The Walt Disney Company agreed to pay a $10
million civil penalty as part of a settlement based on allegations that it violated child privacy laws.
The case involves Disney Worldwide Services Inc and Disney Entertainment Operations
LLC, and prevents the company from operating on YouTube in ways that violate the Children’s Online Privacy Protection Act (COPPA) and its implementing regulations in connection with
Disney's YouTube video content, the Justice Department said last week.
The
settlement is based on a
complaint filed in September by the Department of Justice after the Federal Trade Commission (FTC) alleged the companies violated COPPA rules.
Disney, per the order and COPPA rules,
must create a program that complies with YouTube's privacy law. It also requires its websites, apps and other online services aimed at children under 13 to notify parents about the types of personal
information collected, as well as gain parental consent before collecting the information.
advertisement
advertisement
“The Justice Department is firmly devoted to ensuring parents have a say in how their
children’s information is collected and used,” Assistant Attorney General Brett A. Shumate of the Justice Department’s Civil Division stated. “The Department will take swift action to root out any unlawful infringement
on parents’ rights to protect their children’s privacy.”
It is somewhat surprising that companies focused on entertaining children would violate these privacy laws. The
fault seemed to center on the company failing to correctly apply the privacy laws correctly within the specific framework of
COPPA on YouTube's massive ecosystem, rather than Disney lacking privacy standards.
The primary allegation is that Disney had
failed to properly use the "Made for Kids" (MFK) designation
for hundreds of its YouTube videos. This label is a critical compliance tool that triggers several automated protections, such as disabling personalized ads and preventing data collection.
When the issue was first raised, YouTube allegedly told Disney it had changed the labels on more than 300 videos. Some of them included content from movies like The
Incredibles, Frozen, and Toy Story.
The lawyers for the Justice Department said Disney’s failure to label the videos correctly “results
in YouTube collecting personal information and placing targeted advertisements on child-directed videos on Disney’s behalf," according to one report.
Lawmakers have been pushing to add more
protections to COPPA. An amended version of the law in 2024 passed the Senate that proposed companies needed to provide kids under 17 with the strictest safety guardrails available on their
platforms, The Wall Street Journal reported.
The enhanced version of COPPA was
introduced to the House in November.
The WSJ listed other companies that have paid millions due to
COPPA in recent years. In 2023, Microsoft agreed to pay $20 million to settle claims that it violated children’s privacy rights by signing them up for its Xbox game system.
The FTC
in June 2024 recommended a civil
lawsuit against TikTok for alleged violations of COPPA.
The complaint against TikTok alleged that
the company failed to comply with the COPPA requirement to notify and obtain parental consent before collecting and using personal information from children under the age of 13.
“TikTok knowingly and repeatedly violated kids’ privacy, threatening the safety of millions of children across the country,” stated FTC Chair Lina M. Khan.
TikTok's parent
company ByteDance was aware of the need to comply with the COPPA Rule and the 2019 consent order and knew about TikTok’s compliance failures that put children’s data and privacy at risk,
according to the FTC statement.
"Instead of complying, ByteDance and TikTok spent years knowingly allowing millions of children under 13 on their platform designated for users 13 years and
older in violation of COPPA," the FTC stated, citing the complaint.