On February 11, 2026, California Attorney General Rob Bonta announced that his office recently reached a settlement with Walt Disney Company to resolve allegations that the company violated the California Consumer Privacy Act (“CCPA”) by failing to “fully effectuate” consumer requests to opt-out of the sale or sharing of personal data across all devices and streaming services connected to their Disney accounts. The settlement requires Disney to pay $2.75 million in civil penalties and implement opt-out mechanisms aimed at fully stopping the sale or sharing of consumers’ personal information. Bonta emphasized that the resolution with Disney is California’s largest CCPA settlement to date.
The inquiry into Disney stems from an broader investigation launched in January 2024 into streaming services’ compliance with the CCPA. While investigators found that Disney offered consumers multiple methods to opt-out of data sharing, they determined that each of Disney’s method had limitations that allowed the company to continue selling and sharing consumers’ data. According to the complaint, the opt-out toggles located on Disney’s websites and applications only applied to the specific streaming service that the consumer was using to submit the request, and would often apply only to the specific device that the consumer was using to opt-out, even when they were logged into their Disney account. Consumers who used Disney’s webform to opt out were allegedly only able to stop the sharing and selling of data through Disney’s own advertising platform and were not able stop Disney from sharing or selling consumers’ data to certain third-party ad-tech companies whose code was embedded into Disney’s websites and apps. Investigators also discovered that Disney had limited consumers ability to opt out via the Global Privacy Control (an opt-out function often available on internet browsers or as a browser extension, and required under CCPA) by similarly applying the request only to the specific device the consumer was using to opt-out, even when consumers were logged into their Disney accounts.
In addition to the payment of the fine, the settlement requires Disney to implement opt-out methods that comply with the CCPA and that not only allow consumers to opt-out with minimal steps but apply across all Disney streaming services. The settlement also includes a reporting requirement that calls for Disney to provide the California AG with updates every 60 days until its opt-out program complies with the terms of settlement. In addition, Disney must provide the California AG with annual reports for a period of three years to ensure that its opt-out program remains effective.
California Attorney General Press Release | Final Judgment and Permanent Injunction | Complaint