Key point: The most recent CCPA enforcement action focuses on the CCPA’s right to opt out of sales and shares and treatment of minor’s data.

On November 21, 2025, the California Attorney General (AG) announced its latest enforcement action for violations of the California Consumer Privacy Act (CCPA). The complaint alleges that a gaming app developer failed to provide a CCPA-compliant opt-out link or setting within any of its 21 apps or website. The complaint also alleges that six of the developer’s apps sold the personal information of consumers between the ages of 13 and 16 without obtaining consent. Pursuant to the final judgment and permanent injunction, the developer agreed to pay $1.4 million, implement corrective measures, and maintain a compliance program.

The settlement is the ninth CCPA public enforcement action, including six by the AG and three by the California Privacy Protection Agency. Seven of the nine enforcement actions are from this year, showing a notable increase in enforcement activity. As with prior enforcement actions, this settlement reinforces that businesses should be auditing their current practices and procedures to ensure that they are compliant and remain compliant.

In the below article, we provide a summary of the violations and penalties.

Background

The defendant is a developer that creates gaming apps for mobile devices. The apps are free-to-play and generate revenue, in part, through in-app advertising. The apps collect personal information such as device identifiers, IP addresses, and users’ interaction with a game, including in-game purchases and how often a user plays the game. The information is used, in part, to target ads to users.

The developer also discloses personal information to third-party companies for advertising and analytics. Those entities use the personal information, as well as personal information collected through other sources, for cross-context behavioral advertising. The entities personally target ads to app users both on the app and on other apps and platforms.

Violations

Right to Opt Out of Sales/Shares

Despite engaging in CCPA sells/shares, the developer allegedly did not provide a CCPA-compliant opt-out link or setting within any of its 21 apps. The developer’s website also did not provide a CCPA-compliant opt-out method. Rather, the only reference in the developer’s privacy policy to the CCPA’s opt-out rights was under a section titled “Cookies and Interest Based Advertising,” where consumers could email the developer to stop targeted advertising.

Sale/Share of Minors’ Data

The CCPA prohibits businesses from selling or sharing the personal information of minors between 13 and 16 years of age without the minor’s consent where the business has actual knowledge or willfully disregards the minor’s age. Here, the app developer age-gated several of its apps. In other words, users had to provide their age when first installing the games. Most of the developer’s apps provided a child version for users under 16 years of age in which the app did not collect or share personal information. However, for six of the apps, the child version only applied for those under 13 years of age, meaning that consumers between 13 and 16 years of age had their personal information sold and shared without the minor’s consent.

Monetary Penalty

The developer agreed to pay a $1.4 million penalty, payable in two equal installments with one payment due in 60 days and the second due in a year.

Injunctive Relief

Opt-Out Provisions

The developer is required to comply with all CCPA provisions relating to providing notices and opt-out rights and, to the extent that it sells or shares personal information, must “implement a consumer-friendly, easy to execute opt-out process.” That includes providing a clear and conspicuous opt-out link within its mobile apps that either immediately effectuates the opt-out request or, in the alternative, directs consumers to a notice of right to opt out.

Of note, when a consumer opts out through a mobile app, the developer must effectuate the opt-out across all of the developer’s apps for any personal information the developer associates with that consumer. The developer also must request the minimal amount of information to process the opt out and provide a mechanism by which a consumer can confirm that they opted out, such as by displaying “Opt-Out Request Honored” on its website and through a toggle or radio button that the consumer has opted out.

The order also states that if the developer “makes available to consumers mechanisms on its websites or mobile applications that offer consumers choices related to the collection of personal information, other than the CCPA required opt-out process, such as a cookie-preference manager, [the developer] shall avoid language or design likely to confuse a reasonable consumer into believing that the other choice(s) (i) constitute a CCPA complaint opt-out method, or (ii) must also be selected to opt-out of selling or sharing.” However, the developer is not prevented “from using the same mechanism to effectuate the CCPA required opt-out and other choices related to the collection of personal information, provided such mechanism is presented in a clear and non-confusing manner consistent with the CCPA.” This is an important takeaway for other businesses who should consider reviewing their opt-out procedures and practices to ensure they are not confusing to consumers and that other consumer choices that they may offer (for example a cookie preference link) are consistent with the CCPA’s requirements.

Minors’ Data Provisions

The developer is required to comply with the CCPA’s restrictions on processing minors’ data. The order also creates requirements for how the developer should implement age screening, including that it must direct minors who are 13, 14, and 15 years of age to a child version of an app or obtain the minor’s consent to sell or share their personal information.

Compliance Program

For a period of three years, the developer must implement and maintain a compliance program to ensure it is complying with the injunctive relief provisions and provide the AG with an annual report.