Parties involved: CalPrivacy (agency enforcing CCPA/CPRA and Delete Act); PlayOn Sports (digital ticketing platform for schools, brands like GoFan, MaxPreps, NFHS Network, serving students as a "captive audience"); no specific individuals named.[1][3][5][6][11] Legislation: California Consumer Privacy Act (CCPA), with requirements for opt-outs, preference signals (e.g., GPC), risk assessments (mandatory since January 1, 2026), and opt-in for minors aged 13-15.[4][5][6][8]
Context and timeline: Triggered by a 2024 consumer complaint alleging no opt-out for data sales through trackers; CalPrivacy's Enforcement Division investigated, leading to a January 2026 settlement, Board decision on February 27, 2026 (case ENF24-S-PL-24), and public announcement March 3, 2026.[1][3][7][11] Violations included "agree-only" banners blocking ticket access, ineffective opt-outs (phone/email, third-party tools like NAI/DAA), failure to honor signals, deficient privacy notices claiming no "selling," and one targeted ad campaign still deemed sharing.[3][4][5][9] PlayOn revised practices pre-contact but insufficiently.[1]
Newsworthiness: First CalPrivacy enforcement on student/school data privacy, amid 2026 enforcement surge (e.g., data brokers, Ford; >10 actions, $4.2M+ penalties); signals intensified focus on digital tracking, opt-outs, minor protections, and risk assessments in education/tech sectors.[3][5][6][7][11][12] Lessons emphasize quarterly tracker scans, compliant contracts, and CCPA parity for all businesses.[4][6][8]