Loading story…
Disney agreed to pay $2.75 million to settle allegations by the California Attorney General that it violated the California Consumer Privacy Act (CCPA) by making it difficult for consumers to opt out of the sale/sharing of their personal data. California alleged Disney’s opt-out mechanisms contained gaps that prevented users—including those logged into their accounts—from fully stopping data sharing across Disney’s services, devices, and platforms, and that data continued to be shared with third-party ad-tech companies whose code was embedded in Disney websites and apps.
The settlement (pending court approval) requires Disney to implement a more comprehensive privacy program and provide California officials a compliance update within 60 days describing changes made to align with CCPA requirements. State officials characterized the penalty as the largest fine to date under the CCPA; Disney did not admit liability as part of the agreement and said it continues to invest in privacy protections across its streaming services.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
Disney agreed to a $2.75 million settlement with the California Attorney General over alleged CCPA violations tied to ineffective opt-out mechanisms. The settlement, pending court approval, also requires Disney to implement a comprehensive privacy program and submit a compliance update within 60 days followed by recurring progress reports every 60 days until all services meet CCPA requirements.
By February 2026, California had initiated its second enforcement action against Disney in five months, alleging Disney's CCPA opt-out tools failed to fully stop the sale and sharing of personal data across accounts, devices, services, and platforms. Investigators said data could still be shared with third-party ad-tech companies even after users submitted opt-out requests.
In September 2025, the U.S. Federal Trade Commission fined Disney $10 million for child privacy violations. This was a separate federal privacy enforcement action referenced alongside the later California case.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Disney has agreed to pay a $10 million settlement following allegations that it violated the Children’s Online Privacy Protection Act (COPPA) by failing to properly label thousands of its YouTube videos as directed at children. This mislabeling allowed Disney and its partners to collect personal data from children under 13 and serve them targeted advertisements without obtaining parental consent, actions that are explicitly prohibited under COPPA. The Federal Trade Commission (FTC) initially investigated the case before referring it to the Department of Justice (DoJ), which announced the settlement and emphasized the importance of protecting children’s privacy online. The settlement highlights the ongoing regulatory scrutiny of large content providers on platforms like YouTube, especially regarding compliance with child privacy laws. YouTube had previously updated its policies to require content creators to label videos as "made for kids" or not, following its own record $170 million COPPA settlement in 2019. The Disney case underscores the legal and financial risks for companies that fail to adhere to these requirements, reinforcing the government’s commitment to enforcing parental rights and safeguarding children’s data online.
Jun 29, 2026
A U.S. congressional investigation by the Joint Economic Committee’s Democratic minority estimated that identity theft tied to breaches at **four major data brokers** has cost American consumers roughly **$20 billion**, and highlighted how some brokers obscured legally required “opt-out” pages (including use of `no-index` tactics that made deletion/opt-out pages harder to find). The report, prompted by investigative reporting, said several large brokers subsequently engaged with congressional staff and changed practices to make it easier for consumers to control the collection and sale of their personal data. California regulators separately escalated enforcement of opt-out requirements under state privacy law, with the **California Privacy Protection Agency (CPPA)** fining **PlayOn Sports** **$1.1 million** over allegations that its *GoFan* ticketing platform used tracking technologies for targeted advertising without providing a compliant, easy-to-use opt-out mechanism. The CPPA said users—including large numbers of high school students—were effectively forced to “agree” to tracking to access paid tickets and services, and that directing users to industry opt-out programs (e.g., Network Advertising Initiative / Digital Advertising Alliance) did not satisfy California’s requirement that companies provide their **own** opt-out tool and clear disclosures.
Jun 29, 2026
General Motors agreed to pay **$12.75 million** to settle California allegations that it collected, retained, and sold drivers’ geolocation, driving behavior, and other personal data without proper knowledge or consent, in violation of the **California Consumer Privacy Act (CCPA)**. Prosecutors said GM used data gathered through its **OnStar** service and sold it to **LexisNexis Risk Solutions** and **Verisk Analytics**, which sought to use the information in driver-rating products for insurers; California said GM made about **$20 million nationwide** from the sales. Under the proposed settlement, GM must stop selling driving data to consumer reporting agencies for **five years**, delete retained driving data within **180 days** unless consumers provide affirmative express consent for limited internal uses, and ask LexisNexis and Verisk to delete data they previously received. The agreement, which still requires court approval, also requires GM to establish and maintain a privacy program tied to OnStar data collection and provide privacy assessments to California authorities; officials described the penalty as the **largest CCPA fine to date**.
Jun 29, 2026