PlayOn Sports’ $1.1M CPPA fine: tracking required to use a high-school ticket (2026)
At a glance
- Brought by
- Regulator: CalPrivacy (CPPA)Regulator
- Company
- PlayOn Sports (GoFan)
- Sector
- Youth-sports ticketing
- Law
- CCPA (California)
- Amount
- $1.1M
- Date
- Settled Mar 3, 2026
- Status
- Settled
Summary
In March 2026, CalPrivacy fined PlayOn Sports, which runs the GoFan high-school ticketing platform, $1.1 million. Its order says ticket holders had to click ‘Agree’ to tracking before they could use their tickets, were pointed to industry opt-out tools instead of PlayOn’s own, and had their opt-out preference signals ignored.
What happened
The tracking ticket holders had to agree to included cookies and the Meta Pixel, which PlayOn used to collect data and serve targeted ads.
The mechanism
The industry tools PlayOn pointed people to were the NAI and DAA opt-out pages, in place of an opt-out on its own site. So there was no working way to use a ticket without first agreeing to be tracked.
Why it was preventable
Whether a site offers a real opt-out, and whether it honors GPC, are both direct checks. So is confirming a tracker does not fire before a visitor has any meaningful choice.
In the regulator’s words
Michael Macko, Head of the CPPA’s Enforcement Division, said: “Students trying to go to prom or a high school football game shouldn’t have to leave their privacy rights at the door.”
Timeline
- Mar 3, 2026settled.
Source
Questions
Who fined PlayOn Sports?
CalPrivacy, the California Privacy Protection Agency (CPPA), fined PlayOn Sports $1.1 million in March 2026. PlayOn runs the GoFan high-school ticketing platform.
What made this case notable?
Ticket holders had to click ‘Agree’ to tracking before they could use their tickets, the site pointed users to industry opt-out pages instead of offering its own, and opt-out preference signals were not honored.
How is a “real” opt-out tested?
By checking whether the site offers a working opt-out on its own surface, whether it honors GPC, and whether trackers hold off until the visitor has a meaningful choice.
Related cases
Ford’s $375,703 CPPA fine
Email-verification friction added to opt-out
Tractor Supply’s $1.35M CPPA fine
Opt-out webform did not stop trackers; GPC not honored until Jul 2024
Todd Snyder’s $345,178 CPPA fine
Opt-outs not processed for 40 days; ID verification required
See what your tags send before it becomes a case
DataTrue runs real journeys on your site in each consent state and reads what each tag sends, field by field. A tag sending what it should not shows up in a test.
- Every page, with coverage scans
- Scheduled runs, with alerts when a result changes
- Full journeys, like checkout and signup, in each consent state
- What each tag sent, field by field
- PII detection with test personas
- iOS and Android app testing
- Pre-publish testing for GTM and Adobe Tags
- REST API, plus Slack and Jira alerts
The full platform, every feature, free for 30 days.
