Disney Settlement Over California Consumer Privacy Act Opt-Out Failures

Disney agreed to pay $2.75 million to settle allegations by the California Attorney General that it violated the California Consumer Privacy Act (CCPA) by making it difficult for consumers to opt out of the sale/sharing of their personal data. California alleged Disney’s opt-out mechanisms contained gaps that prevented users—including those logged into their accounts—from fully stopping data sharing across Disney’s services, devices, and platforms, and that data continued to be shared with third-party ad-tech companies whose code was embedded in Disney websites and apps.

The settlement (pending court approval) requires Disney to implement a more comprehensive privacy program and provide California officials a compliance update within 60 days describing changes made to align with CCPA requirements. State officials characterized the penalty as the largest fine to date under the CCPA; Disney did not admit liability as part of the agreement and said it continues to invest in privacy protections across its streaming services.