Disney Ordered to Pay $10 Million After Feds Say Kids’ Data Was Collected Without Parental Consent

The Walt Disney Company has agreed to pay a $10 million civil penalty to settle allegations that it violated U.S. children’s privacy laws in connection with online content distributed on YouTube, the U.S. Department of Justice announced. The lawsuit stemmed from claims that Disney failed to properly label some videos as being directed at children, which allowed the collection of personal data from children under the age of 13 without parental consent.

According to Reuters, the government’s complaint, referred to the Justice Department by the Federal Trade Commission (FTC), said Disney “failed to properly label certain uploaded videos as ‘Made for Kids,’ which enabled the collection of personal data from children under 13 without adequate parental consent.” The mislabeling, regulators said, permitted targeted advertising to children and exposed young viewers to features normally restricted under child-directed content rules.

The penalty settles allegations that Disney violated the Children’s Online Privacy Protection Act (COPPA), a federal rule requiring websites, apps, and online services that collect personal data from children under 13 to notify parents and obtain verifiable consent before doing so. Under the settlement, Disney must also establish a compliance program to ensure future adherence to COPPA’s requirements in its YouTube operations.

In response to the case, Disney stated, “Disney has a long tradition of embracing the highest standards of compliance with children’s privacy laws, and we remain committed to investing in the tools needed to continue being a leader in this space.”

The settlement, which finalizes terms first announced earlier this year, underscores increased regulatory scrutiny on how major media companies classify and manage content aimed at children online.

This penalty follows a broader trend of enforcement under COPPA, which seeks to protect children’s privacy in the digital age by limiting data collection without parental knowledge or consent.