Written by: Haim Ravia, Dotan Hammer
On March 3, 2026, the California Privacy Protection Agency (CalPrivacy) Board issued a decision requiring PlayOn Sports to pay a $1.1 million administrative fine and overhaul its business practices, marking CalPrivacy’s first enforcement action addressing privacy violations involving students and California schools. The settlement, reached in January 2026, represents a significant escalation in state privacy enforcement and signals that CalPrivacy views the protection of students’ data as a priority within its California Consumer Privacy Act (CCPA) enforcement mandate.
PlayOn Sports operates the GoFan platform, which schools across the country use to sell digital tickets to high school sporting events, theater performances, homecoming dances, and proms. In California alone, approximately 1,400 schools contract with PlayOn Sports for ticketing, streaming, fundraising, concessions, merchandise sales, and website management. GoFan is the official ticketing platform for the California Interscholastic Federation, the governing body for high school sports in the state.
According to CalPrivacy’s decision, PlayOn Sports used tracking technologies to collect personal information and deliver targeted advertisements to ticket holders and others using its services. The company allegedly forced Californians to click “agree” to these tracking technologies before they could use their digital tickets or view PlayOn Sports’ websites, without providing a sufficient way to opt out. Instead of providing its own opt-out mechanism—as required under the CCPA—PlayOn Sports directed students and other users to third-party opt-out tools operated by the Network Advertising Initiative and the Digital Advertising Alliance. PlayOn Sports also allegedly failed to recognize opt-out preference signals, such as the Global Privacy Control, and did not provide Californians with sufficient notice of its privacy practices.
“Students trying to go to prom or a high school football game shouldn’t have to leave their privacy rights at the door,” said Michael Macko, CalPrivacy’s head of enforcement. “You couldn’t attend these events without showing your ticket, and you couldn’t show your ticket without being tracked for advertising. California’s privacy law does not work that way.” CalPrivacy emphasized that students are a uniquely vulnerable population whose data should be used to enhance their own learning, not to fuel advertising and commercial surveillance. Targeted advertising systems can subject students to profiling that follows them for years, exposes them to manipulative or harmful content, and develops sensitive inferences about their lives.
In addition to the fine, PlayOn Sports must conduct risk assessments, provide disclosures that are easy to read and understand, and implement proper opt-out methods. The Board’s order also requires compliance with the CCPA’s prohibition on selling or sharing personal information of consumers aged 13 to under 16 years old without their affirmative opt-in consent. This enforcement action follows CalPrivacy’s recent settlements with Ford Motor Company and a data broker, and builds on the agency’s growing track record of investigations into connected vehicles, streaming services, and data brokerage.
Click here to read CalPrivacy’s announcement regarding the PlayOn Sports enforcement action.
