Caught in a Privacy Jam: CCPA Opt-Outs Matter in Mobile Gaming

Root of the Matter

• Popular California mobile gaming app company, Jam City, Inc., agreed to a $1.4 million settlement and ongoing compliance obligations with the CA AG for violations of California Consumer Privacy Act's opt-out of "sale" and "sharing" requirements, including disclosing data of children ages 13 to 16 without the affirmative opt-in consent, across its suite of free mobile apps.

Real-World Consumer Moment

You finally find a quick and easy game to download on your phone to scratch that nostalgic Harry Potter itch. It feels perfect. A chance to wander around the Hogwarts world, cast a few spells, and sink back into the magic without a big price tag. You're excited to relive the journey and share the app with your teenage brother so he can join in on the next generation of wizardry.

Sometime later in the day, you check in with him while you're still playing. A few ads pop up on his screen. They look eerily familiar. Isn't that the exact TV series the two of you watched just last night? Suddenly, you're left wondering if the free game was worth the surveillance-driven data trail linked to your streaming history.

Inside the Company

Mobile app developers building this game genuinely love what they do. They want to keep creating, keep the studio running, and solve problems in ways that make players happy. And because most players expect mobile games to be free, the pressure is always there to monetize through personalized in-app advertising. Revenue keeps the dream alive.

Your developer team is working hard but stretched thin. They're racing to finalize an age-gated experience of the app so younger players are protected but aren't shut out from the fun. At the same time, they're juggling tight deadlines for other franchise titles and leadership is pushing hard to launch the game next quarter.

Meanwhile, something heavier awaits. Technical pieces essential to opt-outs, tracking flows, UI updates, backend logic, consent logs, and the maze of integrating third-party software development kits (SDKs) are barely underway. Business wants momentum. Creative wants an immersive experience. Developers want more time. And privacy requirements, despite their importance, seem like another critical task squeezed into an already overloaded roadmap.

Pulse Check for Product & Privacy Teams

• Does your company have a mobile app? What types of data does it collect? Are any of the data used for in-app advertising?

• Have you checked whether your mobile app has an effective method to opt out of the sale and sharing of data?

• How many steps does it take to opt-out? Is it easy to execute?

• How will you continue to monitor compliance? Are there required reviews set with stakeholders on a recurring cadence?

Background

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), regulates covered businesses' "sale" or "sharing" of personal information, including providing consumers with effective opt-out mechanisms.

Jam City, Inc., develops free-to-play mobile app games, such as ones based on major franchises (e.g., Harry Potter, Family Guy, Frozen, and Snoopy). Per the complaint, the mobile app gaming company generates part of its revenue through personalized in-app advertising and purchases. Despite these monetization efforts, Jam City, Inc. did not provide CCPA compliant in-app opt-out methods across 21 of its games.

The CCPA also provides special protections for minors, requiring covered businesses to obtain affirmative opt-in consent from the consumer (ages 13-16) or parent of the consumer (children under 13) before selling or sharing their personal information.

While Jam City, Inc. did include an age gate feature for most of its apps, it failed to maintain it for some of its games. "Child versions" existed where the company did not collect or share personal information with third parties; however, some of the games did not treat users ages 13-16 as minors, and so those minors had their data sold or shared without first obtaining affirmative opt-in consent.

In addition to the $1.4 million civil penalty, the second largest to date following the $1.55 million Healthline Media LLC settlement earlier in July 2025, Jam City, Inc. agreed to remedial measures including:

• providing CCPA compliant opt-out methods in its apps and sites;

• implementation of a compliance monitoring program on the effectiveness of its opt-out mechanisms and efforts to comply with the special rules regarding consumers under the age of 16;

• three years of reporting to the CA AG demonstrating adherence to the settlement terms.

California Attorney General Rob Bonta has repeatedly shown a commitment to enforce the CCPA, with this marking the sixth enforcement action under the nation's leading privacy law. Recently, the CA AG reached a $530,000 settlement with Sling TV in October 2025 for similar allegations regarding effective opt-out mechanisms and children's privacy.

It's also relevant to mention the June 2024 settlement with Tilting Point Media LLC, owner of the SpongeBob: Krusty Cook-Off app, which agreed to pay $500,000 for claims that the company gathered and shared children's data without proper consent.

Uncover Business Blind Spots

• If you operate a mobile app that might target minors, have you ensured there is a child-version of the game?

• How are you age-gating your app? What ages are gated?

• How are you ensuring that the data of underage users isn't disclosed to third parties, or if it is, are there proper consent authorization processes in place? Do you have a recurring compliance check on your mobile app privacy posture?

Consumer Pro Tips

• Not every free-to-play mobile app means completely free. Check the App Privacy section in the App Store or the Data Safety section of the Google Play store for details.

• Have you checked if you wish to share your personal information with the mobile app developer? Do you mind if you start seeing ads that feel like you're being constantly tracked and monitored?

• Do you know how to opt-out of these sales/sharing of your personal information?

• Consider sharing your experience with relevant plaintiff firms or regulatory bodies if you opt out and it fails, or if there is no opt-out at all.

Our Grounded Take

With this settlement marking the sixth enforcement action under the CCPA, there appears to be heightened focus on consumer choice controls, children's data, and mobile app gaming industry compliance.

Businesses would be wise to confirm that their age screening designs fit respective jurisdictional age requirements for minors and implement a robust process to capture consent or parental consent, where required.

A Grounded Reader's Note and Disclaimer:

This material is provided for general information only and is not intended to constitute legal advice. It should not be relied upon as a substitute for obtaining legal advice tailored to your specific circumstances. You should consult with qualified counsel about your individual situation. Certain portions of this blog may be considered attorney advertising. We strive to ensure the information presented is current, complete, and accurate, but mistakes may occur. Grounded Legal Practice, PLLC and its authors make no representations, warranties, express or implied, or guarantees regarding completeness, accuracy, or suitability of this material and assume no responsibility for any errors or omissions.