On March 3, 2026, the California Privacy Protection Agency (CalPrivacy) announced a $1.1 million settlement with PlayOn Sports, resolving alleged violations of the California Consumer Privacy Act (CCPA). The Order of Decision was issued on February 27, 2026. The settlement was part of early 2026 CPPA enforcement activities focused on missing, deficient, or overcomplicated sales and sharing opt-out mechanisms and failures to implement opt-out requests.

CalPrivacy’s decision is the first to address privacy violations involving students and California schools. The matter is notable both for the size of the penalty and for its subject: a platform deeply embedded in 1400 high schools as the only access via mobile phones to tickets to events such as athletics, theater performances, homecoming and dances and to online streaming and statistics.  

Regulatory Focus and Alleged Violations

Users were required to click “Agree” to tracking technologies before using their tickets or accessing PlayOn Sports’ websites – without having the ability to opt out. CalPrivacy said:    

“Students are a uniquely vulnerable population whose data should be used to enhance their own learning, not to fuel advertising and commercial surveillance. Targeted advertising systems can subject students to profiling that can follow them for years, expose them to manipulative or harmful content, and develop sensitive inferences about their lives.

Instead, PlayOn Sports directed students and other users to opt-out through the Network Advertising Initiative and the Digital Advertising Alliance, violating the company’s responsibility to provide its own method for consumers to opt-out. PlayOn Sports also allegedly failed to recognize opt-out preference signals and did not provide Californians with sufficient notice of its privacy practices.”

In particular, CalPrivacy found that the company’s designated opt-out channels were not operationally linked to its data collection and sharing practices, rendering them ineffective. The company also did not process Global Privacy Control (GPC) signals, which California regulators treat as valid expressions of a consumer’s “do not sell or share” preference.

The complaint further cited deficiencies in PlayOn’s privacy disclosures, including outdated statements that did not accurately describe its data practices or inform consumers of their right to opt out of sharing. In addition, CalPrivacy highlighted user interface design choices—specifically, cookie consent mechanisms that required users to accept tracking to access core functionality—as inconsistent with the requirement that consent be freely given.

Settlement Terms

In addition to paying the fine, PlayOn Sports must conduct risk assessments, provide disclosures that are easy to read and understand, and implement proper opt-out methods. The Board’s order also requires PlayOn Sports to comply with California’s privacy law prohibiting the selling or sharing of personal information of consumers of at least 13 years of age, and less than 16 years old, without their affirmative “opt-in” consent.

Broader Context

In general, privacy policies are supposed to contain a disclosure of the use of tracking technologies, defined in the Order of Decision as “mean[ing] any scripts, cookies, pixel tags, web beacons, software development kits, or other tracking devices or mechanisms that are used to collect and analyze information about a Consumer’s activity on a website or application” and adequate opt outs. Over the last few years, California’s lower courts have interpreted California’s Invasion of Privacy Act (CIPA) to include tracking pixels as “Pen Trap and Trace Devices.” Individuals may sue for such violations, and businesses must pay up and remediate (see https://www.tarterkrinsky.com/insights/waves-of-lawsuits-hit-businesses-over-website-tracking-pixels).

A few recent cases are bucking the trend. In Schallert v. Orkin LLC, 2025 WL 4332757, “the Court sees no basis to conclude that the Legislature intended to impose a broad regulatory and civil-liability scheme around website tracking when it referred to “trap and trace devices in 2015. And the Court cannot expand liability under CIPA beyond what the Legislature intended.” (See also Schallert v. Palo Alto Networks, Inc. 2026 WL 754028).

However, these decisions are not the end of the road for CIPA claims as there is no appellate decision on the books, yet. And CalPrivacy will continue to enforce CIPA, requiring privacy policies that explain what tracking technologies are used and provide easy to understand sales and sharing opt-out mechanisms and implementation of opt-out requests.

For More Information

Reach out to Tarter Krinsky & Drogin for more information on the California Privacy Protection Agency (CalPrivacy) decision and how it may affect your business.