Back to the hub

Disney CCPA settlement: what did California find?

California's Attorney General announced the Disney settlement on February 11, 2026: $2.75 million in civil penalties. The allegation was that Disney's opt-out toggles, webform and Global Privacy Control handling each stopped short, applying a consumer's opt-out to one service or one device rather than the whole account.

Applies to: Any CCPA-covered business that sells or shares personal information and offers more than one app, brand, device experience or login surface, where an opt-out submitted in one place may not propagate to the others.

Find out what applies to you

Run the free 2-minute Obligation Scan and get a plain-language list of what your business has to do, and by when.

Run the free 2-minute Obligation Scan

Disney offered consumers three separate ways to opt out of the sale and sharing of their personal information. California's position was that all three of them leaked. That is the useful part of this case for anyone running more than one app or brand: Disney was not accused of ignoring opt-outs. It was accused of honoring them too narrowly.

What the Attorney General alleged

The investigation came out of a January 2024 investigative sweep of streaming services. The office looked at what actually happened after a consumer asked Disney to stop selling or sharing their data, and found that each of the three available methods had a gap.

The opt-out toggles inside Disney's websites and apps applied the request only to the specific streaming service the consumer was watching, and often only to the specific device they were using. A consumer who opted out on one service, on one device, was still being sold and shared from the other services and devices attached to the same account.

The webform had a different gap. It stopped the sharing of personal data through Disney's own advertising platform and offerings, but Disney continued to sell and share consumer data with specific third-party advertising technology companies whose code Disney had embedded in its own websites and apps. The office also found that many of Disney's connected TV streaming apps had no in-app opt-out method at all, and instead pointed consumers at the webform, which in practice left those consumers with no working way to stop the selling and sharing from those apps.

The third gap involved the Global Privacy Control. When a consumer opted out through GPC, Disney limited the request to the specific device the consumer was using, even when that consumer was logged into their account. Disney knew who they were and still treated the signal as a device-level fact.

Why the scoping is the whole case

Read the three findings together and one principle runs through them. The Attorney General's stated position was that a consumer's opt-out right applies wherever and however a business sells data, and that businesses cannot force people to go device-by-device or service-by-service.

That is a demanding standard for any business with more than one property. It means the compliance question is not "do we have an opt-out control" but "what is the blast radius of a single opt-out request." A toggle that works perfectly, on the one service where it was pressed, is the exact fact pattern that produced a $2.75 million penalty here.

Under the settlement Disney must pay the civil penalties and must implement opt-out methods that fully stop Disney's sale or sharing of consumers' personal information.

Where it sits in the enforcement record

This was the seventh CCPA enforcement action, and the second to come out of the streaming services sweep, after Sling TV. When the office announced it, it called the settlement the largest to date under the CCPA.

That description was accurate on February 11, 2026 and is not accurate now. On May 8, 2026 the Attorney General announced a $12.75 million settlement with General Motors, which is the larger number and the current high-water mark. A page that still calls Disney the largest CCPA settlement is repeating a line that has since been overtaken, which is worth knowing if you are reading commentary written in February.

What a smaller business should take from it

Disney is not a useful comparison on scale, but it is a useful comparison on structure. Plenty of small businesses run a marketing site, a product app and a support portal on three different stacks, with three different consent implementations, all under one account system. That is the same shape of problem.

The practical test is cheap to run. Opt out on one surface, then go and watch the network traffic on the others while logged into the same account. If third-party advertising calls are still firing, the opt-out is scoped the way Disney's was.

If you are not sure whether the CCPA reaches your business at all, the threshold test is separate from all of this and is covered in does the CCPA apply to companies outside California.

Compliance checklist

  • Map every surface where a consumer can opt out, then test whether a request made on one of them actually stops selling and sharing on all the others.
  • Check whether your opt-out is scoped to a device or to the account, because Disney's toggles and Global Privacy Control handling were both faulted for stopping at the device.
  • Give consumers an in-app opt-out method on connected TV and other app surfaces instead of directing them to a webform they cannot reach from the app.
  • Confirm that an opt-out reaches embedded third-party advertising code, not only your own advertising platform, since that gap was the specific fault found in Disney's webform.
  • Treat a logged-in consumer's Global Privacy Control signal as applying to the account, not just the browser it arrived from.

Sources

Last verified: 2026-09-10

Informational, not legal advice.