[2][5][7][11]
Newsworthy as CalPrivacy's first student privacy enforcement—emphasizing minors' protections and tracker compliance amid rising CCPA actions (four public by early 2026)—it signals stricter scrutiny on ed-tech/youth platforms, with fines escalating and remedies like risk assessments setting precedents. Announced March 3 (board decision March 23), it aligns with AG settlements (e.g., Disney $2.75M) and broader privacy pushes.[3][4][11][13]