Privacy CompliancePrivacy Notices
PlayOn Fined $1.1 Million for Selling Data in Conflict with Its Privacy Notice
Earlier this year, a company that streams high school sports paid $1.1 million in California. Its privacy policy said it did not sell personal information. California's privacy agency found that it did, through the use of ordinary advertising trackers on its websites.
By Alex Proctor
Published September 21, 2026
Summary
California's privacy agency fined PlayOn Sports $1.1 million in February 2026 for selling personal information while its privacy policy said it did not. Notably, these were not traditional sales. They happened through the advertising and analytics tools on PlayOn's websites, which sent visitor data to third parties in a way California law treats as a sale. Regulators test each claim in a privacy notice against what the business does, so any notice that says "we do not sell" deserves the same test against California's broad definition of a sale.
What Did the Agency Find?
PlayOn Sports is the parent company of GoFan, MaxPreps, and the NFHS Network. If you have a kid in high school sports, you may know them, because they stream the games and sell tickets. About 1,400 California schools use its services.
The California Privacy Protection Agency looked at PlayOn's activity in 2023 and 2024. The order says PlayOn's websites collected personal information through cookies and tracking technologies such as the Meta Pixel. It says PlayOn then sold and shared that information with advertising, social media, and analytics partners. It also says the websites did not recognize opt-out preference signals, which California already requires businesses that sell or share data to honor.
Meanwhile, the privacy policy indicated otherwise. It had not been updated since July 2022, and it claimed that PlayOn did not sell consumers' personal information. The table lists the notice findings with the rule the order cites for each.
| What the agency found | Rule cited in the order |
|---|---|
| Went 19 months without a policy update | Civ. Code § 1798.130(a)(5) |
| Omitted the right to opt out of sharing | 11 CCR § 7011(e)(3)(C) |
| Claimed that PlayOn did not sell data | 11 CCR § 7011(e)(3)(C) |
| Left out how opt-out signals are processed | 11 CCR § 7011(e)(3)(F) |
| Left required details out of its opt-out link | 11 CCR § 7013 |
| Sold data collected with no opt-out notice | 11 CCR § 7013(h) |
From paragraphs 56 to 60 of the order. PlayOn neither admitted nor denied these findings.
Why Do Advertising Trackers Count as a Sale?
Most companies assume that "selling" personal data requires an exchange of money. While unintuitive, this is not the case in most states with privacy laws, including California. California's statute defines a sale as an exchange of personal information for "monetary or other valuable consideration." It also covers "sharing" for cross-context behavioral advertising, whether or not money changes hands.
The broader definition of a sale tends to include online advertising, where the tools rarely involve a payment for data. The website gets a service, such as ad targeting or measurement, and the vendor gets visitor data that it can use for its own purposes. That exchange is the non-monetary valuable consideration that constitutes a sale. California's Attorney General applied the same reading to Sephora in 2022, and the privacy agency later applied it to PlayOn.
Unfortunately, the states with comprehensive privacy laws do not define a sale consistently. Most states followed California's definition. Six did not. However, these six states still regulate targeted advertising separately.
| A sale is an exchange for | States |
|---|---|
| Money or other valuable consideration | California, Colorado, Connecticut, Delaware, Florida, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Texas |
| Money only | Indiana, Iowa, Kentucky, Tennessee, Utah, Virginia |
The 20 comprehensive state privacy laws in force, as of September 2026.
PlayOn is not an advertising business, and nothing unusual was running on its websites. The order notes that it ran only one targeted advertising campaign on its ticketing platform in two years. Many sites run the same types of tags. Its cookie banner told visitors that the information collected "is shared with our advertising, social media, and analytics partners," yet the privacy policy linked from that same banner said the company did not sell personal information.
Did Fixing the Policy Help PlayOn?
Not enough to avoid the fine. PlayOn revised its policy in February 2024 and overhauled its website, banner, and policy in December 2024, before it had heard from the agency. The agency credited that work in the order, fined the company anyway, and added an ongoing duty. PlayOn has to scan its websites at least quarterly to keep a current inventory of its tracking technologies.
Is PlayOn an Outlier?
No. In May 2026, General Motors agreed to pay $12.75 million to California, which alleged that GM's privacy policy said it did not sell driving or location data while that data went to two data brokers. In August 2026, TaxAct paid $275,000 to Connecticut. The state said TaxAct's notices promised to prohibit third parties from sharing its data, while its contract with Meta put no limit on Meta's own use of it.
Private claimants compare the notice with the website in the same way regulators do. A demand letter often quotes a sentence from the privacy notice and sets it against a record of what the website sent to third parties. Broad statements like "we respect your privacy" are rarely the sentence quoted, while "we do not sell your data" often is. TaxAct paid a private class $14.5 million before it paid Connecticut anything.
What Does an Accurate Statement Look Like?
An accurate statement depends on what the website does, so the facts have to be established before the notice is drafted and published. A business needs to know whether any personal information reaches an advertising, social media, or analytics partner in exchange for something of value. If it does, the notice should not say that the business does not sell or share data.
When the statement and the website do not match, the business can change the practice or change the notice. Either one resolves the mismatch. The statement also has to be rechecked when the website changes, because a sentence that was true when written can become false when marketing adds a single tag.
Questions
Do advertising pixels count as selling personal information?+
Often. California and 13 other states define a sale as an exchange of personal information for money or other valuable consideration, and the service a website receives from an advertising or analytics vendor can be that consideration. Six states limit a sale to an exchange for money. The agency found that PlayOn's use of tracking technologies such as the Meta Pixel was a sale, even though PlayOn ran only one targeted advertising campaign in two years.
Does this apply to a company outside California?+
It can. California's privacy law covers a for-profit business of a certain size that handles California residents' personal information, wherever the business is located. Thirteen other states define a sale the same way. The FTC can also treat an inaccurate privacy notice as a deceptive statement, and that authority has no size threshold.
Does fixing the privacy policy end the exposure?+
Not by itself. PlayOn revised its policy in February 2024 and overhauled its website and banner in December 2024, before it had heard from the agency, and the fine followed anyway. California's regulations also bar selling or sharing the information collected while no opt-out notice was posted, unless the consumer consents.
Briefings are informational and do not constitute legal advice.
Is your privacy notice accurate?
I'll check what it says against what your site does.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.