A federal judge has approved an order requiring Disney to pay $10 million to settle Federal Trade Commission allegations that the entertainment giant violated federal children's privacy protections by enabling the unlawful collection of personal data from minors on YouTube.
The settlement resolves FTC allegations that Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC violated the Children's Online Privacy Protection Rule by failing to properly designate certain videos as child-directed content on YouTube. The Department of Justice filed the complaint in September following notification and referral from the FTC.
According to the complaint, Disney violated COPPA by failing to properly label videos it uploaded to YouTube as "Made for Kids." This mislabeling allowed YouTube to collect personal data from children under 13 who viewed child-directed videos without obtaining the required parental notification and consent. The collected data was then used for targeted advertising directed at children.
The Children's Online Privacy Protection Rule requires websites and online services to obtain verifiable parental consent before collecting, using, or disclosing personal information from children under 13. The rule also mandates that operators provide clear notice to parents about their data collection practices involving children.
The case highlights the complex challenges facing content creators and platforms in complying with children's privacy regulations in the digital age. YouTube's system relies on content creators to accurately designate whether their videos are directed at children, a determination that affects how personal data can be collected and used.
When videos are properly labeled as "Made for Kids," YouTube disables certain features that could collect personal information from child viewers, including personalized advertising, comments, and notifications. However, when videos targeting children are not properly designated, these privacy protections are not activated.
Under the court-approved settlement order finalized last week, Disney faces several requirements beyond the monetary penalty. The company must fully comply with COPPA, including providing proper parental notification before collecting personal information from children under 13 and obtaining verifiable parental consent for the collection and use of that data.
The settlement also includes a forward-looking provision that requires Disney to establish and implement a comprehensive program to review whether videos posted to YouTube should be designated as "Made for Kids." This requirement will remain in effect unless YouTube implements age assurance technologies that can determine the age, age range, or age category of all users, or unless the platform no longer allows content creators to self-designate videos as child-directed.
This provision reflects the FTC's recognition of evolving technological solutions for protecting children online. Age assurance technologies, which can verify user ages without collecting excessive personal information, represent a potential solution to the current system's reliance on content creator self-designation.
The Disney settlement comes as federal regulators continue to scrutinize how major technology platforms and content creators handle children's data. The FTC has previously taken action against YouTube itself, resulting in a $170 million settlement in 2019 for similar COPPA violations.
For parents and families, the case underscores the importance of understanding how children's personal information is collected and used across digital platforms. While COPPA provides important protections, enforcement relies heavily on proper implementation by companies and platforms.
The entertainment industry faces particular challenges in navigating children's privacy requirements, as content that appeals to children often generates significant advertising revenue. The tension between commercial interests and privacy protection continues to drive regulatory scrutiny and enforcement actions.
Disney's settlement demonstrates the financial consequences companies face when children's privacy protections are not properly implemented. The $10 million penalty, while substantial, represents a fraction of Disney's overall revenue but sends a clear message about the importance of COPPA compliance.
The case also highlights the shared responsibility between content creators and platforms in protecting children's privacy online. As digital content consumption among children continues to grow, proper implementation of privacy safeguards becomes increasingly critical.
Looking ahead, the settlement's emphasis on age assurance technologies may signal a shift toward more automated solutions for protecting children's privacy online. Such technologies could reduce reliance on content creator designations while providing more robust protections for young users.
The approved settlement order represents the conclusion of the FTC's investigation into Disney's YouTube practices, but regulators continue to monitor compliance with children's privacy laws across the digital landscape. As technology evolves, enforcement efforts are likely to adapt to address new challenges in protecting children's personal information online.