Published
February 16, 2026
Updated
May 27, 2026
You cannot claim money here — this is a government CCPA enforcement action — but the record $2.75 million penalty forces Disney to rebuild how Disney+, Hulu, and ESPN+ honor your privacy opt-outs.
This is a government enforcement action — California Attorney General Rob Bonta fined Disney $2.75 million for violating the California Consumer Privacy Act (CCPA) by continuing to sell and share user data from Disney+, Hulu, and ESPN+ even after customers explicitly told Disney to stop. The fine goes to the state of California, not to individual consumers.
So why should you care? Because the settlement forces Disney to fundamentally change how it handles your privacy choices — and because what Disney was doing is something a lot of people don't realize was happening. (And it isn't the only Disney privacy story to land in 2026: a separate Disneyland facial recognition class action complaint was filed in May 2026 over biometric scans at the California theme-park entrances. That one's a private class action in its earliest stage; this one is a resolved government enforcement action with a court-ordered fix on streaming opt-outs. Different cases, different remedies, same underlying pattern.)
What Was Disney Doing With Your Data?
When you stream something on Disney+, Hulu, or ESPN+, Disney collects personal information about you — what you watch, when you watch it, what device you're using, and more. Disney then sells or shares some of this data with third-party advertising companies who use it to target ads at you across the internet. This is called "cross-context behavioral advertising." It's legal, but California law gives you the right to tell companies to stop doing it.The problem? When you actually exercised that right and told Disney to stop, Disney didn't actually stop. Not fully, anyway. The California Attorney General's investigation — which started with a 2024 sweep of streaming services — found three major ways Disney's opt-out process failed.
Status
Final — Largest CCPA Settlement in California History
stipulated judgment entered February 2026; ongoing compliance monitoring required
Fine
$2,750,000 in Civil Penalties
paid to the State of California — not to individual consumers
Type
Government Enforcement Action
brought by California Attorney General Rob Bonta — not a class action, no claim form, no individual payouts
Services Affected
Disney+, Hulu & ESPN+
applies to all Disney streaming services and connected products that handle California consumer data
What Changes
Account-Wide Opt-Out, Honored GPC, Stricter Ad-Tech Vendor Controls
Disney must rebuild its opt-out flow across services, devices, and ad-tech partners
Three Ways Disney Ignored Your Opt-Out
The opt-out toggle only applied to one app on one device. If you toggled the opt-out setting in the Disney+ app on your Roku, for example, Disney only stopped selling your data from that one app on that one device. If you also used Hulu on your phone or ESPN+ on your tablet — all under the same Disney account — Disney kept right on selling your data from those other services and devices.The webform only partially worked. Disney offered a webform to opt out. But it only stopped sharing through Disney's own advertising platform. Disney continued sharing your data with third-party ad-tech companies whose tracking code was embedded directly in Disney's websites and apps. So you thought you opted out, but your data was still flowing to outside companies.
The Global Privacy Control was treated as device-specific. The Global Privacy Control (GPC) is a browser setting that sends an automatic "do not sell my data" signal to every website you visit. California law requires businesses to honor it. Disney technically honored GPC — but only for the one device sending the signal, even when you were logged into your account. Your account-wide data sharing continued.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Is the CCPA and Why Does This Matter?
The California Consumer Privacy Act is one of the strongest privacy laws in the United States. It gives California residents the right to know what personal data companies collect about them, the right to delete that data, and the right to tell companies to stop selling or sharing it. When you see a "Do Not Sell or Share My Personal Information" link at the bottom of a website, that's a CCPA requirement.The key principle behind this settlement is that when you opt out, it has to actually work — everywhere. You shouldn't have to opt out separately on every device, every app, and every streaming service under the same account. One request should cover everything. Disney's system violated that principle.
This is the seventh CCPA enforcement action by the Attorney General and the largest fine ever. Previous actions targeted Sephora, DoorDash, Jam City, Sling TV, Healthline.com, and Tilting Point Media.
What Does Disney Have to Do Now?
The settlement imposes a permanent injunction — meaning these aren't suggestions, they're court orders. Disney must make the following changes to all its streaming services:When a logged-in user opts out on any Disney streaming service, Disney must apply that choice across all Disney streaming services connected to the user's account. No more device-by-device or app-by-app opt-outs.
Disney must honor the Global Privacy Control signal account-wide for logged-in users.
Disney must provide clear, easy-to-find opt-out links in all streaming apps, including connected TV apps (smart TVs, Roku, Fire Stick, etc.). Previously, some connected TV apps had no in-app opt-out and just pointed users to a webform.
Disney cannot use confusing design or choice architecture to trick users into thinking they've opted out when they haven't, or to discourage opting out.
When a user opts out, Disney must notify all third parties that received that user's data and tell them to stop using it.
Disney must provide a way for users to confirm their opt-out has been processed.
Disney must continue protecting children's data (under 13) and minors (13-15) by not selling or sharing their information without affirmative authorization.
How Is Disney Being Monitored?
Disney must provide compliance updates to the Attorney General every 60 days until all its services are in full compliance. Disney must also implement a monitoring program and submit annual reports to the AG for three years documenting how it assesses whether its opt-out methods are actually working.How to Protect Your Privacy Now
While you can't get money from this settlement, you can take steps to protect your data:Log into your Disney account and look for privacy or opt-out settings. Because of this settlement, Disney is required to make these easier to find and use — and to apply your choice across all services linked to your account.
Consider installing the Global Privacy Control. It's built into browsers like Firefox and Brave, and available as an extension for Chrome and other browsers. It automatically tells every website you visit to stop selling your data. Under this settlement and California law, Disney must honor it account-wide for logged-in users.
If you want to report a CCPA violation, you can submit a complaint to the California Attorney General at oag.ca.gov/report.
Key Details
• Settlement Amount: $2,750,000 in civil penalties (paid to State of California)
• Type: Government enforcement action — NOT a class action (no individual payouts)
• Announced: February 11, 2026
• Streaming Services: Disney+, Hulu, ESPN+, and all Disney online services
• Compliance Updates: Every 60 days until full compliance, plus annual reports for 3 years
Case Information
The case is People of the State of California v. Disney DTC, LLC and ABC Enterprises, Inc., Case No. 24STCV04425, in the Superior Court of the State of California, County of Los Angeles.Defendants: Disney DTC, LLC (Delaware LLC) and ABC Enterprises, Inc. (California corporation), on behalf of their affiliates and subsidiaries, including any U.S. corporate member of The Walt Disney Family of Companies.
Plaintiff: The People of the State of California, through Attorney General Rob Bonta.
Attorneys for the People: Maneesh Sharma, Amos E. Hartston, and Yen P. Nguyen, Deputy Attorneys General; Stacey D. Schesser, Supervising Deputy Attorney General; Nicklas A. Akers, Senior Assistant Attorney General.
Defense Counsel: Alysa Z. Hutnik and Austin J. Del Priore of Kelley Drye & Warren LLP (Washington, DC).
Laws Violated: California Consumer Privacy Act (Civil Code § 1798.100 et seq.) and the Unfair Competition Law (Business and Professions Code § 17200 et seq.).
Court Documents
Other Disney Class Actions & Enforcement Matters
Disney’s data, biometric, and ESPN/Hulu carriage practices have generated several separate cases that consumers often confuse with this one. The most relevant ones are:• Disneyland Facial Recognition Class Action (Duffield v. Disney, S.D.N.Y., May 2026). A newly filed private class action alleging Disney began collecting facial recognition biometric data from guests at the Disneyland and Disney California Adventure entrances on or around April 28, 2026 without adequate consent. Allegations only at this stage; no settlement, no claim form. See the Disney facial recognition class action complaint page for what the complaint alleges, which laws it invokes, and what California park visitors can do right now.
• Disney ESPN $50M YouTube TV & DirecTV Stream Antitrust Settlement. A class action alleging Disney used its ownership of ESPN and Hulu to force anticompetitive carriage terms on YouTube TV and DirecTV Stream, inflating prices for live TV subscribers. The court preliminarily approved the deal on March 31, 2026 and the claim form opens July 7, 2026. See the Disney ESPN YouTube TV & DirecTV Stream settlement page for the schedule, eligibility, and what to do when the Epiq claim portal launches.
• Disney FTC COPPA Children’s Privacy Settlement. A separate Federal Trade Commission enforcement action over Disney’s handling of children’s privacy under the Children’s Online Privacy Protection Act. See the Disney FTC COPPA settlement page for details on what the FTC required of Disney and how it differs from the CCPA action covered here.
Sources
• California Attorney General Press Release, February 11, 2026• [Proposed] Final Judgment and Permanent Injunction, People of the State of California v. Disney DTC, LLC and ABC Enterprises, Inc., Case No. 24STCV04425 (Superior Court, Los Angeles County, CA)
About This Article
This is a government enforcement action, not a class action settlement. There is no claim form and no money available to individual consumers. This article is provided for informational purposes to help consumers understand what Disney was doing with their data and what privacy protections have been put in place. OpenClassActions.com is a consumer news site and is not a law firm.
For more class actions keep scrolling below.
Settlement Amount
$2,750,000 civil penalty
paid to the State of California · a government enforcement action, so there is no consumer fund and no claim form
Case Title
People of the State of California v. Disney DTC, LLC and ABC Enterprises, Inc.
Case Number
24STCV04425
Court
Superior Court of California, County of Los Angeles
Official Website
California Attorney General
