The California Privacy Protection Agency (CPPA) fined PlayOn Sports $1.1 million on March 3, 2026, for violating state privacy laws by tracking users and forcing students to accept data sharing to buy event tickets. PlayOn had a working consent banner, but when users clicked “Reject All”, its tags kept firing anyway, continuing to transmit data after the opt-out. The banner recorded the user’s choice, but nothing verified that the tags honored it. A pre-publish consent simulation, run in the staging environment before the code shipped, would have caught the mismatch before it reached a real user. This is one thing that DataTrue tests for.
Think about fire alarms for a second. You install a brand new, top-of-the-line fire alarm system in your home. Smoke, Carbon Monoxide, Radon, it’s got sensors for it all. It even has sprinklers that pop out of little compartments to fight a fire. The control panel shows all green lights, and it passes every self-test. You get a nice certificate from your insurance company, maybe even a bit of a savings, because you’re so responsible. Then one day a fire breaks out when you’re not home. Nothing happens. The alarm doesn’t blare, the sprinklers don’t turn on, the fire department is never called, and then your house burns down. Why? Because while the alarm system was installed, no one ever checked to see if it was actually connected to anything.
This is, in very loose non-technical terms, what happened to the streaming service PlayOn. And the fire, in this case, cost them $1.1 million.
In 2023, they settled with the California Privacy Protection Agency (CPPA) for a clear and increasingly common failure for companies. Their website had a Consent Management Platform (CMP) banner, so when a user arrived and clicked “Reject All,” the banner did its job perfectly. It recorded that the user had opted out of data collection and sharing.
But the back end never got the memo.
The marketing and analytics tags on their site continued to fire, collecting and transmitting user data as if no choice had ever been made. This is the critical gap between a front-end promise and back-end behavior. The consent banner is the fire alarm control panel showing a green light, and the tag firing behavior is the sprinkler system that was never hooked up to it. The result, as documented in the official settlement, was a massive discrepancy between what users were promised and what the technology actually did.
This wasn’t a failure of the banner, it was a failure of the verification. The company trusted that the banner was enough for them to be compliant, and they assumed that because they had installed the alarm, the sprinklers would just work. This is probably the single most dangerous assumption in digital privacy compliance today.
The strongest counterargument to this that we hear from legal and compliance teams is a seemingly reasonable one: “We have a CMP. We paid for OneTrust (or Cookiebot, or Termly). We’re covered.”
PlayOn was covered. They had a CMP tool, and it worked just fine, but they still paid the fine. A CMP’s only job is only to record a user’s preference. It does not, by itself, enforce that preference on your website or other third-party technologies. The enforcement step, where a tag has to check for a consent signal before it is even allowed to fire, is a separate piece of configuration, which is all on you and your team. It’s a piece that is all too frequently missed, misconfigured, or broken down the road by a subsequent code update by some developer in another department.
So what would have actually helped to prevent this fine from being levied on PlayOn?
An automated test, running in a staging environment, before a single line of new code reached the public, as well as regular (daily at least) automated scans of the production environment. This is what’s called consent simulation, and it works by having a machine visit your site and act like a real user. This is one thing DataTrue does. It simulates every possible consent scenario: clicking “Accept,” clicking “Reject,” or even arriving with a Global Privacy Control (GPC) signal already active in its browser.
After DataTrue makes a choice, it watches and records every single tag that fires and inspects what data it’s trying to send. If a user (real or simulated) clicks “Reject All” and a Meta pixel still fires, the test fails and you get an alert (or if it’s running on a regular daily automated schedule, you get potentially a Slack message letting you know). For pre-publish testing, the code release can then be blocked from going into production.
The entire failure at PlayOn could have been a failed test run, and a ten-minute fix for a developer, instead of a seven-figure settlement and a public enforcement action. You can read more about the specifics in the US Regulatory Case Library.
The broader lesson from the PlayOn case is simple but urgent: a banner is not compliance. Proof of compliance isn’t the banner, but a verifiable audit trail showing that your systems actually respected the choice that banner recorded. Without that proof, you just have a very nice, very loud alarm that isn’t connected to anything, and if there is ever a fire, stuff is gonna burn.
Could you prove proof of compliance to an auditor or regulator if they emailed you today? If not, drop us a line and find out how we can help you.