On March 3, 2026, the California Privacy Protection Agency announced a $1.1 million settlement with 2080 Media, Inc. d/b/a PlayOn Sports, a high school sports events management platform, to resolve alleged violations of the California Consumer Privacy Act. Below are our key takeaways from the settlement:

1. Deterrence Over Remediation. 

PlayOn had proactively identified and resolved issues with its privacy policy, notice banners, and website practices in December 2024, prior to being contacted by the Enforcement Division. Where earlier enforcement efforts focused on bringing businesses into compliance, PlayOn represents a shift toward industry-wide deterrence. CalPrivacy imposed a $1.1 million penalty despite the business’s previous remediation, demonstrating that subsequent fixes may not excuse prior violations, even where compliance was not spurred by regulatory inquiry.

2. Student Privacy Remains in Focus.

Last November, the California Attorney General's Office joined a $5.1 million multistate enforcement action against Illuminate Education for alleged failures to safeguard student data. CalPrivacy has made clear that heightened regulatory scrutiny of this area will continue. PlayOn’s platform is used by approximately 1,400 California schools for ticketing and streaming, and CalPrivacy alleged that students and parents were forced to “agree” to tracking technologies to access tickets they had already purchased. Regulators characterized students as a “uniquely vulnerable population” and criticized the practice of requiring users to agree to tracking to participate in school events. While this action undoubtedly puts businesses in or around the education space on high alert, this “captive audience” framework could readily be applied to many other business practices.

3. Risk Assessments as an Enforcement Tool.

Among the injunctive terms, PlayOn must conduct risk assessments required by the new CCPA regulations. This is the first action to explicitly reference this obligation. Despite the 2028 deadline to submit risk assessment reports, the requirement to conduct risk assessments began on January 1^st of this year. CalPrivacy will likely continue to utilize this requirement as an enforcement tool. Notably, however, these terms go beyond the requirements in the regulations in a few ways:

4. Focus on Minors Without Opt-In Allegations

While this action involved a significant number of consumers aged 13-15, the core allegations focused on the failure to provide an effective opt out for all users and to honor opt-out preference signals. CalPrivacy did not specifically allege a failure to obtain affirmative opt-in consent for minors, as is required by the CCPA. However, the final order explicitly mandates PlayOn to implement and maintain compliant opt-in procedures for minors going forward. The agency will continue to monitor age-specific consent requirements, even when they may not form the basis of the penalty.

5. Industry Opt-Out Tools are Insufficient

The settlement clarifies that businesses cannot satisfy their CCPA obligations by redirecting consumers to third-party industry tools. PlayOn allegedly instructed consumers to exercise their opt-out rights via the Network Advertising Initiative and Digital Advertising Alliance, rather than providing a direct, business-specific opt-out mechanism. Just as many previous enforcement actions centered on a business’s reliance on faulty vendor tools, industry association tools can pose similar risks if not properly configured. With regard to the two parties named in the order: the NAI sunset its opt-out tools last year, and the DAA’s opt-out tool remains a questionable means of compliance.