Disney settles California privacy violations with $2.75M penalty

Disney has agreed to pay $2.75 million to resolve violations under the California Consumer Privacy Act, which stemmed from its failure to ease data sharing opt-outs for its customers, reports The Record, a news site by cybersecurity firm Recorded Future.

Aside from fulfilling the fine, which is the largest yet under California's landmark privacy law, Disney has also been ordered to provide a compliance update to state officials within 60 days outlining the changes it has implemented to align with the CCPA. Such a settlement follows a state investigation that concluded Disneys opt-out processes failed to fully protect consumers from having their data shared, including users who were logged into their accounts.

According to California Attorney General Rob Bonta, those who submitted opt-out requests through Disneys web form were still not able to prevent the full sale or sharing of their personal data, alleging that information continued to be shared with "specific third-party ad-tech companies whose code Disney embedded in its websites and apps."