Disney agrees to record $2.75 million CCPA fine over opt-out violations in California

The Walt Disney Co. has agreed to pay a $2.75 million fine and implement sweeping privacy reforms to resolve allegations that it violated California’s landmark consumer privacy law by making it excessively difficult for users to opt out of data sharing and sales, state officials announced. The settlement, which remains subject to court approval, marks the largest penalty ever imposed under the California Consumer Privacy Act.

California Attorney General Rob Bonta alleged that Disney’s opt-out mechanisms failed to provide consumers with a meaningful way to stop the sale and sharing of their personal information across devices, streaming platforms and services connected to their Disney accounts.

The enforcement action follows a separate regulatory penalty in September, when the Federal Trade Commission fined The Walt Disney Company $10 million for violations related to children’s privacy.

The California investigation determined that Disney’s opt-out processes contained significant gaps. Consumers who attempted to opt out through toggles embedded in Disney’s websites and apps were often able to block data sharing only for the specific streaming service and device in use at the time. That structure meant data could continue to be sold or shared through other devices or affiliated services tied to the same account.

State officials also found shortcomings in Disney’s webform opt-out system. Even when consumers submitted the required forms, certain categories of personal data continued to be shared with specific third-party advertising technology companies whose code was embedded within Disney’s digital platforms.

The investigation further concluded that Disney did not provide an in-app opt-out mechanism and instead directed users to complete requests through a webform, limiting consumers’ ability to halt data sales and sharing directly within its applications.

Bonta said California’s privacy law clearly requires businesses to honor opt-out rights wherever and however personal data is sold, and that companies cannot require consumers to navigate device-by-device or service-by-service processes to exercise those rights.

The inquiry into Disney began after Bonta launched a January 2024 investigative sweep focused on streaming services and their compliance with the CCPA.

Under the terms of the proposed settlement, Disney does not admit liability or wrongdoing. A company spokesperson said Disney continues to invest significant resources to maintain responsible and transparent data practices across its streaming platforms.

In addition to paying the $2.75 million penalty, Disney must report to the state within 60 days of court approval on the measures it has taken to comply with CCPA requirements. The company will be required to submit follow-up progress reports every 60 days until all services meet the law’s standards.