Overview
On November 21, 2025, Attorney General Rob Bonta announced a settlement with Jam City, filed in the Superior Court of the State of California. Jam City is a mobile-app gaming company known for developing popular games based on major franchises such as Frozen, Harry Potter, and Family Guy. The settlement resolved allegations that the company violated provisions of the California Consumer Privacy Act (CCPA), specifically by failing to provide a clear and accessible opt-out mechanism for consumers in any of its 21 mobile apps regarding the sale or sharing of their personal information, and by mishandling the personal information of users aged 13–15 without obtaining the required affirmative consent for minors under the CCPA.
Penalties and Compliance Mandate
Under the settlement, Jam City was directed to pay $1.4 million in civil penalties and comply with CCPA requirements, including providing clear opt-out mechanisms across all apps and implementing special rules for sharing and selling minors’ personal information, as detailed below:
- The company is required to implement a “clear and conspicuous opt-out link” on its website and across all mobile apps. This link must either immediately let users "opt out" of the sale or sharing of their personal information, or direct them to a "notice of right to opt out" under the CCPA, which includes an easy-to-use and non-confusing method such as a toggle or checkbox.
- The notice of the right to opt out must request only the minimal personal information needed and be designed to fit the website or app without making it harder for consumers to opt out.
- Opt-out choices made by a consumer must be applied across all of the company’s apps. The company must provide confirmation to consumers that their opt-out choice has been processed and “honored” via a visible indicator.
- Compliance with CCPA provisions and special rules concerning consumers under 16 years of age must be implemented by the company.
- If an age-screening mechanism is implemented in its apps, the company must ensure it is neutral (not defaulting to 16+ or restricting features for younger users) and must not collect personal information before verifying age, except as permitted by law.
- Consumers under 13 years of age must be directed to a child-version of the app. Consumers aged 13-15 years must either be directed to the child-version or provide “affirmative authorization” to sell or share their personal information.
- Company must direct all third-parties to whom personal information of consumers under 16 years was sold to delete that data.
- Under the compliance program, the company must document the implementation of the above requirements and provide an annual report to authorities for three years from the effective date.
Key Takeaways
The Jam City settlement demonstrates the ongoing commitment of California authorities to the effective enforcement of the CCPA, particularly in holding mobile gaming companies accountable and protecting consumers’ privacy rights. Companies are expected to provide clear, simple, and easy-to-use ways for consumers to opt out of the sale or sharing of personal data, rather than hiding the opt-out process in complex documentation or asking consumers to opt out via request emails. It should be straightforward and easily accessible. This settlement sends a strong message that businesses must actively implement consumer-friendly architecture to handle personal information, or face enforcement actions.
Read the full judgment here↗
Authored by: Sonali Mishra
Email: sonalimishra.mac@gmail.com
Add comment
Comments