On Feb. 11, 2026, the California Attorney General’s Office announced a $2.75 million settlement with The Walt Disney Company, making it the largest fine imposed under the California Consumer Privacy Act (CCPA) to date. The penalty resolves allegations that Disney failed to fully honor consumers’ requests to opt out of the sale or sharing of their data across all devices and services tied to their accounts, in violation of the CCPA.
According to the Attorney General’s press release, the Department of Justice found that Disney’s opt-out mechanisms exhibited significant functional gaps that undermined consumer choice.
The investigation found problems with Disney’s opt-out toggle, webform submission and the Global Privacy Control signals. Essentially, the opt-out mechanisms used by Disney did not allow a customer to completely opt-out of and stop the sale and sharing of their data, even when logged into their account. Instead, the mechanisms used to effectuate the opt-out process still enabled Disney to continue to sell and share consumers’ data. The Attorney General noted several examples, including only applying the opt-out to the specific streaming service the consumer was watching, and often only the specific device being used.
If the consumer submitted an opt-out request through the webform, Disney only applied the request to the sharing of personal data through its own advertising platform and offerings, but continued to sell and share the data with third-party ad-tech companies. And for consumers who opted out via the Global Privacy Control, Disney applied the request only to the specific device the consumer was using.
Disney is required to implement a “consumer-friendly, easy to execute opt-out process” that enables consumers to opt-out of the sale or sharing of their data through minimal steps. The final judgment specifically noted that Disney is required to enable consumers to opt-out of all streaming services associated with the consumer’s account when they exercise these rights through that account.
This enforcement action highlights the importance of companies making it easy for consumers to exercise their opt-out rights across all services at once. Companies must develop the appropriate controls for ensuring the opt-out request is applied throughout a company’s entire ecosystem including vendors and service providers, and not in a piece meal fashion.
