Disney to Pay $10 Million Over Children’s Data Privacy Violations

In a landmark settlement announced on September 2, 2025, The Walt Disney Company has agreed to pay a $10 million civil penalty to resolve allegations by the United States Department of Justice that its subsidiaries violated federal law by collecting personal data from children without parental consent.

The suit, filed as Case No. 2:25-cv-08223 in the U.S. District Court for the Central District of California, stems from Disney’s use of YouTube channels to distribute child-directed video content where targeted advertising and data-harvesting features remained active, contravening the Children’s Online Privacy Protection Rule (COPPA) and Section 5(a) of the Federal Trade Commission Act.

According to the complaint, Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC operated more than 1,250 YouTube channels that streamed popular videos and playlists aimed at viewers under age 13.

Although YouTube requires content creators to designate whether each video is “Made for Kids” (MFK) or “Not Made for Kids” (NMFK), Disney allegedly defaulted entire channels to NMFK—even when individual videos featured animated characters, sing-along story sessions, and movie clips from Frozen, Moana, and Toy Story that clearly target children.

YouTube’s child-safety settings disable features such as comments, autoplay on home, and personalized advertising for MFK videos; by mislabeling child-directed content as NMFK, Disney allowed YouTube to collect persistent identifiers and serve targeted ads directly to young viewers.

The DOJ complaint highlights internal communications showing that, in November 2019, YouTube instructed Disney to “tell [us] whether your videos are made for kids,” warning of potential FTC enforcement if child-directed content remained improperly designated.

Despite this, and despite YouTube’s unilateral reclassification of over three hundred Disney videos as MFK in mid-2020, Disney maintained a corporate policy assigning audience designations at the channel level and failed to adopt a video-by-video approach.

As a result, child-directed videos on channels such as Pixar, Disney Plus, and Disney Animation Studios continued to support targeted advertising and feature sets disabled for genuine MFK content.

Beyond YouTube-served ads, Disney itself placed at least twelve targeted ad campaigns on misclassified videos across MFK-designated channels, generating over 350,000 impressions.

By enabling interest-based marketing campaigns without obtaining verifiable parental consent, Disney violated COPPA’s notice and consent requirements and engaged in unfair or deceptive practices under Section 5(a) of the FTC Act.

Under COPPA, operators of child-directed online services must provide clear disclosures to parents, post prominent privacy notices, and secure parental consent before collecting personal information from children.

The DOJ complaint alleges Disney’s systematic failure to meet these obligations, resulting in the unauthorized collection and use of personal data for advertising revenue.

Each improper collection event constitutes a separate violation subject to civil penalties under Section 5(m)(1)(A) of the FTC Act.

In settling the government’s claims, Disney neither admitted nor denied wrongdoing but agreed to implement rigorous compliance measures.

These include enhanced audit procedures to ensure accurate audience designations, staff training on COPPA requirements, regular reporting to the FTC on its YouTube operations, and a robust verification process for parental consent.

The $10 million penalty will be payable to the U.S. Treasury and represents one of the largest civil penalties ever imposed for COPPA violations.

With this settlement, regulators send a clear signal that major digital content providers cannot sidestep children’s privacy protections.

As families increasingly turn to online platforms for entertainment, all operators of child-directed services must adhere strictly to federal privacy laws or face significant enforcement action.

The case underscores the vital importance of safeguarding children’s data in the digital age and sets a precedent for accountability among leading media companies.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.