CalPrivacy said PlayOn used tracking technologies for targeted ads and made users accept tracking before they could buy tickets or use its sites. It also said PlayOn sent people to industry opt-out pages instead of offering its own opt-out, ignored opt-out preference signals, and gave inadequate notices. PlayOn was ordered to pay $1.10 million, carry out risk assessments, provide working opt-out methods and clear disclosures, and get affirmative consent before selling or sharing data of users aged 13 to 16.
On 3 March 2026, the California Privacy Protection Agency Board issued a decision requiring 2080 Media, Inc., which trades as PlayOn Sports, to pay a $1.10 million fine and change its practices. The decision followed a settlement with the agency’s Enforcement Division, and the agency said it was the first to deal with privacy issues involving students and California schools.
PlayOn runs GoFan, the platform schools use to sell digital tickets to high school games, plays and dances, and the official ticketing platform for the California Interscholastic Federation. The agency says about 1,400 California schools contract with the company, which also streams games and publishes team statistics.
According to the decision, PlayOn used tracking technologies to collect personal information and target ads at ticketholders and other users. The agency alleged that people had to click “agree” to that tracking before they could use their tickets or view the company’s websites, with no adequate way to opt out. Instead of its own opt-out, PlayOn sent people to the Network Advertising Initiative and Digital Advertising Alliance industry pages. The agency also alleged that it ignored opt-out preference signals such as Global Privacy Control and that its privacy notices fell short.
Besides paying, PlayOn must carry out risk assessments, publish disclosures that are easy to read, put working opt-out methods in place, and get opt-in consent before selling or sharing the data of users aged 13 to 15.
Nothing here involved a hacker or a leaked database. The issue was the ordinary ad tracking on a ticketing site, and a consent step that left no real choice. It follows CalPrivacy’s September 2025 order against Tractor Supply, which paid $1.35 million after the agency alleged, among other things, that it had no working opt-out, including for Global Privacy Control.
The questions this case raises can be asked of any site: whether visitors can use it without first agreeing to ad tracking, whether the site offers its own way to opt out rather than pointing to an industry page, and whether its tags stop when a browser sends a Global Privacy Control signal.