Disney Streaming $2.75 Million Privacy Violations Settlement

California residents who used Disney streaming services, apps or online services and attempted to opt out of the sale or sharing of their personal information may benefit from a settlement negotiated by California Attorney General Rob Bonta. This settlement represents the largest CCPA settlement in the state’s history.

The Walt Disney Co. agreed to pay $2.75 million to resolve allegations that it violated the California Consumer Privacy Act by not fully honoring consumers’ requests to opt out of the sale or sharing of their personal data across all Disney streaming services and apps consumers accessed through their phones, tablets, computers and televisions. The settlement includes Disney+, ESPN+ and Hulu streaming services.

The CCPA requires businesses to provide easy-to-understand opt-out options for consumers. The attorney general alleged Disney failed to execute consumer requests to opt out of the sale or sharing of their personal information across all devices and services linked to a single Disney account. The investigation revealed Disney's current opt-out methods confused consumers, did not take effect account-wide and sometimes only included individual services or devices.

What opt-out violations did the investigation uncover?

• Opt-out toggles: If a consumer utilized the opt-out toggle, Disney applied their request only to the specific streaming service and often the specific device used at the time of the request. The toggle opt-out function did not prevent Disney from selling or sharing the user's data from other devices or services connected to the account.
• Webform: If a consumer opted out using a Disney webform, Disney applied their request to the company's own advertising platform and services. The company continued to sell user data to third-party companies with code embedded in its websites and apps. Users also had no other way of opting out of data sharing and selling while in an app.
• Global Privacy Control: If a customer opted out through Global Privacy Control, Disney limited their request to the specific device used to make the request.

Who will benefit from the settlement?

• Class members are California residents who used Disney streaming services, which includes Disney+, Hulu or ESPN+.
• Class members must have requested to opt out of the sale or sharing of their personal information through any available method, including opt-out toggles, webforms or Global Privacy Control.
• Disney must not have fully honored their opt-out requests across all devices, services or platforms associated with their Disney account.

What does the Disney settlement provide for users?

According to the settlement agreement, Disney will pay $2.75 million in civil penalties to the state of California and implement the following within its streaming services and apps:

• Simplified opt-out: Disney will implement an "easy-to-execute" process for consumers to opt out of the sale or sharing of their personal data with minimal steps required.
• Account-wide opt-out: For users who are logged in to a Disney streaming service or app, the opt-out request will automatically apply across all Disney streaming services associated with that account, which includes Disney+, Hulu and ESPN+.
• Non-logged-in opt-out: For users not logged in, Disney will inform the user that logging in or providing additional information may be required to fully opt out.
• No account opt-out: For users who do not have an account or who choose not to log in to their account, Disney will identify the opt-out request as a request for the specific browser, app or device being used.
• Clear opt-out notices: Disney will provide "clear and conspicuous" opt-out links and notices within all its streaming services. It will format the opt-out link and notice to fit to scale the web browser, device or app the user is using at the time. Users will not be required to "unnecessarily search or scroll " to submit a request.
• Opt-out confirmation: Disney will provide a way for users to confirm it processed their opt-out request, such as a status update in their account settings.
• Compliance: Disney agreed to comply with all user opt-out requests as required by the California Consumer Privacy Act.

No claim form required

Class members do not need to submit a claim form to receive the injunctive relief the settlement provides.

Important dates

• Final judgement effective date: Feb. 11, 2026

What happens next?

Within 30 days of the settlement effective date, Disney will pay a civil fine of $2,750,000 to the California attorney general's office. Within 60 days of the effective date, Disney will provide a progress update to the California attorney general. Disney will continue to provide updates every 60 days until all Disney streaming services meet the compliance requirements outlined in the settlement agreement.

Within 180 days of the settlement, Disney will "implement and maintain" a plan of action that will monitor opt-out compliance. The opt-out compliance monitoring program will stay in effect for at least three years after the start date. Disney will provide a compliance report to the California attorney general's office annually for three years after the settlement effective date.

Why is there a settlement?

The lawsuit alleged Disney violated California privacy laws by failing to fully honor users' requests to opt out of the sale or sharing of their personal information. The investigation found Disney’s opt-out processes did not always apply across all devices or services and sometimes continued to share data with third parties even after an opt-out request.

Disney does not admit liability but agreed to settl to avoid further litigation.

Sources

1. Press release
2. Final judgment and permanent injunction