Enforcement Under CCPA: Sling TV Settlement

By: Shivangi Yadav

On January 26, 2024, California Attorney General Rob Bonta (“Attorney General”) announced an investigative sweep targeting streaming applications and devices. The primary focus of the sweep was to ensure streaming services were in compliance with the consumer’s right to opt-out of the sale and share of their personal information including implementation of an easy and understandable mechanism to exercise this right.

Pursuant to this sweep, an investigation was launched into Sling TV LLC, an internet based live TV and media streaming service. As result of the investigation, a formal complaint was filed against Sling TV LLC and Dish Network LLC (collectively “Sling TV”) on October 30, 2025 in Los Angeles Superior Court.

Sling TV Complaint and Settlement

Violations alleged against Sling TV include:

1. Failure to provide consumers an easy way to opt-out of selling and sharing of their personal information: Alleged violations in the complaint included failure to provide separate options to opt-out of sale or share of personal information and cookie preferences, requiring logged in customers to provide their information again to opt out of sale or share of personal information, and failure to provide an opt-out mechanism for Sling TV application requiring consumers visit the website to exercise their right to opt-out.
2. Failure to offer privacy protections for children and minors: The complaint alleged, among other things, failure to provide parents an option to create a “kid’s profile” that turned off sale or sharing of personal information when children were watching, failure to age screen consumers, and failure to review programs designated for children to restrict advertising.

The complaint resulted in a settlement where Sling TV was required to pay a $530,000 fine and comply with the terms of the injunction. As per the injunction, Sling TV is required to, among other things:

1. Provide consumers an easy to find and intuitive link to opt-out of sale or share of personal information on its website, mobile and other applications, ensuring their choice is implemented across all devices with minimal steps.
2. Allow consumers to create a “kid’s profile” designated for children (under 13) and/or minors (13 to 16) with default setting that prevents the sale or sharing of personal information, cross-context behavioral advertising^[i] and display of advertising based on personal information to advertising partners.
3. Maintain a system for programmers to designate their channels for children or minors, annually assess new designations and ensure deletion of personal information collected from consumers known to be children or minors.
4. Implement a three year compliance program ensuring easy opt-out methods and protection of children and minors’ privacy.

Enforcement Trends

The Sling TV settlement is the fifth out of a total of six settlements under CCPA. Previous settlements under CCPA (Healthline.com; Tilting Point Media LLC; DoorDash; Sephora) were also enforcements of consumer’s right to opt-out. These settlements demonstrate an enforcement pattern focused on consumer’s right to opt-out of sale or sharing of their personal information, implementation of Global Privacy Control, and opt-out mechanisms easy for consumers.

Children and minors’ privacy appears to be another area of focus for the Attorney General’s enforcement actions under CCPA. In 2024, Attorney General’s complaint against Tilting Point Media LLC alleged violation of children and minors’ privacy similar to those against Sling TV. In both complaints, the Attorney General is mainly focused on ensuring children are not subject to advertising and that their personal information is not sold or shared by implementing parental consent for children (under 13) and minor consent (13-16) and age screens designed to encourage children and minors to insert their correct age.

.#Another trend observed in these settlements is the broad interpretation of the term “sale.”^[i] In the DoorDash case, the sharing of personal information with a marketing co-operative, was interpreted as a sale. It was construed as a benefit when DoorDash received personal information of consumers from other businesses and considered within the scope of CCPA definition of a “sale.” Similarly, in the Sephora case, exchange of consumer personal information for analytics and advertisement options was interpreted as “sale” under CCPA. While this was not an issue in the Sling TV settlement, it is important to understand the broad interpretation of the term “sale” under CCPA and the scope of activities that could potentially be considered a “sale” which may lead to violations.

Conclusion

The Attorney General’s focus on enforcing the right to opt-out and protection of children’s privacy continues as they announced a settlement on November 21, 2025 with Jam City, a mobile app gaming company. The Consumer Privacy Protection Agency (“CalPrivacy”) is similarly focused on children’ s privacy as they joined the 2025 Global Privacy Enforcement Network sweep to examine websites and mobile applications commonly used by children to ensure their protection. Another area of interest for the Attorney General is location data as an investigative sweep of the location data industry’s compliance with CCPA was announced in March 2025. 

As enforcement actions continue under CCPA, each settlement and enforcement sweep serves as a case study for businesses to evaluate their privacy compliance programs and practices.

---

^{[1] ‘Cross-context behavioral advertising’ means the targeting of advertising to a consumer based on the consumer’s personal information obtained from the consumer’s activity across businesses, distinctly branded internet websites, applications, or services, other than the business, distinctly branded internet website, application, or service with which the consumer intentionally interacts. Cal. Civ. Code § 1798.140(k).}

^{[2] CCPA defines “sale” as means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for monetary or other valuable consideration. Cal. Civ. Code § 1798.140(ad)(1).}