California Fined a School Ticketing App $1.1M for Tracking Students

What PlayOn Sports actually did

PlayOn Sports operates GoFan, a digital ticketing platform used by thousands of schools across the United States. About 1,400 schools in California alone use it. If you're a student who wants to attend a Friday night football game, the homecoming dance, or a school play, you buy your ticket through GoFan.

Here's where it gets ugly. When students visited the GoFan website, PlayOn loaded third-party cookies, persistent trackers, and metapixels before getting any meaningful consent. To actually access or present their tickets, students had to click 'agree' to tracking. There was no alternative. No paper ticket option. No way to use the platform without surveillance.

PlayOn then used this data - collected from minors - for targeted behavioral advertising. They shared student information with advertising networks. A 15-year-old buying a ticket to see the school play was generating ad revenue for PlayOn without knowing it.

The fake opt-out

Under the California Consumer Privacy Act, companies must provide consumers with a clear way to opt out of the sale or sharing of their personal information. PlayOn's approach was to point users to the Network Advertising Initiative and the Digital Advertising Alliance - external industry groups that most adults have never heard of, let alone teenagers.

This is like telling someone they can opt out of being tracked by writing a letter to a trade association in Washington, D.C. It's technically a link you can click, but it's designed to ensure almost nobody actually does it. California's privacy agency saw right through it.

PlayOn also failed to recognize opt-out preference signals - the Global Privacy Control (GPC) setting that browsers like Firefox and Brave send automatically. If a student's browser was sending a clear signal saying 'don't track me,' PlayOn ignored it.

Why this case matters beyond California

This is the first enforcement action from California's privacy agency that specifically involves student privacy. It sets a precedent that applies far beyond one ticketing platform.

Schools across the country have adopted digital tools at an accelerating pace since 2020. Ticketing, attendance tracking, learning management systems, photo sharing for school events - all of these collect student data. Most parents have no idea what's happening with that data because the platforms are selected by school administrators, not families.

• 1,400 California schools used GoFan. Nationally, the platform serves thousands more.
• Students had no choice. If the school uses GoFan for ticketing, you either agree to tracking or you don't attend the event.
• The fine is just the start. PlayOn must now conduct risk assessments, implement proper opt-out tools, and provide clearer disclosures.

The connection to school photos

The GoFan case is about ticketing, but the same patterns show up in school photo sharing. When a school hires a photographer for picture day, graduation, or a sports event, those photos often end up on platforms that track viewers, require account creation, and collect data from parents and students who just want to see or download photos.

Some school photo platforms embed tracking pixels, require email addresses before showing proofs, or share browsing data with advertising partners. Parents clicking through to see their kid's class photo are generating behavioral data just like students buying football tickets.

The precedent from the PlayOn case applies here too. If you're a platform collecting data from minors or their parents in a school context - and you're not providing real opt-outs or honoring privacy signals - California has now shown it will take action.

What parents should know

Most parents don't get to choose which digital platforms their child's school uses. But you can take some steps to limit the data exposure:

• Enable Global Privacy Control in your child's browser. Firefox, Brave, and DuckDuckGo browser all support GPC. Platforms are legally required to honor it in California, Colorado, Connecticut, and several other states.
• Use a separate email for school platforms. Don't use your primary email or your child's personal email for school ticketing, photo viewing, or event registration.
• Ask the school what data their vendors collect. Schools have a responsibility to vet the platforms they require students to use.
• Check for opt-out options. Look for 'Do Not Sell My Information' links on any platform you're required to use. If there isn't one, that's a red flag.

A better approach to school content sharing

The core problem with platforms like GoFan isn't that they're digital - it's that they monetize captive audiences. Students can't opt out because the school mandates the platform. That's a fundamentally different dynamic than choosing to use Instagram or TikTok.

When it comes to sharing school photos and event content, the right approach is one where viewing doesn't require accounts, trackers, or surrendering personal data. A private link that anyone can open - parents, grandparents, family friends - without creating a profile or agreeing to behavioral tracking.

Viallo was built with this in mind. Recipients view photos through a link. No account needed. No tracking pixels. No ad networks. If a school community wants to share event photos, everyone can access them without handing over data in exchange.

Frequently Asked Questions