The California Privacy Protection Agency (CalPrivacy, also known as the CPPA) fined PlayOn Sports $1.1 million, announced on March 3, 2026. PlayOn runs GoFan, the ticketing platform a lot of high schools and youth sports programs use. According to the agency’s order, ticket holders had to click “Agree” to tracking before they could use their tickets. Anyone who wanted to opt out was sent to industry opt-out tools run by the NAI and the DAA instead of an opt-out on PlayOn’s own site. And opt-out preference signals, the kind a browser sends automatically, weren’t honored. PlayOn had a consent banner, but the choice on it wasn’t a real one. Checking whether a site’s privacy choices actually work is one of the things DataTrue tests for.
Think about fire alarms for a second. You install a brand new, top-of-the-line fire alarm system in your home. Smoke, Carbon Monoxide, Radon, it’s got sensors for it all. It even has sprinklers that pop out of little compartments to fight a fire. The control panel shows all green lights, and it passes every self-test. You get a nice certificate from your insurance company, maybe even a bit of a savings, because you’re so responsible. Then one day a fire breaks out when you’re not home. Nothing happens. The alarm doesn’t blare, the sprinklers don’t turn on, the fire department is never called, and then your house burns down. Why? Because while the alarm system was installed, no one ever checked whether it actually did what the control panel said it did.
This is, in very loose non-technical terms, what happened to PlayOn Sports, the company behind the GoFan high school and youth sports ticketing platform. And the fire, in this case, cost them $1.1 million.
PlayOn used tracking technologies (the order names cookies and the Meta Pixel) to serve targeted ads. There was a banner. But if you wanted to actually use your ticket, you had to click “Agree” to the tracking first. That’s a banner with one real button.
And if you went looking for a way to opt out, PlayOn didn’t give you one of its own. It pointed you to the industry opt-out pages run by the NAI and the DAA. If your browser was already sending an opt-out preference signal (Global Privacy Control is the best-known one), the order says PlayOn didn’t honor it.
So the control panel was there, the lights were green, and none of it did what a visitor would reasonably assume it did. (PlayOn neither admitted nor denied most of the findings, for what it’s worth. The lesson holds either way.)
The strongest counterargument to this that we hear from legal and compliance teams is a seemingly reasonable one: “We have a CMP. We paid for OneTrust (or Cookiebot, or Termly). We’re covered.”
PlayOn had a banner too. A banner shows people a choice. Whether that choice is real is a separate question, and the answer lives in how your site is actually configured: whether there’s a working opt-out on the site itself, whether the site listens to the signals browsers send, and whether tags wait for an actual decision before they fire. That configuration is all on you and your team, and it’s the piece that is all too frequently missed, misconfigured, or broken down the road by a code update from some developer in another department.
So what would have actually helped?
Regular automated testing of the live site (daily at least), with pre-publish testing on top so changes get checked in staging before they ever reach the public. This is what DataTrue does. It crawls the whole site to find every tag, then walks the journeys that matter the way a real person would, in each consent state. For a case like this one, it checks three things:
- Is there a working opt-out on your own site, and does using it actually stop the advertising tags?
- Does the site honor opt-out preference signals such as GPC? DataTrue can arrive with the signal already switched on in its browser and watch what fires.
- Do tags wait for a real choice, or are they firing before the visitor has made one?
After every run, DataTrue records every tag that fired and inspects what data it tried to send. If something fails, you get an alert (a Slack message, if that’s how your team works). For pre-publish testing, the release can be held until it’s fixed.
You can read the regulator’s own summary in CalPrivacy’s announcement. See how DataTrue and OneTrust compare.
Could you show proof of compliance to an auditor or regulator if they emailed you today? If not, drop us a line and find out how we can help you. More on the case.
The broader lesson from the PlayOn case is simple but urgent: a banner is not compliance. Proof of compliance is a verifiable record showing that your site actually respected the choice the banner offered. Without that, you just have a very nice, very loud alarm panel that nobody ever connected to anything, and if there is ever a fire, stuff is gonna burn.