California fines mobile gaming firm $1.4 million for privacy failures

California Attorney General Rob Bonta announced on November 21, 2025 a $1.4 million settlement with mobile app gaming company Jam City, Inc. for violations of the California Consumer Privacy Act. The enforcement action marks the sixth settlement under CCPA since the landmark privacy law took effect, highlighting intensifying scrutiny of mobile applications that collect and share consumer data for advertising purposes.

Jam City creates games for mobile platforms based on popular franchises including Frozen, Harry Potter, and Family Guy. The investigation revealed the company failed to provide CCPA-compliant opt-out mechanisms in any of its 21 mobile applications despite collecting and sharing consumer personal information almost exclusively through these mobile platforms.

The company generates revenue partly through disclosing personal information for advertising purposes. Jam City and its advertising technology partners use information obtained from consumers to display personalized advertisements within Jam City games. Despite this business model relying on consumer data sharing, the California Department of Justice investigation found no compliant opt-out options available in the company's mobile app portfolio.

"Many Californians like to unwind after a long day by gaming on their cell phones. Even on apps, California law obligates companies to provide a way for consumers to opt-out of the sale and sharing of their personal data," Bonta stated in the announcement. "This process should be simple, transparent, and easy to navigate."

The investigation also uncovered that some Jam City games shared or sold data from children between ages 13 and 16 without the affirmative consent required under CCPA. The law affords minors under age 16 special protections for the sale of their data, requiring businesses to obtain explicit "opt-in" consent before selling or sharing personal information from this demographic.

Under the settlement terms, Jam City must provide in-app methods for consumers to opt-out of the sale or sharing of their data. The company cannot sell or share the personal information of consumers at least 13 years old but less than 16 years old without their affirmative opt-in consent. These requirements address fundamental failures in how the company approached privacy obligations across its entire mobile gaming portfolio.

The $1.4 million civil penalty represents substantial enforcement of privacy protections for California consumers. Settlement funds typically support ongoing consumer protection activities by the Attorney General's office, though specific allocation details were not provided in the announcement.

This enforcement action arrives amid California's broader efforts to strengthen consumer privacy rights in the mobile app ecosystem. Following Data Privacy Day on January 29, 2025, Bonta reminded Californians of their right to opt-out of the sale and sharing of their personal information under CCPA. The Attorney General has emphasized Global Privacy Control as an automated browser-based mechanism allowing consumers to signal opt-out preferences without making individualized requests on every website.

Mobile applications present distinct challenges for privacy enforcement compared to traditional websites. Apps often lack the visible "Do Not Sell or Share My Personal Information" links that CCPA requires businesses to display on their websites. This creates compliance gaps where mobile-first companies collect extensive consumer data without providing accessible opt-out mechanisms.

The California Department of Justice investigation found Jam City collected and shared consumer personal information nearly exclusively through mobile games. This business model created obligations to implement in-app opt-out functionality rather than relying solely on website-based mechanisms that mobile app users rarely encounter. The settlement establishes clear expectations that CCPA obligations extend fully to mobile applications regardless of where companies choose to collect consumer data.

Attorney General Bonta has demonstrated sustained commitment to CCPA enforcement across multiple business sectors. In July 2025, the office secured a $1.55 million settlement with Healthline Media LLC, the largest CCPA penalty to date, for failing to allow customers to opt-out of targeted advertising and sharing data with third parties without mandated privacy protections.

Previous enforcement actions targeted streaming services, location data practices, and employee information handling. In October 2025, the Attorney General secured a settlement with Sling TV for failing to provide an easy-to-use method for consumers to stop the sale of their personal information and for failing to provide sufficient privacy protections for children. These cases collectively signal regulatory focus on companies that create friction for consumers exercising privacy rights.

The settlement with Jam City follows a pattern of enforcement targeting companies whose technical implementations fall short of legal requirements. The Department of Justice conducted investigative sweeps in March 2025 into the location data industry, sending letters to advertising networks, mobile app providers, and data brokers appearing to violate CCPA. Similar sweeps addressed streaming apps and devices along with employee information practices.

CCPA establishes comprehensive privacy rights for California consumers, including the right to know how businesses collect, share, and disclose personal information. Consumers can request businesses stop selling or sharing their personal information, with few exceptions. Businesses must wait at least 12 months before asking consumers to opt back into data sale or sharing after receiving opt-out requests.

The law defines "sale" broadly to include disclosing personal information to third parties for monetary or other valuable consideration. This definition captures many advertising technology practices where publishers share user data with advertising networks and demand-side platforms in exchange for advertising revenue. Mobile games frequently employ these monetization strategies, making CCPA compliance essential for the gaming industry.

For minors, CCPA implements heightened protections reflecting concerns about children's limited ability to understand privacy implications. Businesses cannot sell the personal information of consumers under 16 without consent. For consumers between 13 and 16 years old, the consumer must provide affirmative opt-in consent. For consumers under 13, a parent or guardian must provide consent. These requirements impose additional verification burdens on businesses with minor users.

Jam City's failure to implement compliant opt-out mechanisms across its entire mobile portfolio demonstrates compliance gaps common in mobile-first businesses. Many companies built mobile applications before CCPA took effect and have struggled to retrofit privacy controls into existing technical architectures. The settlement establishes that such legacy technical decisions do not excuse current violations.

The mobile gaming industry faces particular pressure to balance user experience with privacy compliance. In-app opt-out mechanisms can create additional screens and interactions that some companies fear might reduce user engagement or increase application abandonment. However, CCPA makes clear that business considerations cannot override consumer privacy rights, requiring companies to implement compliant mechanisms regardless of potential impacts on user metrics.

California's enforcement approach contrasts with the fragmented privacy landscape across other states. While multiple states have enacted consumer privacy laws, California maintains the most aggressive enforcement program. Google has expanded privacy controls to eight additional U.S. states recognizing Global Privacy Control signals, but enforcement mechanisms vary significantly across jurisdictions.

The settlement also highlights gaps between existing privacy tools and mobile platform capabilities. Global Privacy Control functions primarily through web browsers, while mobile applications operate in distinct technical environments. Governor Newsom vetoed Assembly Bill 3048 in September 2024, which would have required mobile operating systems to include system-wide opt-out settings. This veto means mobile app developers must implement individual opt-out mechanisms without platform-level infrastructure support.

Jam City, co-founded by CEO Josh Yguado and former MySpace co-founders Chris DeWolfe and Aber Whitcomb, operates studios across multiple countries. The company's popular role-playing game Harry Potter: Hogwarts Mystery has generated over $500 million in bookings and 135 million installs since launch. Cookie Jam generated over $1 billion in aggregate lifetime bookings. These financial successes demonstrate the commercial value of data-driven advertising models that CCPA regulates.

The company's games have collectively generated over $4 billion in aggregate lifetime bookings and nearly 1.5 billion downloads for hundreds of millions of players worldwide. This scale magnifies the impact of privacy violations, affecting large consumer populations who may be unaware of how their data supports targeted advertising ecosystems.

Industry observers note that CCPA enforcement creates compliance precedents affecting the broader mobile gaming sector. Many gaming companies employ similar business models where advertising revenue depends on sharing user data with third-party networks. The Jam City settlement establishes that mobile platforms cannot serve as justification for incomplete CCPA implementation, pushing the industry toward comprehensive in-app privacy controls.

The timing of this enforcement action may influence other mobile app developers to review their privacy implementations. With CCPA enforcement activity accelerating and penalty amounts increasing, companies face growing pressure to ensure mobile applications provide the same privacy protections required for websites. This could drive broader industry changes in how mobile games approach data collection and sharing practices.

Advertising technology companies also face implications from mobile app enforcement. Many ad tech providers operate across both web and mobile environments, requiring technical capabilities to process opt-out signals regardless of platform. The settlement reinforces expectations that ad tech providers must honor privacy signals from mobile applications, not just traditional websites.

For marketing professionals, the settlement underscores the importance of understanding how advertising partners handle consumer data across all platforms. Advertisers who purchase inventory in mobile games should verify that publishers provide compliant opt-out mechanisms, as regulatory scrutiny increasingly focuses on the entire advertising supply chain rather than individual companies.

Consumers can report CCPA violations to the California Attorney General's office through online complaint forms at oag.ca.gov/report. The Attorney General's office continues accepting complaints about businesses that fail to provide required opt-out mechanisms or that fail to honor opt-out requests after receiving them.

Timeline

• August 2022: Attorney General announced settlement with Sephora for failing to disclose sale of personal information and failing to process opt-out requests via global privacy controls
• February 2024: Attorney General announced settlement with DoorDash for selling customers' personal information without providing notice or opportunity to opt out
• June 2024: Attorney General and Los Angeles City Attorney announced $500,000 settlement with Tilting Point Media LLC for collecting and sharing children's data without parental consent in "SpongeBob: Krusty Cook-Of"
• January 29, 2025: Attorney General reminded consumers of opt-out rights following Data Privacy Day, encouraging use of Global Privacy Control
• March 2025: CCPA investigative sweep into location data industry involved sending letters to advertising networks, mobile app providers, and data brokers
• July 2025: Attorney General secured $1.55 million settlement with Healthline Media LLC, the largest CCPA settlement to date
• October 2025: Attorney General secured settlement with Sling TV for failing to provide easy opt-out method and failing to provide privacy protections for children
• November 21, 2025: Attorney General announced $1.4 million settlement with Jam City for violating CCPA by failing to offer opt-out methods in 21 mobile apps

Summary

Who: California Attorney General Rob Bonta announced a settlement with Jam City, Inc., a mobile app gaming company founded by Josh Yguado, Chris DeWolfe, and Aber Whitcomb that creates games based on franchises including Frozen, Harry Potter, and Family Guy.

What: The $1.4 million settlement resolves allegations that Jam City violated the California Consumer Privacy Act by failing to offer consumers methods to opt-out of the sale or sharing of their personal information across its 21 mobile gaming apps, and by selling or sharing personal information of consumers ages 13-16 without affirmative opt-in consent.

When: The settlement was announced on November 21, 2025, representing the sixth enforcement action under CCPA and part of ongoing enforcement efforts that included investigative sweeps into location data, streaming apps, and employee information practices throughout 2025.

Where: The enforcement action occurred in California under CCPA, the state's landmark privacy law, and affects Jam City's mobile gaming applications available to California consumers through mobile app platforms including those based on popular entertainment franchises.

Why: The settlement addresses violations where Jam City generated revenue through disclosing personal information for advertising purposes while failing to provide CCPA-compliant opt-out mechanisms despite collecting and sharing consumer data almost exclusively through mobile games, including data from minors requiring special consent protections.