Mar 14, 2026 · 5 min read
1,400 Schools Made Students Agree to Tracking Just to Use Their Tickets
California's privacy agency issued its first student focused enforcement action, fining PlayOn Sports $1.1 million for forcing students to accept ad tracking through its GoFan ticketing platform used by schools across the state.
Agree to Tracking or Miss the Game
PlayOn Sports, operating under the name 2080 Media, runs GoFan, a digital ticketing platform used by approximately 1,400 California schools for event tickets, live streaming, fundraising, and merchandise sales. On March 3, 2026, the California Privacy Protection Agency announced a $1.1 million fine against the company for violating the California Consumer Privacy Act in what marks CalPrivacy's first enforcement action specifically involving student privacy.
The core violation was straightforward and troubling: students who had already purchased tickets to school sporting events were forced to click "agree" to tracking before they could even access or display those tickets on their phones. Refusing meant they could not use what they had already paid for. The platform then used the personal information it collected, including data from minors, for targeted advertising.
What PlayOn Did Wrong
CalPrivacy's investigation identified multiple CCPA violations beyond the forced consent mechanism. PlayOn failed to provide a compliant way for users to opt out of the sale or sharing of their personal information. Instead of building its own opt out tool, the company directed students and parents to third party industry groups like the Network Advertising Initiative and the Digital Advertising Alliance, effectively shifting the burden onto the very people whose data was being exploited.
The company also failed to recognize opt out preference signals, which are browser level settings that automatically communicate a user's desire not to be tracked. Under the CCPA and its implementing regulations, businesses are required to honor these signals as valid opt out requests. PlayOn ignored them entirely.
On top of that, the company did not provide adequate notice of its data practices. Users, many of them minors, had no meaningful way to understand how their information was being collected, shared, or sold before being compelled to accept tracking.
Why Student Data Deserves Stronger Protection
CalPrivacy emphasized that students are a "vulnerable population" who deserve heightened protection under privacy law. The CCPA specifically prohibits the sale or sharing of personal information from consumers aged 13 to under 16 without prior opt in consent, a higher bar than the standard opt out right available to adults. By making tracking acceptance a precondition for ticket access, PlayOn effectively circumvented this protection.
The case is part of a broader pattern. In February 2026, CalPrivacy also issued a $4.5 million fine against National Public Data for security failures that exposed 2.9 billion personal records, and fined Todd Snyder $375,703 alongside Ford Motor Company for making opt out processes unnecessarily difficult. Combined with the PlayOn action, these early 2026 enforcement actions signal a more aggressive posture from California's privacy regulator.
The Growing Problem of Tracking in Schools
GoFan is far from the only platform embedding tracking technology in school related services. A 2025 report from the Electronic Frontier Foundation found that 89% of educational technology products recommended during the pandemic collected data beyond what was necessary for their stated purpose. Many used that data for advertising or shared it with third party brokers without parental knowledge.
The challenge for parents and students is that these platforms are often mandatory. Schools select them, students are required to use them, and opting out means losing access to essential services like event tickets, learning management systems, or college preparation tools. This power imbalance is precisely what privacy laws like the CCPA are designed to address, and why enforcement actions like the PlayOn case matter.
What PlayOn Must Do Now
Under the settlement, PlayOn is required to conduct risk assessments of its data practices, provide clearer disclosures to users about how their information is collected and used, and implement a fully compliant opt out mechanism. The company must also ensure full compliance with the CCPA's special protections for consumers under 16.
For schools still using GoFan, the enforcement action is a reminder to scrutinize the privacy practices of their technology vendors. And for parents and students, it reinforces a difficult reality: the platforms you are told to use may be profiting from your data in ways you never agreed to.
What You Can Do
- Enable Global Privacy Control in your browser to automatically signal opt out preferences to websites
- Review the privacy policies of any school related platforms your family uses
- Ask your school district what data its technology vendors collect and how they use it
- File complaints with CalPrivacy at privacy.ca.gov if you believe a company is violating your privacy rights