Run a free scan

PlayOn Sports: a banner with only "Agree" over a school ticket is not a choice

If your banner has only one button, and the page behind it is something people need, you have built a forced choice. The CPPA found that PlayOn’s notice covered the ticket that students and families had to show at the door, and the only way past it was "Agree".

California Privacy Protection Agency (CalPrivacy) · CCPA · Board decision 27 February 2026

The problem

About 1,400 California schools sell tickets for games, dances and plays through PlayOn’s GoFan platform, the official ticketing platform of the California Interscholastic Federation. The order finds that its banner said data was collected with trackers such as the Meta Pixel and "shared with our advertising, social media, and analytics partners", offered only "Agree", and on phones covered the part of the screen used to redeem the ticket (Order, ¶¶ 30–35, 42–44).

Case record

Regulator
California Privacy Protection Agency; decision by its Board, Chair Jennifer M. Urban ([Order, p. 1](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf))
Case number
ENF24-S-PL-24
Parties
CPPA Enforcement Division v. 2080 Media, Inc. d/b/a PlayOn Sports (parent of GoFan, MaxPreps and the NFHS Network)
Counsel
Enforcement Division; ZwillGen for PlayOn ([Order, pp. 15–16](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf))
Laws
CCPA; CCPA regulations (11 CCR)
Stage
Stipulated final order adopted by the Board, 27 February 2026; review waived ([¶ 78](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf))
Amount
USD 1,100,000 administrative fine ([¶ 65](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf))
Source review
17 October 2026

PlayOn admitted only the business description in paragraphs 29 to 36, neither admitted nor denied the rest, and did not admit liability (¶ 74). The order credits PlayOn for changes made in December 2024, before it heard from the Enforcement Division (¶¶ 26, 66).

What the regulator found

What the regulator found
PracticeWhat the law requiresWhat the order describesSource
Forced "Agree" bannerAn effective way to opt out of sale and sharing (Civ. Code § 1798.135(a)(1))The banner could be closed only by clicking "Agree"; on mobile it blocked ticket redemption[¶¶ 42–44, 48](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf)
Opt-out outsourcedThe business must offer its own methods, including an opt-out preference signal (11 CCR § 7026(a))Only a phone number and email, which did not reach the trackers; the policy sent people to the NAI and DAA industry opt-out pages[¶¶ 46–49](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf)
GPC ignoredHonour opt-out preference signals (11 CCR § 7025)Sites not configured to recognise them during the relevant period[¶¶ 50–52](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf)
NoticesAnnual privacy policy update; a full notice of the right to opt out (11 CCR §§ 7011, 7013)Policy not updated from July 2022 to February 2024 and said PlayOn did not sell data; the "Your Privacy Choices" link pointed to the inadequate methods[¶¶ 53–60](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf)

The order notes PlayOn ran "only one targeted advertising campaign" on its ticketing platform in the relevant period, but its trackers still amounted to selling and sharing (¶ 45). The relevant period is 1 January 2023 to 31 December 2024 (¶ 28).

What the order requires

Paragraphs are from the stipulated final order.

  • Quarterly tracker scans of its digital properties to keep "a full and current inventory of Tracking Technologies" (¶ 67(b)), and compliant contracts with every third party receiving data through them (¶ 67(c)).
  • Opt-outs that work on the trackers, from both opt-out preference signals and PlayOn’s other methods (¶ 67(d)), and a "Do Not Sell or Share" or "Your Privacy Choices" link (¶ 67(e)).
  • A review of the consent management platform, notices and request mechanisms within 90 days (¶ 67(f)).
  • Risk assessments for GoFan and the NFHS Network within one year, updated before material changes for three years, reviewed by PlayOn’s board, and considering "whether users are required to consent to the Selling or Sharing of their Personal Information... in order to participate in certain events" (¶ 68).
  • Plain language for the audience: notices on services selling tickets to high school events must be "easy to read and understandable to attendees of those events" (¶ 69).
  • Request metrics posted annually for three years (¶ 70).

Technical issue

  • Tools or vendors: the Meta Pixel (named in PlayOn’s own banner), other cookies and persistent trackers, and the NAI and DAA opt-out pages (¶¶ 42, 47).
  • Where: GoFan ticket purchase and redemption pages, on desktop and mobile.
  • What data: personal information collected by trackers and shared with advertising, social media and analytics partners.
  • When: from page load; the banner said continued use counted as agreement.
  • How it came to light: a 2024 investigation, during which a consumer complained that opt-outs were impossible (¶ 25).

Inth’s technical interpretation: this was a notice banner styled as consent, with a single exit. Under California’s opt-out model the trackers could run before a choice, but there had to be a working way to stop them, and GPC had to count. Here the only control was "Agree", the policy pointed elsewhere, and the banner sat on top of the one element people had to reach.

Illustrative pattern, not the defendant’s code.

<!-- Bad: one button, and the notice covers the ticket until it is pressed -->
<div class="notice" style="position: fixed; inset: auto 0 0 0; height: 45vh">
  We share data with advertising and social media partners. Further use means you agree.
  <button onclick="agree()">Agree</button>
</div>
<script>fbq('init', PIXEL_ID); fbq('track', 'PageView');</script>

Illustrative pattern, not the defendant’s code.

<!-- Fixed: the ticket works either way; opting out and GPC stop the pixel -->
<div class="notice" role="dialog" aria-label="Privacy choices">
  You can use your ticket whatever you choose.
  <button onclick="choose('accept')">Accept</button>
  <button onclick="choose('reject')">Do not sell or share</button>
</div>
<script>
  const optedOut = navigator.globalPrivacyControl === true || getChoice() === 'reject';
  if (!optedOut) { fbq('init', PIXEL_ID); fbq('track', 'PageView'); }
</script>

Timeline

Timeline
DateEvent
July 2022 to February 2024Privacy policy not updated ([¶ 57](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf))
2024Investigation opens ([¶ 25](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf))
December 2024PlayOn adds accept and reject choices and honours opt-out signals ([¶ 26](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf))
27 February 2026Board adopts the order ([Order, p. 1](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf))
3 March 2026CalPrivacy announcement ([Announcement](https://privacy.ca.gov/2026/03/youth-sports-media-company-to-pay-1-1-million-fine-change-practices-over-privacy-violations/))

Outcome

PlayOn pays USD 1,100,000 within 30 days of the decision (¶ 65); each side bears its own fees (¶ 72). System changes were due within 180 days unless another date applies (¶ 71). The release covers only the agency’s CCPA claims on the conduct described (¶ 73).

What it cost

What it cost
ItemAmount or term
Administrative fineUSD 1,100,000 ([¶ 65](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf))
Agency feesEach side bears its own ([¶ 72](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf))
Risk assessmentsWithin one year, updated for three years, board-reviewed ([¶ 68](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf))
Quarterly tracker scansNo end date stated ([¶ 67(b)](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf))
Public request metricsThree years ([¶ 70](https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf))

Why it matters

CalPrivacy called it "the first to address privacy violations involving students and California schools" (Announcement). It is also an early order to use the CCPA risk-assessment rules that took effect on 1 January 2026, and it tells the business to weigh whether people are being coerced into sharing to attend an event (¶ 68). Pointing users to the NAI or DAA pages is not a substitute for your own opt-out. The quarterly scan term repeats Tractor Supply. See notice, consent scope and assent and CCPA.

How Inth catches this

  • Code audit: flags a pull request that adds the Meta Pixel outside the consent check.
  • Website audit: script and domain monitoring and vendor discovery build the tracker inventory ¶ 67(b) asks for, and it records Meta Pixel requests made after a refusal or with GPC, with the page, time and consent state.
  • Consent banner: the Meta Pixel helper loads only when its category is granted. Inth’s default California policy is opt-out, so tags run until the visitor opts out, and GPC counts as an opt-out of sale and sharing. For an audience of students, a California opt-in policy is a configuration choice your team can make, not the default. The banner gives Accept and Reject the same weight by default.
  • Evidence: each consent record shows the choice, country and policy applied.

Limit: Inth cannot assess whether a notice is readable for a teenage audience, or perform the CCPA risk assessment.

Checks for your own systems

In the repository

  • Find every banner variant and count its buttons. A single "Agree" or "OK" is the pattern here.
  • Check the banner never overlaps a primary action such as a ticket, checkout or login.
  • Check marketing pixels read both the stored choice and navigator.globalPrivacyControl.

In the browser and network

  • On a phone-sized viewport, open a ticket page and check you can use the ticket without accepting.
  • Refuse, reload, and filter for facebook.com/tr.

With the people responsible

  • Remove any instruction that tells users to opt out through NAI or DAA instead of your own control.
  • Ask whether the audience includes under-16s and whether opt-in is needed for them.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit PlayOn Sports' current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.