Your Kid Had to Surrender Their Data Just to Buy a Prom Ticket—California Fined the Company $1.1 Million

Agree or Miss Prom

PlayOn Sports operates GoFan, one of the most widely used digital ticketing platforms for high school events in the United States. Roughly 1,400 California schools contracted with the company, making it the official ticketing system for everything from Friday night football to homecoming dances, theater performances, and prom.

The problem was what happened before students could use their tickets. When a student opened GoFan, a popup appeared asking them to agree to the company's privacy policy, which authorized the sale of their personal data. The popup obscured the entire screen. There was no "decline" button, no way to dismiss it. Students either agreed to let PlayOn sell their data to advertisers or they could not access the tickets they had already paid for.

"Students trying to go to prom or a high school football game shouldn't have to leave their privacy rights at the door," said Michael Macko, head of enforcement at the California Privacy Protection Agency.

What the Investigation Found

The California Privacy Protection Agency's investigation, which resulted in a disciplinary order filed in January 2026, found that PlayOn Sports repeatedly violated state privacy law throughout 2023 and 2024. The violations fell into three categories.

First, the company used tracking technologies to collect personal information from students and deliver targeted advertising. Second, it provided no meaningful way to opt out. When users asked to stop the data sharing, PlayOn directed them to third party tools run by the Network Advertising Initiative and the Digital Advertising Alliance instead of building its own opt out mechanism. California law requires companies to provide their own opt out methods, not offload that responsibility onto outside organizations.

Third, PlayOn failed to comply with California's special protections for minors. The state prohibits the sale or sharing of personal data for anyone under 13 under any circumstance, and for anyone between 13 and 16 without their explicit opt in consent. PlayOn did neither.

The $1.1 Million Penalty

The CPPA Board ordered PlayOn Sports to pay $1.1 million, marking the agency's first enforcement action focused specifically on student privacy. The settlement, announced on March 3, 2026, also requires the company to make concrete changes to how it handles student data going forward.

PlayOn must now conduct privacy risk assessments, provide disclosures that are easy to read and understand, and implement proper opt out methods that comply with California law. The company must also follow the state's age based consent requirements, meaning it can no longer sell or share student data without meeting the heightened protections for minors.

The Ed Tech Privacy Gap

The PlayOn case highlights a growing problem in education technology. While California has some of the strongest data privacy laws in the country, enforcement has not kept pace with the explosion of apps and platforms that schools require students to use. A CalMatters investigation found more than 30 companies using hidden techniques to make it difficult for customers to exercise their privacy rights.

The deeper issue is structural. Existing education privacy laws were written for classroom technology. They do not necessarily cover apps and services used outside the classroom, even when that technology is a de facto requirement for participation in school sports, clubs, or events. GoFan is a perfect example: it is not a learning tool, but students cannot attend school events without it. That gap between what the law covers and what students are forced to use leaves families exposed.

A Signal for Ed Tech Companies

The CPPA's action against PlayOn is notable not just for the fine, but for what it signals about the agency's enforcement priorities. This is the first time the California Privacy Protection Agency has used its authority to directly address student data privacy. It suggests that companies operating in the school ecosystem—ticketing platforms, scheduling apps, fundraising tools—are now squarely in the agency's sights.

For parents and students, the lesson is straightforward: the apps that schools require you to use are not always governed by the privacy laws you might expect. Check what data you are agreeing to share, look for opt out settings, and remember that a mandatory popup does not equal informed consent.

What Happens Next

PlayOn Sports has agreed to the settlement terms. The company must implement the required changes and submit to ongoing compliance monitoring by the CPPA. If the agency follows the pattern it has set with other enforcement actions, PlayOn's compliance will be reviewed periodically, and further penalties could follow if the company fails to meet its obligations.

The broader question is whether other states will follow California's lead. With 21 states now having comprehensive privacy laws on the books, the regulatory landscape for ed tech companies is getting more complex by the month. Companies that treat student data as an advertising asset may soon find that the cost of doing so exceeds the revenue it generates.