California Attorney General Rob Bonta recently announced a $2.75 million settlement with The Walt Disney Company over alleged violations of the California Consumer Privacy Act (CCPA), marking the largest settlement to date under the state’s landmark privacy law.

The agreement resolves claims that Disney failed to fully honor consumers’ requests to opt out of the sale or sharing of their personal data across devices and streaming services linked to their Disney accounts. In addition to paying civil penalties, Disney must implement measures ensuring that opt-out requests effectively halt the sale or sharing of consumer data.

“Consumers shouldn’t have to go to infinity and beyond to assert their privacy rights. Today, my office secured the largest settlement to date under the CCPA over Disney’s failure to stop selling and sharing the data of consumers that explicitly asked it to,” Bonta said.

“California’s nation-leading privacy law is clear: A consumer’s opt-out right applies wherever and however a business sells data — businesses can’t force people to go device-by-device or service-by-service. In California, asking a business to stop selling your data should not be complicated or cumbersome. My office is committed to the continued enforcement of this critical privacy law.”

The California Department of Justice launched its investigation as part of a January 2024 sweep of streaming services for potential CCPA violations. Investigators found that Disney’s opt-out mechanisms contained gaps that allowed continued data sales or sharing even after consumers submitted requests.

The investigation also determined that when consumers used the Global Privacy Control (GPC) — a browser-based tool designed to signal a request to stop the sale or sharing of data — Disney limited the request to the specific device being used, even if the consumer was logged into their account.

Under the settlement, Disney must revise its opt-out processes to ensure requests apply across all relevant devices and services tied to a user’s account, in line with CCPA requirements.