Jam City: a mobile game needs its opt-out inside the app

If people use your product in an app, the opt-out must be in the app too. California’s case against Jam City says an email address in a website privacy policy is not an opt-out for 21 mobile games, and that an age gate which only protects under-13s leaves 13 to 15-year-olds exposed.

California Attorney General · CCPA and UCL · Stipulated judgment signed 21 November 2025

The problem

Jam City makes free-to-play mobile games, including titles based on Disney and Warner Bros. franchises, and earns money from targeted in-game ads. The Attorney General alleged that 20 of its 21 apps had no control for the sale or sharing of data, the 21st had an unclear "Data Privacy" control, and the only opt-out route was an email address in the privacy policy (Complaint, ¶¶ 6–11).

Case record

Court: Superior Court of California, County of Los Angeles
Case number: 25STCV34029 ([Complaint, p. 1](https://oag.ca.gov/system/files/attachments/press-docs/Complaint%20%28People%20v%20Jam%20City%20Inc%29.pdf))
Parties: The People of the State of California v. Jam City, Inc.
Counsel: Attorney General's Office; Frankfurt Kurnit Klein & Selz PC for Jam City ([Judgment, p. 2](https://oag.ca.gov/system/files/attachments/press-docs/CA_SUP_LAX_25STCV34029_Signed_Order_Final_Judgment.pdf))
Laws: CCPA; UCL
Stage: Stipulated final judgment, signed 21 November 2025 ([Judgment, p. 9](https://oag.ca.gov/system/files/attachments/press-docs/CA_SUP_LAX_25STCV34029_Signed_Order_Final_Judgment.pdf))
Amount: USD 1,400,000 civil penalty ([Judgment, ¶ 26](https://oag.ca.gov/system/files/attachments/press-docs/CA_SUP_LAX_25STCV34029_Signed_Order_Final_Judgment.pdf))
Source review: 17 October 2026

Jam City stipulated without admitting liability and without any adjudication of fact or law (Judgment, p. 2).

The problem
Case record
What the regulator alleged
What the judgment requires
Technical issue
Timeline
Outcome
What it cost
Why it matters
How Inth catches this
Checks for your own systems
Sources and limits

What the regulator alleged

What the regulator alleged
Claim	What the law requires	Facts alleged	Result
No in-app opt-out	An opt-out that reflects how the business mainly interacts with consumers (11 CCR § 7026(a))	20 of 21 apps had no sale or sharing control; one had a "Data Privacy" control that did not mention the CCPA; the website had no opt-out link; the policy offered only ccpaoptout@jamcity.com ([Complaint, ¶¶ 10–11](https://oag.ca.gov/system/files/attachments/press-docs/Complaint%20%28People%20v%20Jam%20City%20Inc%29.pdf))	Settled; not decided
Minors 13 to 15	No sale or sharing of known under-16s' data without opt-in (Civ. Code § 1798.120(c))	In six age-gated games, only players who entered an age under 13 got the child version; 13 to 15-year-olds got the ad-supported version ([Complaint, ¶ 13](https://oag.ca.gov/system/files/attachments/press-docs/Complaint%20%28People%20v%20Jam%20City%20Inc%29.pdf))	Settled; not decided

The data involved was device identifiers, IP addresses and gameplay, including in-game purchases and how often people played, shared with advertising and analytics companies for cross-context advertising (Complaint, ¶¶ 7–8).

What the judgment requires

Paragraphs are from the signed judgment.

Opt-out link in every app and on the website, either acting at once or leading to a notice with "a simple toggle or check box" (¶ 17(a)–(b)).
One opt-out, all games. An opt-out in one app applies "across all of DEFENDANT’S mobile applications" for any data linked to that person (¶ 17(c)), asking only the minimum data needed (¶ 17(d)).
Visible confirmation, such as "Opt-Out Request Honored" and a toggle showing the state, in each app (¶ 18).
Cookie and other choices kept distinct from the CCPA opt-out, though one mechanism may serve both if clear (¶ 19).
Neutral age screens: no default of 16 or over, no hint that features are lost by entering a younger age, and no data collected before the age is entered (¶ 21(a)). Under-13s go to a child version; 13 to 15-year-olds get the child version unless they opt in (¶ 21(b)–(c)).
Deletion requests: Jam City must tell recipients to delete data collected before 1 October 2024 from players who entered an age under 16 (¶ 22).

Technical issue

Tools or vendors: unnamed advertising and analytics partners integrated in the games.
Where: 21 mobile apps; the website only for the privacy policy.
What data: device identifiers, IP addresses, play and purchase behaviour.
When: from install, with no in-app way to stop it; for 13 to 15-year-olds, without the opt-in the law requires.
How it came to light: an Attorney General investigation opened in May 2024 (Complaint, ¶ 10); the record does not say what prompted it.

Inth’s technical interpretation: the age gate had the right shape with the wrong threshold. The branch sent under-13s to a build without ad SDKs, but the CCPA’s opt-in rule runs to 16, so six games started the ad stack for 13 to 15-year-olds. Separately, there was no opt-out state in the apps for the ad SDKs to read at all.

Illustrative pattern, not the defendant’s code.

// Bad: only under-13s are diverted; the ad SDK starts for everyone else
fun onAgeSubmitted(age: Int) {
    if (age < 13) {
        startChildVersion()
    } else {
        AdsSdk.initialize(context)
        startFullGame()
    }
}

Illustrative pattern, not the defendant’s code.

// Fixed: under-16s need opt-in; an in-app opt-out is checked before ads start
fun onAgeSubmitted(age: Int) {
    when {
        age < 13 -> startChildVersion()
        age < 16 && !privacy.hasTeenOptIn() -> startChildVersion()
        privacy.hasSaleShareOptOut() -> startFullGame() // no ad SDK
        else -> { AdsSdk.initialize(context); startFullGame() }
    }
}

Timeline

Timeline
Date	Event
May 2024	Investigation opens ([Complaint, ¶ 10](https://oag.ca.gov/system/files/attachments/press-docs/Complaint%20%28People%20v%20Jam%20City%20Inc%29.pdf))
1 October 2024	Cut-off for data covered by the deletion instruction ([¶ 22](https://oag.ca.gov/system/files/attachments/press-docs/CA_SUP_LAX_25STCV34029_Signed_Order_Final_Judgment.pdf))
21 November 2025	Complaint filed; judgment signed; settlement announced ([Complaint, p. 1](https://oag.ca.gov/system/files/attachments/press-docs/Complaint%20%28People%20v%20Jam%20City%20Inc%29.pdf); [Judgment, p. 9](https://oag.ca.gov/system/files/attachments/press-docs/CA_SUP_LAX_25STCV34029_Signed_Order_Final_Judgment.pdf))

Outcome

Jam City pays USD 1,400,000 in two halves: USD 700,000 within 60 days of being served with notice of entry, and USD 700,000 within one year (¶¶ 7, 26). Each side bears its own fees (¶ 27). Two monitoring programmes, one for opt-outs and one for under-16 rules, start within 180 days and run for three years with confidential annual reports (¶¶ 23–25). The judgment establishes no finding of fact.

What it cost

What it cost
Item	Amount or term
Civil penalty	USD 1,400,000 in two instalments of USD 700,000 ([¶ 26](https://oag.ca.gov/system/files/attachments/press-docs/CA_SUP_LAX_25STCV34029_Signed_Order_Final_Judgment.pdf))
Attorney General's fees	None; each side bears its own ([¶ 27](https://oag.ca.gov/system/files/attachments/press-docs/CA_SUP_LAX_25STCV34029_Signed_Order_Final_Judgment.pdf))
Monitoring programmes	Two, three years each, annual reports ([¶¶ 23–24](https://oag.ca.gov/system/files/attachments/press-docs/CA_SUP_LAX_25STCV34029_Signed_Order_Final_Judgment.pdf))
Deletion instructions to recipients	Data from under-16 players collected before 1 October 2024 ([¶ 22](https://oag.ca.gov/system/files/attachments/press-docs/CA_SUP_LAX_25STCV34029_Signed_Order_Final_Judgment.pdf))

Why it matters

The complaint states the rule for app businesses plainly: "app developers must design and provide opt-out methods within the apps they offer to consumers" (Complaint, ¶ 1). The age-screen terms repeat those in Tilting Point almost word for word, and the cross-app opt-out matches the account-wide terms in Disney and Sling TV. The Attorney General counted it as its sixth CCPA action (Announcement). See children’s privacy defaults and CCPA.

How Inth catches this

Code audit: tracker and SDK detection spots an advertising SDK as it enters an app codebase, and the vendor call graph shows when its initialisation does not check an age or opt-out state.
Website audit: limited here; it observes websites, not native game apps.
Consent banner: Inth’s Consent banner runs on websites. It does not provide an in-app opt-out for native games.
Evidence: each Code audit finding keeps its file, commit, owner and decision.

Limit: Inth cannot test what an ad SDK sends from a device, or whether an age screen is neutral; those need device testing and design review.

Checks for your own systems

In the repository

Find every place an ad or analytics SDK is initialised and check that an opt-out and an age state are read first.
Check the age-gate threshold: under 16, not under 13, for sale and sharing.
Check the date picker or age field does not default to an adult age.

In the browser and network

On a test device, enter age 14 and capture traffic. Ad network requests should not appear without opt-in.
Opt out in one game, open another on the same account, and check its ad traffic.

With the people responsible

List every game, its SDKs and whether each has an in-app opt-out.
Agree who sends deletion instructions to ad partners and how receipt is recorded.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Jam City’s current apps. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.