Earlier this week, The Walt Disney Company reached a significant settlement, agreeing to pay a US$10 million civil penalty following allegations from the United States Department of Justice (DOJ) regarding the unlawful collection of personal data from children without parental consent.
The lawsuit, identified as Case No. 2:25-cv-08223 in the U.S. District Court for the Central District of California, focuses on Disney’s use of YouTube channels to distribute content aimed at children while continuing to collect data and serve targeted advertising—actions that violate the Children’s Online Privacy Protection Rule (COPPA) and Section 5(a) of the Federal Trade Commission Act.
According to the complaint, Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC operated over 1,250 YouTube channels, streaming popular content specifically designed for audiences under 13. YouTube requires content creators to label their videos as either “Made for Kids” (MFK) or “Not Made for Kids” (NMFK). However, Disney allegedly set entire channels to NMFK, even for videos featuring family-friendly characters and themes from popular films such as Frozen, Moana, and Toy Story.
YouTube’s child-safety features turn off key functionalities, including comments and personalised advertising, for videos marked as MFK. By misclassifying their content, Disney inadvertently allowed YouTube to gather persistent identifiers and deliver targeted advertisements to young viewers.
The DOJ’s complaint cites internal communications showing that, in November 2019, YouTube instructed Disney to clarify whether its videos were intended for children, warning of potential enforcement actions should the mislabeling continue. Despite YouTube’s effort to reclassify over 300 Disney videos as MFK in mid-2020, Disney continued to adhere to a policy that designated audience types at the channel level rather than for each video individually.
Consequently, child-targeted content remained subject to interest-based advertising practices, with Disney conducting at least twelve targeted advertising campaigns on improperly classified videos, generating over 350,000 impressions.
By permitting these targeted marketing activities without obtaining valid parental consent, Disney violated the COPPA stipulations for notice and consent and engaged in practices deemed unfair or deceptive under Section 5(a) of the FTC Act.
COPPA requires that operators of online services aimed at children provide clear notifications to parents, display an accessible privacy policy, and obtain parental consent before collecting any personal information from children. The DOJ’s complaint alleges that Disney failed to comply with these obligations, resulting in wrongful data collection and usage for advertising purposes.
Each instance of improper data collection is treated as a separate violation and is subject to civil penalties under Section 5(m)(1)(A) of the FTC Act.
In response to the government’s allegations, Disney neither admitted to nor denied any wrongdoing, but committed to implementing stronger compliance measures. These measures include enhanced auditing processes for audience designations, employee training on COPPA regulations, ongoing reporting to the FTC regarding YouTube activities, and a robust parental consent verification protocol.
The US$10 million penalty will be directed to the U.S. Treasury and is one of the largest fines ever imposed due to COPPA violations.
This settlement underscores a powerful message from regulators that major digital content providers must adhere to children’s privacy laws. As families increasingly rely on online platforms for entertainment, all operators of child-oriented services must comply with federal privacy regulations to avoid severe repercussions.
The case underscores the importance of safeguarding children’s data in the digital landscape and sets a precedent for accountability within prominent media companies.
