The California Privacy Protection Agency has fined tech company GoFan $1.1m for swiping and selling data from high school students across the state who used the service to sign up for events including football games, school plays and senior prom.
Before signing up for school events, software by GoFan – a ticketing business owned by PlayOn, a media company that streams high school sports games – prompted users to accept conditions, including allowing the company to collect users’ personal information and sell it to advertisers. Users could only proceed to buy their tickets if they hit a white “agree” button. They did not have the option to opt out.
The 27 February CPPA order said GoFan’s strong-arming led to repeated violations of the California Privacy Protection Act in 2023-24. The law gives the state’s residents the right to know that their private information has been collected and allows them to block companies from selling that information.
“Students trying to go to prom or a high school football game shouldn’t have to leave their privacy rights at the door,” Michael Macko, CalPrivacy’s head of enforcement, said in a press release. “You couldn’t attend these events without showing your ticket, and you couldn’t show your ticket without being tracked for advertising. California’s privacy law does not work that way. Businesses must ensure they offer lawful ways for Californians to opt out, particularly with captive audiences.”
The law requires companies to offer at least two ways to opt out of having their information sold. California residents have the right to force companies to delete their personal data.
The company also falsely told users in a privacy policy on its website that it did not sell their personal information, the order says. The policy was not updated annually, nor did it inform users about their right to opt out of commercialized personal data collection, both of which violated state law.
The CPPA first began investigating PlayOn in 2024, according to the order. The agency received complaints from users during the course of the investigation. PlayOn started revising its privacy policies before becoming aware of the investigation.
“PlayOn takes the privacy and safety of the students and school communities we serve very seriously,” the company said in a statement. “The CPPA’s recent inquiry was focused on certain aspects of PlayOn’s privacy practices prior to December 2024, and those matters have since been fully resolved … Throughout the review process, we worked cooperatively with the CPPA and took additional steps to address its concerns.”
PlayOn has sold more than 30m tickets to high school events nationwide, the order says. The company has contracts with 1,400 schools in California.
