Disney Streaming $2.75 Million Privacy Violations Settlement

California residents who used Disney streaming services, apps or online services, and attempted to opt out of the sale or sharing of their personal information, may benefit from a settlement, negotiated by California Attorney General Rob Bonta. This settlement represents the largest CCPA settlement in the state’s history.

The Walt Disney Co. has agreed to pay $2.75 million to resolve allegations that it violated the California Consumer Privacy Act (CCPA) by not fully honoring consumers’ requests to opt out of the sale or sharing of their personal data across all Disney streaming services and apps consumers accessed through their phones, tablets, computers and televisions. Streaming services included in the settlement are Disney Plus, ESPN Plus and Hulu.

The CCPA requires businesses to provide easy to understand opt-out options for consumers. The Attorney General alleged that Disney failed to execute consumer requests to opt-out of the sale or sharing of their personal information across all devices and services linked to a single Disney account. The investigation revealed that Disney's current opt-out methods were confusing for consumers, were not account-wide and sometimes only included individual services or devices.

What opt-out violations did the investigation uncover?

According to the California Attorney General, the following CCPA violations occurred:

• Opt-out toggles: Consumers who utilized the opt-out toggle had their request applied only to the specific streaming service and often the specific device being used at the time of the request. The toggle opt-out function did not prevent Disney from selling or sharing the user's data from other devices or services connected to the account.
• Webform: Consumers who opted out using a Disney webform had their request applied to the company's own advertising platform and services. Disney continued to sell user data to third-party companies with code embedded in its websites and apps. Users also had no other way of opting out of having their data shared and sold while in an app.
• Global Privacy Control: Consumers who opted out through Global Privacy Control had their request limited to the specific device the user was using.

Who will benefit from the settlement?

• California residents who used Disney streaming services, which includes Disney+, Hulu, or ESPN+.
• They requested to opt out of the sale or sharing of their personal information through any available method, including opt-out toggles, webforms, or Global Privacy Control.
• Users whose opt-out requests were not fully honored across all devices, services, or platforms associated with their Disney account.

What does the Disney settlement provide for users?

According to the settlement agreement, Disney will pay $2.75 million in civil penalties to the state of California and implement the following within it's streaming services and apps:

• Simplified opt-out: Disney will implement an "easy to execute" process for consumers to opt out of the sale or sharing of their personal data with minimal steps required.
• Account-wide opt-out: For users who are logged in to a Disney streaming service or app, the opt-out request will automatically apply across all Disney streaming services associated with that account, which includes Disney+, Hulu and ESPN+.
• Non-logged-in opt-out: For users not logged in, Disney will inform the user that logging in or providing additional information may be required to fully opt-out.
• No account opt-out: For users that do not have an account, or chose not to log-in to their account, Disney will identify the opt-out request as a request for the specific browser, app or device being used.
• Clear opt-out notices: Disney will provide "clear and conspicuous" opt-out links and notices within all its streaming services. The opt-out link and notice will be formatted to fit to scale the web browser, device or app the user is using at the time. Users will not be required to "unnecessarily search or scroll " to submit a request.
• Opt-out confirmation: Disney will provide a way for users to confirm their opt-out has been processed, such as a status update in their account settings.
• Compliance: Disney has agreed to comply with all user opt-out requests as required by the California Consumer Privacy Act (CCPA).

No claim form required

A claim form is not required to receive the injunctive relief the settlement provides.

Important dates

• Final judgement effective date: Feb. 11, 2026

What happens next?

Within 30 days of the settlement effective date, Disney will pay a civil fine of $2,750,000 to the California Attorney General's office. Within 60 days of the effective date, Disney will provide a progress update to the California Attorney General. Disney will continue to provide updates every 60 days until all Disney streaming services meet the compliance requirements outlined in the settlement agreement.

Within 180 days of the settlement, Disney will "implement and maintain" a plan of action that will monitor opt-out compliance. The opt-out compliance monitoring program will stay in effect for at least three years after the start date. Disney will provide a compliance report to the California Attorney General's office annually for three years after the settlement effective date.

Why did Disney agree to this settlement?

The lawsuit alleged that Disney violated California privacy laws by failing to fully honor users' requests to opt out of the sale or sharing of their personal information. The investigation found that Disney’s opt-out processes did not always apply across all devices or services, and sometimes continued to share data with third parties even after an opt-out request.

Disney does not admit liability, however agreed to settle in order to avoid further litigation.

Sources

1. California Department of Justice, Office of the Attorney General, Press Release
2. Final Judgment and Permanent Injunction