California’s privacy watchdog has levied a $1.1 million fine against GoFan, a national high school ticketing platform, for allegedly collecting and selling the personal data of students without proper consent. The California Privacy Protection Agency (CPPA) found that GoFan violated the California Privacy Protection Act (CPPA) through its data collection practices related to ticket purchases for events like football games, proms, and school plays.
The agency’s investigation revealed that GoFan prompted users to agree to terms allowing the company to collect and sell their personal information to advertisers as a condition of purchasing tickets. Students and parents were presented with a mandatory “agree” button, with no option to opt out of data sharing. This practice, according to the CPPA, effectively forced individuals to surrender their privacy in order to participate in school events.
“Students trying to head to prom or a high school football game shouldn’t have to leave their privacy rights at the door,” said Michael Macko, CalPrivacy’s head of enforcement, in a press release. “You couldn’t attend these events without showing your ticket, and you couldn’t show your ticket without being tracked for advertising. California’s privacy law does not work that way. Businesses must ensure they offer lawful ways for Californians to opt out, particularly with captive audiences.”
GoFan, owned by PlayOn, a company that also streams high school sports, allegedly misrepresented its data practices in its privacy policy, claiming it did not sell personal information while simultaneously doing so. The CPPA order also noted that the policy was not updated annually and failed to inform users of their right to opt out of data commercialization, both violations of state law. The investigation began in 2024 following complaints from users, according to the agency.
Data Collection Practices and Violations
The CPPA’s order detailed how GoFan’s software prompted users to accept conditions that allowed the collection and sale of their personal information. This practice occurred between 2023 and 2024, resulting in repeated violations of the California Privacy Protection Act. The law grants California residents the right to grasp when their personal information is collected and to prevent companies from selling it. California residents also have the right to request the deletion of their personal data.
PlayOn has reportedly sold over 30 million tickets to high school events nationwide and maintains contracts with approximately 1,400 schools in California.
PlayOn’s Response and Corrective Measures
PlayOn acknowledged the CPPA’s inquiry and stated that the issues identified related to privacy practices prior to December 2024 have been resolved. The company said it cooperated with the CPPA and took steps to address the agency’s concerns. “PlayOn takes the privacy and safety of the students and school communities we serve very seriously,” the company said in a statement.
This case highlights the growing scrutiny of data privacy practices, particularly concerning the collection of information from minors. The CPPA’s enforcement action sends a clear message to companies that they must prioritize user privacy and provide transparent and lawful options for data control. The agency’s investigation was prompted by complaints from users, demonstrating the importance of individuals asserting their privacy rights.
Looking ahead, it remains to be seen whether other ticketing platforms or companies collecting data from students will face similar scrutiny. The CPPA’s continued enforcement of the California Privacy Protection Act will likely shape the future of data privacy practices in the state and potentially influence national standards. Readers are encouraged to learn more about their data privacy rights and report any suspected violations to the CPPA.
Share your thoughts on this story in the comments below.
