Did Disney just admit that millions of guests' data were leaked through third-party companies?
The Magic Guests Expect Extends Far Beyond the Parks
For millions of families, the magic of Disney doesn’t stop at the gates of Disneyland or Walt Disney World. It continues at home — through streaming services, connected TVs, mobile apps, and personalized content experiences powered by The Walt Disney Company’s massive digital ecosystem.
From Disney+ movie nights to ESPN streaming marathons and Hulu binge sessions, fans expect seamless access, curated recommendations, and family-friendly experiences. There’s an assumption that the company behind Mickey Mouse and Sleeping Beauty Castle holds itself to the highest standards — especially when it comes to trust.
But recently, that trust has been tested in a way few theme park fans saw coming.
A Growing Concern About How Data Travels Behind the Scenes
In today’s entertainment landscape, personalization is king. Streaming platforms rely on user data to suggest shows, tailor advertisements, and optimize performance across devices. But as companies expand their digital reach, so does scrutiny over how consumer data is collected and shared.
California’s Consumer Privacy Act (CCPA) gives residents the right to understand how their data is used — and, importantly, to opt out of its sale or sharing. For major corporations operating across multiple platforms and devices, compliance isn’t just a checkbox; it’s a complex, ongoing responsibility.
Earlier this year, concerns began surfacing that one of the entertainment industry’s most recognizable brands may not have fully met that responsibility.
California’s Investigation Quietly Put Disney Under the Microscope
In January 2024, the California Attorney General’s office launched a large-scale investigation into major streaming services for potential violations of the CCPA. According to California Attorney General Rob Bonta, investigators identified compliance gaps in how some platforms handled consumer opt-out requests.
For Disney, the issue centered on whether users who chose to opt out of data selling or sharing were fully protected across all devices and services linked to their accounts.
What investigators reportedly found was more complicated than many consumers might expect.
The $2.75 Million Settlement Marks a Major Enforcement Action
California Attorney General Rob Bonta announced that The Walt Disney Company has agreed to a $2.75 million settlement over alleged violations of the California Consumer Privacy Act.
According to the Attorney General’s office, Disney’s opt-out systems did not fully stop the sale or sharing of personal data across all devices and streaming services connected to user accounts.
Investigators determined that:
-
Opt-out toggles on Disney websites and apps often applied only to a specific streaming service or device — not the entire account.
-
Disney’s webform halted sharing through its own advertising platform but allowed continued sharing with certain third-party ad-tech companies embedded on its platforms.
-
Some connected TV apps lacked in-app opt-out options and redirected users to a webform that did not fully halt data sharing.
-
Global Privacy Control (GPC) signals were limited to individual devices, even when users were logged into their accounts.
Under the terms of the settlement, Disney must pay civil penalties and implement updated opt-out mechanisms that completely stop the sale or sharing of personal information when requested.
This marks the seventh CCPA enforcement action under Attorney General Bonta, following previous settlements with companies including Sephora, DoorDash, Jam City, Sling TV, Healthline.com, and Tilting Point Media.
What This Means for Disney+ Users and Future Privacy Standards
The settlement doesn’t mean Disney streaming services are shutting down or changing overnight. However, it does require the company to implement more comprehensive opt-out mechanisms to comply fully with California privacy law.
The CCPA grants California consumers the right to know how businesses collect and share their data — and to request that businesses stop selling or sharing it. Enforcement actions like this signal that the Attorney General’s office will continue investigative sweeps to monitor compliance.
This isn’t the first time Disney has addressed privacy concerns. In September 2025, the company reached a settlement with the Federal Trade Commission over “Made for Kids” content that was not correctly labeled, which allowed data collection without parental consent. At that time, Disney acknowledged shortcomings and implemented new procedures to align with the Children’s Online Privacy Protection Act (COPPA).
No matter how you feel about Disney or its products, transparency and consumer choice remain critical in today’s digital environment. The end of an era? Not quite. But it is a reminder that even beloved brands must evolve alongside privacy expectations.
As The Walt Disney Company updates its opt-out processes, future travelers and streamers alike may feel more confident knowing stronger protections are in place.
What do you think about the Disney CCPA settlement? Does this change how you view streaming privacy — or is it simply part of doing business in the digital age?
