Disney to pay $2.75 million to settle alleged violations of the California Consumer Privacy Act

Walt Disney Co. will pay $2.75 million to settle allegations that it violated the California Consumer Privacy Act by not fully complying with consumers’ requests to opt out of data sharing on its streaming services, the state attorney general’s office said Wednesday.

The Burbank media and entertainment company allegedly restricted the extent of opt-out requests, including complying with users’ petitions only on the device or streaming services they processed it from, or stopping the sharing of consumers’ personal data through Disney’s advertising platform but not those of specific ad-tech companies whose code was embedded on Disney websites and apps, the attorney general’s office said.

In addition to the fine, the settlement, which is subject to court approval, will require Disney to enact a “consumer-friendly, easy to execute” process that allows users to opt-out of the sale or sharing of their data with as few steps as possible, according to court documents.

“Consumers shouldn’t have to go to infinity and beyond to assert their privacy rights,” Atty. Gen. Rob Bonta said in a statement. “In California, asking a business to stop selling your data should not be complicated or cumbersome.”

A Disney spokesperson said in a statement that the company “continues to invest significant resources to set the standard for responsible and transparent data practices across our streaming services.”

“As technology and media continue to evolve, protecting the privacy and preserving the experience of Californians and fans everywhere remains a longstanding priority for Disney,” the spokesperson said.

The settlement with Disney stemmed from a 2024 investigation by the attorney general’s office into streaming devices and apps for alleged violations of the California Consumer Privacy Act, which governs the collection of consumers’ personal data by businesses.

Under the law, businesses that sell or share personal data for targeted advertising must give users the right to opt-out.

Disney’s $2.75-million payment is the largest such settlement under the state privacy act, Bonta’s office said.

The attorney general has also reached settlements with companies such as beauty retailer Sephora, food delivery app DoorDash and SlingTV for alleged violations of the privacy act.