Loading story…
Disney has agreed to pay a $10 million settlement following allegations that it violated the Children’s Online Privacy Protection Act (COPPA) by failing to properly label thousands of its YouTube videos as directed at children. This mislabeling allowed Disney and its partners to collect personal data from children under 13 and serve them targeted advertisements without obtaining parental consent, actions that are explicitly prohibited under COPPA. The Federal Trade Commission (FTC) initially investigated the case before referring it to the Department of Justice (DoJ), which announced the settlement and emphasized the importance of protecting children’s privacy online.
The settlement highlights the ongoing regulatory scrutiny of large content providers on platforms like YouTube, especially regarding compliance with child privacy laws. YouTube had previously updated its policies to require content creators to label videos as "made for kids" or not, following its own record $170 million COPPA settlement in 2019. The Disney case underscores the legal and financial risks for companies that fail to adhere to these requirements, reinforcing the government’s commitment to enforcing parental rights and safeguarding children’s data online.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
After its investigation, the FTC unanimously voted to refer the case to the US Department of Justice for enforcement over alleged violations of the Children's Online Privacy Protection Act related to Disney's YouTube content.
The Department of Justice announced that Disney agreed to pay a $10 million civil penalty to resolve allegations that it violated COPPA by mislabeling child-directed YouTube videos. The settlement also requires Disney to implement a compliance program, review videos for proper labeling, and notify parents and obtain consent before collecting personal information from children under 13.
The Federal Trade Commission investigated Disney over allegations that it improperly labeled child-directed YouTube videos as not made for kids, enabling targeted advertising and unlawful collection of children's data without parental consent.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Disney agreed to pay **$2.75 million** to settle allegations by the California Attorney General that it violated the **California Consumer Privacy Act (CCPA)** by making it difficult for consumers to opt out of the sale/sharing of their personal data. California alleged Disney’s opt-out mechanisms contained gaps that prevented users—including those logged into their accounts—from fully stopping data sharing across Disney’s services, devices, and platforms, and that data continued to be shared with **third-party ad-tech companies** whose code was embedded in Disney websites and apps. The settlement (pending court approval) requires Disney to implement a more comprehensive privacy program and provide California officials a **compliance update within 60 days** describing changes made to align with CCPA requirements. State officials characterized the penalty as the **largest fine to date under the CCPA**; Disney did not admit liability as part of the agreement and said it continues to invest in privacy protections across its streaming services.
Jun 29, 2026
TikTok and its parent company **ByteDance** agreed to a **$400 million** settlement with the U.S. Department of Justice over allegations that the platform violated children's privacy law, including requirements under the **Children’s Online Privacy Protection Act (COPPA)**. The case stemmed from a 2024 lawsuit, and the DOJ described the resolution as one of the largest settlements reached in a COPPA-related matter. Under the agreement, TikTok will pay **$300 million immediately** and an additional **$100 million** after a prior consent decree involving TikTok predecessor **Musical.ly** is vacated. Justice Department officials said the settlement also reflects changes TikTok has made to ownership, management, compliance, privacy practices, age controls, and parental oversight aimed at improving protections for children and families.
Aug 26, 2026
A Los Angeles jury found **Meta** and **YouTube** liable in a landmark lawsuit brought by a 20-year-old woman identified as `K.G.M.`, ruling that social media platforms can be addictive and that their design contributed to mental health harm she says began while using the services as a minor. Jurors awarded **$3 million** in damages, assigning **70%** of the payment to Meta and **30%** to YouTube, after concluding the companies were negligent; deliberations on punitive damages were still continuing. The case focused on features such as infinite scroll and exposure that allegedly fueled depression and suicidal thoughts, and the verdict is expected to bolster thousands of similar claims against Meta, YouTube, TikTok, and Snap. A separate New Mexico case also recently ordered Meta to pay **$375 million** over alleged failures tied to child safety and sexual exploitation risks on its platforms. In Australia, pressure on major platforms intensified as the country’s online safety regulator opened investigations into possible violations of the national ban on social media use by children under 16. eSafety Commissioner **Julie Inman Grant** said some companies may not be doing enough to comply with the law despite initial measures, naming **Facebook, Instagram, Snapchat, TikTok, and YouTube** as platforms of concern. Together, the court ruling in the United States and the Australian probe underscore growing legal and regulatory action against social media companies over platform design, child safety, and protections for minors.
Jun 29, 2026