Right on the heels of the California Attorney General’s recent privacy settlement with Disney, the California Privacy Protection Agency (a.k.a., CalPrivacy) has announced a $1.1 million settlement with PlayOn Sports for violations of the California Consumer Privacy Act (CCPA).

PlayOn Sports is an online platform that provides digital ticketing services, video streaming, fundraising, and more for school sports and other events. It is widely used, having contracts with over 1,400 schools in California alone.

Let’s dig into CalPrivacy’s case against PlayOn Sports.

Failure to Properly Implement Opt-Outs

Under the CCPA, as with other state privacy laws, consumers have the right to opt-out of the selling and sharing of their personal information. Businesses must offer easy online methods for submitting opt-outs, including links in the footers on their websites and respecting opt-outs via Global Privacy Control.

According to the settlement order, PlayOn Sports was using tracking technologies on its platform for the purposes of targeted advertising (i.e., “sharing”). However, it did not respect GPC opt-outs and did not offer an online method for opting out. Instead, it had a banner that informed consumers of the use of these technologies and forced them to accept these terms in order to use the platform. It did apparently offer an email address and toll-free phone number for submitting opt-outs, but these fell short of CCPA requirements.

For other businesses, here are some key takeaways on opt-outs:

• GPC opt-outs are mandatory, and regulators are closely scrutinizing compliance with this rule.
• You must offer an online opt-out method if your business sells and/or shares personal information online. An email address or phone number is not enough, especially since there is no way to opt-out a consumer’s device or browser using those methods.
• If you use an informational banner on your site or app detailing your use of tracking technologies, you should provide an opt-out link within the banner.

Check Your Privacy Policy’s “Last Updated” Date

It’s a minor issue, but one that many businesses overlook: CCPA regulations require businesses to update their privacy notices at least once a year. In the PlayOn Sports settlement, CalPrivacy specifically calls out the company for not updating its privacy policy frequently enough.

In this case, PlayOn Sports did not update its privacy policy from July 2022 to February 2024. Given that this is only a period of 19 months, it’s interesting that CalPrivacy made an issue of it.

PlayOn Sports Had Already Fixed These Problems

A striking aspect the settlement was that, after CalPrivacy had started its investigation but before the agency had contacted the company, PlayOn Sports had already substantially resolved the compliance issues on its own. Despite this, CalPrivacy continued with its investigation and levied a large fine against PlayOn.

This should serve as a stern warning to businesses that think they will be given a chance to fix any compliance shortfalls after a regulator contacts them. CalPrivacy didn’t cut PlayOn Sports any slack, and they had fixed the problems before they even knew they were being investigated.

Stop Putting Off Compliance

The CCPA has been in effect for several years already, and regulators are not giving businesses the benefit of the doubt. If they see signs of non-compliance, they will actively enforce the law. 

Smaller companies often meet the processing thresholds for privacy laws like the CCPA, but they don’t always have the internal expertise or even the time to handle compliance on their own. TrueVault makes comprehensive privacy compliance achievable and affordable for organizations of all sizes. 

Using our guided workflows and automated integrations, you can quickly create a data map, publish privacy notices, be prepared to handle consumer requests, and more. Anyone can do it—no legal background required. Best of all, as new state laws are passed or old laws are amended, those changes are incorporated into your privacy dashboard at no extra cost!

Contact our team today to learn how TrueVault can help your business get compliant.