California has secured its largest settlement under the state’s data privacy law, requiring Disney to pay $2.75 million and change its data practices.

California Attorney General Rob Bonta announced the settlement on Feb. 11, resolving allegations that Disney violated the California Consumer Privacy Act (CCPA) by failing to fully honor users’ requests to stop the sale or sharing of their personal data.

California’s investigation found that Disney did not fully honor consumers’ requests to opt out of the sale or sharing of their data across all devices and streaming services associated with their accounts.

“Businesses can’t force people to go device-by-device or service-by-service,” Bonta said. “In California, asking a business to stop selling your data should not be complicated or cumbersome.”

Under the settlement, Disney agreed to pay $2.75 million in civil penalties and implement opt-out procedures that permanently prevent the sale or sharing of consumers’ personal information.

The Epoch Times reached out to Disney for comment but didn’t receive a response by the time of publication.

2024 Investigative Sweep

The California Department of Justice said its probe of Disney stemmed from a January 2024 investigative sweep of streaming services for potential CCPA violations.

Investigators found that even when users were logged into their Disney accounts, the company’s processes did not allow them to opt out of all sales or data sharing.

That meant consumers could continue to have their data sold or shared through other devices or services connected to the same account.

The state said the alleged shortcomings appeared in several opt-out methods offered by Disney.

The department also said Disney failed to provide an in-app opt-out option in many connected TV streaming apps, instead directing consumers to a web form, leaving users without a way to stop data sales or sharing from those apps.

For consumers who used the Global Privacy Control, or GPC—described by the state as an easy-to-use “stop selling or sharing my data switch” available on some browsers or as an extension—the department said Disney limited the request to the specific device being used, even when the user was logged into their account.

Scope of the CCPA

The CCPA grants residents the right to know how businesses collect, share, and disclose their personal information and allows them to request that companies stop selling or sharing it.

Wednesday’s settlement represents the seventh enforcement action under the CCPA, according to the attorney general’s office.

Bonta has previously announced settlements with companies including Sephora, DoorDash, Jam City, Sling TV, Healthline.com, and Tilting Point Media.

The department said it has conducted investigative sweeps into location data, streaming apps and devices, employee information, and surveillance pricing to monitor compliance.

“Consumers shouldn’t have to go to infinity and beyond to assert their privacy rights,” Bonta said in a Feb. 11 post on X.