Jam City CCPA settlement: what did the judgment require?

Jam City makes mobile games, including titles based on Frozen, Harry Potter, and Family Guy. In November 2025 it became the sixth CCPA enforcement action California's Attorney General brought, and the case turned on a gap most app companies still have: the opt-out exists on the web and nowhere else.

What the investigation found

Jam City generates revenue in part through disclosing personal information for advertising. It and its ad-tech partners use information obtained from consumers to display personalized ads inside the games. The California Department of Justice's investigation found that despite collecting and sharing consumer personal information nearly exclusively through its mobile games, Jam City did not offer CCPA compliant opt-outs in any of its 21 mobile apps.

That is the whole of the first allegation, and it is worth sitting with. The problem was not a badly worded link or a slow response. There was no compliant mechanism at all, in the place where the data was actually moving.

The investigation also found that some Jam City games shared or sold the data of children between the ages of 13 and 16 without the affirmative consent the CCPA requires. Under the CCPA, minors under 16 are afforded special protections for the sale of their data.

What the settlement required

In addition to $1.4 million in civil penalties, Jam City must provide in-app methods for consumers to opt out of the sale or sharing of their data. It must also not sell or share the personal information of consumers at least 13 and less than 16 years old without their affirmative opt-in consent.

Both terms track the finding exactly. The remedy for a missing in-app control is an in-app control, and the remedy for teen data moving without consent is a consent gate.

The two lessons that transfer

The first is about surfaces. A CCPA opt-out has to exist where the consumer is. If your product is an app, a footer link on a marketing site does not reach the person who downloaded the app and never visited the site. The same reasoning has appeared repeatedly in California's streaming and connected-TV cases, where the opt-out lived on a website that the living-room viewer never opened.

The second is about age. The CCPA's under-16 rule bites on what you know, and knowing is not always a choice you make deliberately. A game built for a general audience that in practice attracts teenagers still has to deal with the affirmative consent requirement before selling or sharing their data. The safe posture is to decide in advance how you will detect and handle minors rather than discovering the answer during an investigation.

Where this sits in California's enforcement record

Jam City was the sixth CCPA settlement. It came a month after the Sling TV matter and preceded the Disney and General Motors actions that followed in 2026. Read as a sequence, the actions are overwhelmingly about opt-outs that did not work rather than about missing paperwork. The full settlement list sets out each one, and CCPA fines and penalties explains how a per-violation amount compounds across a user base. For the mechanics of the right itself, see Do Not Sell or Share.

Next step

If you ship a mobile app that runs advertising SDKs, the free 2-minute Obligation Scan checks whether the CCPA applies to your business and flags the opt-out, consent, and disclosure duties that attach to the data your app sends out.