California Privacy Protection Agency Issues First Decision Involving Violation Of CCPA And Minor Students

The California Privacy Protection Agency Board last week announced the agency's first decision involving students and California schools. The decision required PlayOn Sports, a company that sells tickets to high school athletic events, to pay a $1.10 million dollar fine for forcing consumers to agree to tracking technologies without providing a sufficient procedure for opting-out of these technologies. Even though PlayOn Sports did provide an opt-out through the Network Advertising Initiative and Digital Advertising Alliance, the Board found that these mechanisms were not enough because PlayOn had to provide its own opt-out method. In addition, the decision noted that PlayOn Sports failed to recognize the opt-out preference signals and did not provide Californians with sufficient notice of its privacy practices.

While the decision did not find that PlayOn sports violated any of the special protections provided to teens or children under California law, it did note that teens may need to be treated differently. In particular, the decision stated that notices "must be easy to read and understandable to consumers who use its services, taking into consideration the age of the intended audience of such services." The decision gave the example that the notices may have to be modified for high school events to make them easier to understand for the "attendees of those events."

This decision is similar to the settlement in February in which the California Attorney General alleged a major entertainment and media company violated the CCPA by not allowing consumers to completely opt out and stop all sale or sharing of their data. The case settled for $2.75 million — the largest CCPA settlement in California history. While the allegations did not relate specifically to a child or minor's opt-out request, the settlement specifically noted that the company "shall continue to not sell or share the Personal Information of consumers it has actual knowledge are Children or Minors unless the Minor or Parent, in the case of a Child, has affirmatively authorized such selling or sharing[.]"

PRACTICE TIP: For those with a general audience website that may have minor or teen users, California appears to be taking a closer look at your privacy practices — both those related to children and minors and those related to adults. Other attorneys general may be taking note. Therefore, you should review all of your privacy practices to ensure that they comply with the ever-changing state privacy laws.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.