On February 27, 2026, CalPrivacy and PlayOn settled a CCPA claim for $1.1 million. PlayOn is a digital ticketing platform used by schools and other organizations for ticketing, streaming, fundraising, concessions, merchandise sales, and website management. The settlement resolves allegations that PlayOn unlawfully “sold” and “shared” users’ personal information without providing sufficient opt-outs and notice, in violation of the CCPA. This marks the agency’s first enforcement action involving students’ data privacy.
CalPrivacy alleged that PlayOn’s cookie banner was not a sufficient opt-out mechanism since there was no way to close it without clicking “agree,” and on mobile devices, the cookie banner required users to click “agree” in order to use site functionality. Relatedly, CalPrivacy alleged that directing users to opt out of tracking technologies directly via the Network Advertising Initiative and the Digital Advertising Alliance was insufficient. Finally, CalPrivacy alleged that PlayOn failed to recognize and honor opt-out preference signals.
CalPrivacy also alleged that PlayOn’s privacy notice was deficient. For example, CalPrivacy alleged that PlayOn’s privacy notice had not been updated for more than a year, failed to inform consumers of their right to opt out of “sharing,” and incorrectly stated that PlayOn did not “sell” personal information. The privacy notice also failed to set out how to exercise the right to opt out of “selling” and “sharing,” including through the use of an opt-out preference signal. CalPrivacy noted that its allegations only applied to PlayOn before PlayOn engaged in a series of updates to its privacy practices, including updating its website to recognize opt-out preference signals and revising its cookie banner to provide users with an accept and reject button.
In addition to paying the fine, the settlement requires that PlayOn, to the extent it has not already done so, implement proper data sharing opt-out features, conduct regular scans to take an inventory of tracking technologies, engage in periodic risk assessments, and publish certain data metrics. It also requires PlayOn to comply with California’s privacy law prohibiting the “selling” or “sharing” of personal information of consumers between the ages of 13 and 16 without their affirmative opt-in consent.