Penalty Amount
$1,100,000
The California Privacy Protection Agency settled with PlayOn Sports for $1.10 million over CCPA violations, including failing to provide adequate opt-out mechanisms and improperly tracking users, particularly students. The company must implement proper opt-out methods, improve disclosures, and comply with children's data consent requirements.
PlayOn Sports must pay a $1.10 million fine, conduct risk assessments, provide clear and easy-to-understand privacy disclosures, implement proper opt-out methods for consumers, and obtain affirmative opt-in consent for sharing personal information of consumers aged 13 to 16.
In-house legal teams should review vendor and customer agreements, particularly those with educational institutions (e.g., school districts, high school athletic associations) and any data processing agreements. Focus on clauses governing data collection via tracking technologies, targeted advertising, user consent mechanisms (especially for minors), opt-out rights, and privacy policy integration. Required changes include implementing a direct, functional opt-out mechanism that does not force agreement to tracking, updating privacy disclosures to clearly describe data practices, ensuring valid consent for minors (or verifiable parental consent where required), and honoring universal opt-out preference signals like Global Privacy Control. Agreements must also prohibit conditioning access to services (like digital tickets) on consent to tracking.
Entity
PlayOn Sports
Industry
TechnologyOfficial Press Release
https://privacy.ca.gov/2026/03/youth-sports-media-company-to-pay-1-1-million-fine-change-practices-over-privacy-violations/
Order of Decision PlayOn Enforcement
https://privacy.ca.gov/wp-content/uploads/sites/357/2026/03/Order-of-Decision_PlayOn_Enforcement.pdf
California Privacy Protection Agency Enforcement Page
https://cppa.ca.gov/enforcement/
The California Privacy Protection Agency announced that over 300,000 Californians have signed up for the Delete Request and Opt-out Platform (DROP) since its launch five months ago. The Data Broker Registry now includes 581 registered data brokers, the highest number since the registry was established in 2020. Beginning August 1, 2026, all data brokers will be required to access DROP and process deletion requests.
The California Privacy Protection Agency launched a statewide roadshow to promote its Delete Request and Opt-out Platform (DROP), which allows California residents to request deletion of their personal information from all registered data brokers in a single request. The roadshow aims to increase awareness of data privacy rights and the DROP tool, which data brokers are legally required to process starting August 1, 2026.
$376K
The California Privacy Protection Agency settled with Ford Motor Company for $375,703 after finding that Ford violated the CCPA by requiring email verification for opt-out requests, creating unnecessary friction. Ford must implement easier opt-out methods, conduct a website audit, and comply with global privacy controls.
The California Privacy Protection Agency (CalPrivacy) announced the appointment of Sabrina Boyson Ross as its first Chief Privacy Auditor and the formation of a new Audits Division. The division will conduct regulatory examinations of businesses to determine compliance with the California Consumer Privacy Act, and its findings may lead to enforcement referrals.
$45K
Datamasters, a data broker, failed to register with the California Data Broker Registry as required by the Delete Act. The company sold sensitive personal information including health conditions, age, race, and political views. As a result, it must pay a $45,000 fine and cease all sales of Californians' personal information.
$57K
The California Privacy Protection Agency fined ROR Partners LLC $56,600 for failing to register as a data broker under the Delete Act. The marketing firm sold custom audience lists built from consumer data without registration, highlighting that businesses collecting and selling personal information must comply with data broker requirements.