Privacy & Cybersecurity Law Blog

On March 3, 2026, the California Privacy Protection Agency (“CalPrivacy”) announced its first California Consumer Privacy Act (“CCPA”) enforcement action involving student privacy, requiring 2080 Media, Inc., d/b/a PlayOn Sports (“PlayOn”), to pay a $1.10 million fine for alleged violations of the CCPA in a stipulated order.

PlayOn is a media and technology company that offers schools and other youth sports organizations a platform for ticketing, streaming, fundraising, concessions, merchandise sales, and website management. The enforcement action stems from the use of tracking technologies on PlayOn’s GoFan digital ticketing platform, which about 1,400 California schools use. According to CalPrivacy, PlayOn required users, including students, to click “agree” to tracking before they could access or present their tickets, and used students’ personal information for targeted advertising purposes.

CalPrivacy alleged that PlayOn did not provide a compliant opt-out of sale/sharing mechanism, instead directing users to industry groups such as the Network Advertising Initiative (“NAI”) and the Digital Advertising Alliance. CalPrivacy further alleged that PlayOn failed to recognize opt-out preference signals and did not provide adequate notice of its data practices. CalPrivacy also noted that students are a vulnerable population and that businesses must offer compliant and accessible opt-out of sale/sharing mechanisms, in compliance with the CCPA.

Under the order, in addition to paying the fine, PlayOn must conduct risk assessments, provide clearer disclosures, implement proper opt-out tools, and comply with the CCPA and its implementing regulations, which prohibit the sale or sharing of personal information of consumers aged 13 to under 16 without prior opt-in consent.  

On March 3, 2026, NAI President & CEO Leigh Freund issued a statement noting that the PlayOn order highlights that linking only to a third‑party opt‑out tool is not enough to comply with the CCPA, and that businesses must offer consumers a direct opt‑out method.