California AG Secures $1.4M Settlement Against Mobile Game Developer for Alleged CCPA Violations

California Attorney General (AG) Rob Bonta announced a $1.4 million settlement with mobile game developer Jam City Inc. on Nov. 21, 2025, resolving allegations that the company violated the California Consumer Privacy Act (CCPA) and California's Unfair Competition Law (UCL). The complaint and judgment detail how Jam City allegedly failed to provide compliant methods for consumers to opt out of the "sale" and "sharing" of their personal information, on both Jam City's mobile applications and its website, and violated special protections for minors' data.

Background

This is the second enforcement action announced by the AG in less than a month and emphasizes again the AG's focus on consumer choice architecture. In October 2025, the AG settled with Sling TV for allegedly employing a "deceptive" user interface design that directed consumers to cookie preferences instead of comprehensive opt outs. Both settlements also focused on children's privacy requirements, noting the CCPA's stricter requirements around consent for the "sale" or "sharing" of the personal information of minors under age 16.

Factual Allegations

Jam City develops and operates free-to-play mobile games, including popular titles based on well-known entertainment franchises. The company's games are available through app stores and generate revenue primarily through in-app purchases and advertising.

According to the complaint, Jam City's alleged violations centered on two main areas:

• Inadequate Opt-Out Processes. Most Jam City apps provided no mechanism for consumers to opt out of data "sales" or "sharing." One app offered a "Data Privacy" control, but it did not expressly reference the CCPA. It was also unclear whether enabling the control would stop data sharing when used. Even Jam City's website did not include a CCPA-compliant opt-out method: It did not have the required opt-out link, and the one method for opting out of targeted advertising referenced in its privacy policy was to email Jam City, which the complaint explained did not, by itself, satisfy the CCPA.
• Protection of Minors. The CCPA requires consent to sell personal information for consumers under age 16, which typically requires companies with child end users to alter personalized advertising practices for such users. Jam City used an age gate to identify the ages of users but allegedly did not consistently apply protections based on the input. Though some games offered a child experience for users under age 16 that blocked data "sales," in six games, users between ages 13 and 16 were not directed to the child experience, resulting in "sales" of their personal information.

Alleged Violations of Law

The complaint alleged that Jam City committed the following violations of law:

1. Violation of the CCPA (Cal. Civ. Code § 1798.100 et seq). For "selling" and "sharing" consumer information without providing a compliant opt-out process and "selling" minors' data (ages 13 to 16) without obtaining opt-in consent.
2. Violation of the Unfair Competition Law (Cal. Bus. & Prof. Code § 17200 et seq). Through its violations of the CCPA.

Consequences for Jam City

Under the settlement judgment, Jam City agreed to:

• pay a $1.4 million civil penalty
• provide opt-out mechanisms in compliance with law, including clear and conspicuous opt-out links on both its mobile applications and website
• implement compliant methods for age screening that do not default to ages 16 or over and do not suggest features will be unavailable to individuals who indicate they are under 16; Jam City will provide "child versions" of the applications to all individuals under 13 and individuals between 13 and 16 who do not consent to the "sale" of their personal information
• implement a comprehensive compliance program to assess and monitor the effectiveness of its opt-out mechanisms and ensure adherence to obligations related to minor users
• submit to monitoring and reporting requirements for three years, including providing regular compliance reports to the California AG's office demonstrating adherence to the settlement terms

Implications

Although the settlement does not break substantially new ground, it reemphasizes the California AG's focus on CCPA fundamentals such as opt-out mechanisms. It also shows that the AG is willing to push for more significant monetary settlements ($1.4 million in this case, compared to $530,000 for Sling TV) where a business does not make any obvious effort to implement required controls.

Another feature highlighted in the complaint is ensuring that age screening features are implemented properly. Regulators may infer knowledge of a consumer's age if an age gate or other similar feature is used. If the business using that feature does not then ensure that information is used to address CCPA-required controls, regulatory scrutiny may follow.

For more information or questions, please contact the authors.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.