The California Privacy Protection Agency has fined technology company GoFan $1.1 million for stealing and selling data from high school students across the state who used the service to sign up for events including football games, school plays and graduation parties.
Before signing up for school events, software from GoFan (a ticketing business owned by PlayOn, a media company that broadcasts high school sports games) prompted users to agree to terms, including allowing the company to collect users’ personal information and sell it to advertisers. Users could only proceed to purchase their tickets by pressing the white “accept” button. They did not have the option to opt out.
The CPPA’s Feb. 27 order said GoFan’s heavy-handedness led to repeated violations of the California Privacy Protection Act in 2023-24. The law gives state residents the right to know that their private information has been collected and allows them to prevent companies from selling that information.
“Students trying to go to prom or a high school football game should not have to leave their privacy rights at the door,” Michael Macko, CalPrivacy’s chief compliance officer, said in a news release. “You couldn’t attend these events without showing your ticket, and you couldn’t show your ticket without being tracked for advertising. California privacy law doesn’t work that way. Companies need to make sure they offer legal ways for Californians to opt out, particularly with captive audiences.”
The law requires companies to offer at least two ways to opt out of the sale of your information. California residents have the right to force companies to delete their personal data.
The company also falsely told users in a privacy policy on its website that it did not sell their personal information, the order says. The policy was not updated annually or informed users of their right to opt out of the collection of marketed personal data, which violated state law.
The CPPA first began investigating PlayOn in 2024, according to the order. The agency received complaints from users during the course of the investigation. PlayOn began reviewing its privacy policies before becoming aware of the investigation.
“PlayOn takes the privacy and security of the students and school communities we serve very seriously,” the company said in a statement. “The CPPA’s recent investigation focused on certain aspects of PlayOn’s privacy practices prior to December 2024, and those matters have since been fully resolved… Throughout the review process, we worked cooperatively with the CPPA and took additional steps to address their concerns.”
PlayOn has sold more than 30 million tickets to high school events nationwide, according to the order. The company has contracts with 1,400 schools in California.
