Announced this week, the settlement argued PlayOn Sports was essentially forcing users — namely students and parents — to give up their personal data to access and utilize high school event tickets. The case marks a watershed moment for "pay-to-play" privacy, where consumers are required to pay a fee to prevent their personal data from being collected, mined or used for targeted advertising, signaling the state's willingness to prosecute businesses that obstruct consumer rights behind essential digital services.
PlayOn Sports operates several major high school sports platforms: GoFan, a digital ticketing platform used by thousands of U.S. schools; MaxPreps, which provides stats, schedules and other data about high school sports; and the NFHS Network, a subscription-based high school sports streaming service, operated by PlayOn in partnership with the National Federation of State High School Associations (NFHS) and its member state associations, which was the subject of the privacy investigation.
PlayOn Sports' system allows attendees to purchase digital tickets to events and present them on their mobile phones for entry. In California alone, roughly 1,400 schools rely on the company’s platforms to sell and manage event tickets, according to the CPPA’s news release.
Moreover, the investigation into PlayOn Sports centered on how the company’s mobile interface cornered users into data tracking. According to the CPPA’s Order of Decision last week, “When using PlayOn’s GoFan ticketing platform on a phone or mobile device, the notice banner covered the portion of the screen that allowed the consumer to ‘use’ or redeem the ticket. Thus, consumers were forced to first click ‘Agree’ on the notice banner in order to use their ticket.”
In a public statement, the CPPA framed the issue as a matter of consumer rights and youth protection.
“Students trying to go to prom or a high school football game shouldn’t have to leave their privacy rights at the door,” Michael Macko, CPPA's head of enforcement, said in a public statement.
Investigators also found that PlayOn did not adequately provide users with mechanisms required under California privacy law to opt out of the sale or sharing of personal information.
Under the California Consumer Privacy Act, businesses must offer clear methods for consumers to submit requests to opt out of the sale or sharing of their data. However, PlayOn only offered a toll-free phone number and email address to submit such requests.
Regulators concluded these options were insufficient because they did not effectively stop data collection through online tracking technologies. As the order explained, those mechanisms “did not sufficiently address PlayOn’s selling and sharing of consumers’ personal information through tracking technologies.”
In addition, the order said the company’s privacy disclosures were not regularly updated and did not fully explain users’ rights or how to exercise them.
SETTLEMENT REQUIREMENTS
In addition to a hefty fine, under the settlement, PlayOn must also implement a series of changes designed to bring its services into compliance with California law. The order requires the company to provide consumers with clear mechanisms to control how their personal information is used. For example, if PlayOn sells or shares consumer data, it must maintain a “Do Not Sell or Share My Personal Information” or “Your Privacy Choices” link on its websites that allows users to exercise those rights.
The order also said the company must scan its digital platforms at least quarterly to maintain “a full and current inventory of tracking technologies” and ensure its systems properly process opt-out requests.
Lastly, PlayOn is required to review and revise its notices and disclosures so they are understandable to the people using its services, noting that services selling tickets to school events should be easy for attendees — including students — to understand.
MESSAGE TO ED-TECH VENDORS
The CPPA emphasized that students represent a particularly sensitive group when it comes to data collection and online profiling.
“Students are a uniquely vulnerable population whose data should be used to enhance their own learning, not to fuel advertising and commercial surveillance,” the agency said in its news release.
In the release, privacy regulators said the case underscores a broader effort to protect minors and families interacting with digital services tied to school activities.
“You couldn’t attend these events without showing your ticket, and you couldn’t show your ticket without being tracked for advertising,” Macko said in a public statement. “California’s privacy law does not work that way. Businesses must ensure they offer lawful ways for Californians to opt out, particularly with captive audiences.”
