California AG Enters Into $1.4M Settlement With Gaming Company Over Opt-Out Failures While EU Proposes Major Digital Rulebook Changes

Want to receive these privacy recaps in your inbox each week? Subscribe here.

California’s Attorney General secured another CCPA enforcement win this week with a $1.4 million settlement with mobile gaming company Jam City, marking the sixth AG action under the state privacy law and highlighting continued regulatory focus on opt-out mechanism failures. Meanwhile, across the Atlantic, the European Commission introduced its final Digital Package—a comprehensive legislative proposal aimed at simplifying and harmonizing the EU’s digital rulebook, including amendments to the GDPR, Data Act, and AI Act.

United States

Gaming Company Hit With Latest AG Enforcement Action Over Opt-Out Failures

The California Attorney General’s Office announced a $1.4 million settlement with Jam City over allegations that the mobile gaming company: 

• sold or shared personal information without providing a CCPA-compliant opt-out process; and 
• sold or shared personal information of consumers known to be between 13 and 16 years of age without obtaining affirmative consent. 

Specifically, Jam City did not provide opt-out links at all on 20 out of its 21 apps. The one app with an opt-out link did not reference the CCPA or clarify whether enabling the control would stop the sale or sharing of consumers’ personal information. Its website also lacked an opt-out link, and its privacy policy only provided an email address for consumers to use to stop targeted advertisements, which the complaint alleged did not, by itself, meet CCPA requirements. 

Several of the apps included an age gate, however, for 6 of those apps, only users who indicated they were under 13 years old received a version that did not collect personal information. Consumers aged 13–16 received the adult version of the apps, which allegedly collected and sold personal information without obtaining consumer consent. 

TAKEAWAY

This is the sixth AG enforcement action under the CCPA and the second against a mobile gaming app involving children’s data. The other four actions targeted a food delivery service, a retailer, a website publisher, and a streaming service, showing the breadth of industries and platforms California AG investigations target. Every one of those actions involved opt-out or consent failures in some form, indicating that the Attorney General’s focus is more on the nature of the violation than the industry or platform involved. 

Europe

European Commission Introduces Digital Package to Simplify AI and Data Rules

The European Commission officially announced its final Digital Package of legislative proposals, which it will submit to the European Parliament and Council for adoption, with an aim “to simplify and make more effective the EU’s digital rulebook.”  The package includes proposed amendments to the Data Act, GDPR, and AI Act, along with changes to cybersecurity incident reporting requirements, a Data Union Strategy with initiatives to unlock data access for AI innovation, and regulation for European Business Wallets to ease secure communication among companies and public authorities. 

TAKEAWAY

Although the package is far from final—it must still proceed through the European Parliament and the Council in the ordinary course, and may undergo substantive amendments—it raises questions about its potential implications for both businesses and consumers. For a deeper dive into the package’s details and important takeaways for companies, see Didomi’s in-depth analysis.  

A LITTLE MORE PRIVACY, IF YOU PLEASE

• CalPrivacy Launches Data Broker Enforcement Strike Force
• CalPrivacy Publishes “7 Things to Know Before 2026 CCPA Updates Take Effect”

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.