California reached a historic settlement with Disney under its state privacy law, requiring the company to pay $2.75 million and implement changes to its opt-out policies. The settlement stems from a 2024 investigation in which the state found that Disney did not allow consumers to fully opt out of data sharing and sales, in violation of state law. The civil penalty is the largest California Consumer Privacy Act (CCPA) settlement in state history.
According to the investigators’ discovery, Disney did not stop selling consumers’ data across all devices connected to the account and continued sharing data with third-party ad companies.
Under the settlement, Disney is to “implement a consumer-friendly, easy to execute opt-out process that allows CONSUMERS to opt-out with minimal steps, including through use of an OPT-OUT PREFERENCE SIGNAL consistent with applicable obligations under the CCPA, on DISNEY STREAMING SERVICES.”
“Consumers shouldn’t have to go to infinity and beyond to assert their privacy rights. Today, my office secured the largest settlement to date under the CCPA over Disney’s failure to stop selling and sharing the data of consumers that explicitly asked it to,” California Attorney General Rob Bonta said in a statement. “California’s nation-leading privacy law is clear: A consumer’s opt-out right applies wherever and however a business sells data — businesses can’t force people to go device-by-device or service-by-service. In California, asking a business to stop selling your data should not be complicated or cumbersome. My office is committed to the continued enforcement of this critical privacy law.”
In a separate case, Disney will pay $10 million in civil penalties after violating children’s online privacy. The matter surrounds the company’s YouTube content. According to the complaint, Disney failed to designate its YouTube content as directed towards children, which led to targeted advertising and the unlawful collection of children’s data without parental consent.
