Disney Fined $10 Million for Collecting Children’s Personal Data

Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC have been ordered to pay a $10 million civil penalty for systematic violations of the Children’s Online Privacy Protection Act (COPPA) Rule and Section 5(a) of the FTC Act.

The federal complaint, filed September 2, 2025, in the Central District of California, alleges that Disney failed to properly designate numerous child-directed videos uploaded across more than 1,250 YouTube channels as “Made for Kids” (MFK).

By relying on a channel-level default setting of “Not Made for Kids” (NMFK), Disney allowed persistent identifiers such as cookies and mobile device IDs to be collected on videos featuring content aimed at children without obtaining verifiable parental consent or providing the required parental notice under COPPA.

YouTube’s MFK designation automatically disables targeted advertising, comments, autoplay on home, Miniplayer, and playlist saving for child-directed videos. However, Disney’s corporate policy maintained a uniform NMFK designation at the channel level.

This practice applied even to videos with clearly child-oriented subject matter—such as clips from Frozen and Toy Story, sing-along playlists, and story-time readings resulting in targeted ads and data collection on programming popular with children.

YouTube itself reclassified over 300 such videos in mid-2020 after identifying the COPPA-inconsistent designations, yet Disney failed to adopt a robust video-level review process to correct future mislabeling.

Permanent Injunction and Enhanced Compliance Protocol

Under COPPA’s civil penalty framework, each unauthorized collection or disclosure of a child’s personal information constitutes a separate violation. In addition to the $10 million payment to the U.S. Treasury, the court imposed a permanent injunction compelling Disney to:

• Align YouTube audience settings with actual video content through a comprehensive, video-level compliance protocol;
• Conduct quarterly audits of all channels and videos to verify MFK designations and disable noncompliant functionality; and
• Provide clear, prominent parental notices detailing data practices and obtain verifiable parental consent before collecting or engaging in targeted advertising involving children.

The FTC’s action also highlighted that Disney operated targeted ad campaigns directly within its videos and ran at least twelve campaigns generating more than 350,000 impressions on child-directed videos mislabeled as NMFK.

By allowing persistent identifiers on such content, Disney circumvented COPPA’s notice and consent prerequisites, depriving parents of control over their children’s online data.

This ruling underscores the FTC’s commitment to enforcing children’s privacy protections in the digital marketplace.

Content operators are reminded that accurate audience designations and strict adherence to COPPA’s technical and procedural requirements are nonnegotiable when serving child-directed content.

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates

The post Disney Fined $10 Million for Collecting Children’s Personal Data appeared first on Cyber Security News.