CalPrivacy fined PlayOn $1.1 million after finding the company’s GoFan ticketing pop‑up forced students and families to accept a privacy policy that allowed data sales before accessing school event tickets. The order says the pop‑up blocked ticket access unless users consented, and the company later revised its policy in December 2024 to allow opt‑outs. PlayOn does not admit liability; the action is the state agency’s first focused enforcement on student and school privacy rights.
CalPrivacy Fines PlayOn $1.1M After GoFan Pop‑Up Forced Students To Accept Data Sales
The California Privacy Protection Agency (CalPrivacy) has issued a $1.1 million disciplinary order against PlayOn — the parent company of ticketing platform GoFan — after finding the company repeatedly prevented users from opting out of data collection when retrieving school event tickets.
What Happened
The agency’s order, filed in January, says PlayOn required students and family members to accept a privacy policy that permitted the sale of their personal information before they could access tickets for school events. The company’s products, which include GoFan, MaxPreps and NFHS Network, are used by roughly 1,400 California schools.
CalPrivacy investigators found that when users tried to access tickets via GoFan, a pop‑up obscured the screen and effectively blocked access to the ticket unless the user clicked to accept the company’s terms. There was no clear option to decline or opt out, the order states — meaning attendance at school events became contingent on consenting to data collection for advertising.
“Students trying to go to prom or a high school football game shouldn’t have to leave their privacy rights at the door,” said Michael Macko, CalPrivacy’s head of enforcement, in the agency’s press release. “Businesses must ensure they offer lawful ways for Californians to opt‑out, particularly with captive audiences.”
Company Response And Changes
The disciplinary order functions as a settlement; PlayOn does not admit liability. The order notes PlayOn revised its privacy policy in December 2024 to provide an opt‑out mechanism for users. James Dickinson, PlayOn’s senior vice president of marketing, told the agency the privacy issues have been "fully resolved" since those changes.
Context And Broader Enforcement
PlayOn reports annual gross revenue of more than $26 million. CalPrivacy says this is the first enforcement action it has taken explicitly for violations involving students and schools. The agency — created after voters approved a 2020 ballot measure to strengthen data‑privacy enforcement — has fined other companies in the last year for privacy violations, including Todd Snyder, Tractor Supply Co., Honda and Datamasters.
California’s 2018 consumer privacy law requires many for‑profit companies to provide straightforward ways for users to opt out of the sale of their personal information or request deletion, although the statute includes exemptions (for example, some nonprofits or entities handling data for fewer than 100,000 California residents). Separate state rules also prohibit the sale of K–12 students’ data regardless of age, but those protections don’t always cover apps and services used outside the classroom — even when those services are effectively required for participation in extracurricular activities.
Key Takeaways
The order highlights how design choices in online services — like an opaque pop‑up that forces consent — can undermine legal privacy protections, especially for captive or vulnerable audiences such as students and their families. CalPrivacy’s action underscores increased scrutiny of ed‑tech and school‑adjacent platforms that collect or monetize student and family data.
This article was adapted from reporting originally published by CalMatters and republished under a Creative Commons Attribution‑NonCommercial‑NoDerivatives license.
Help us improve.
