The US Department of Justice has finalized a $10 million civil penalty against Disney for violations of the Children’s Online Privacy Protection Act (COPPA), marking the formal resolution of allegations that the media giant unlawfully collected data from children on YouTube without obtaining parental consent.
The court-approved settlement follows a complaint filed by the DOJ in September 2025, acting on behalf of the Federal Trade Commission (FTC). The complaint accused Disney Worldwide Services Inc. and Disney Entertainment Operations LLC of failing to properly designate child-directed content on YouTube, which enabled unauthorized collection of personal data and targeted advertising aimed at viewers under the age of 13.
The investigation revealed that Disney classified entire YouTube channels, comprising tens of thousands of videos, as “Not Made for Kids” (NMFK), despite the presence of clearly child-targeted content. Characters from beloved Disney franchises such as Frozen, Moana, Toy Story, and Mickey Mouse featured prominently in many of these videos, which were nevertheless mislabeled, leading to violations of COPPA’s core requirement for verifiable parental consent prior to data collection.
Disney, one of the world’s most influential entertainment companies, operates a vast online content portfolio through platforms like YouTube, where its videos attract billions of views. The FTC’s complaint underscored the company’s decision to apply audience settings at the channel level rather than per video, despite YouTube’s introduction of the “Made for Kids” (MFK) designation system in 2019 following its own COPPA enforcement action.
Even after YouTube notified Disney in mid-2020 that it had reclassified more than 300 of its videos from NMFK to MFK, Disney continued to rely on its default policy. The company made no substantial effort to correct existing misclassifications or implement systemic changes, according to court documents. This negligence allowed behavioral advertising and tracking on child-directed content, a direct breach of COPPA’s safeguards designed to protect children’s digital privacy.
Under the stipulated order entered by the US District Court for the Central District of California, Disney must not only pay the $10 million penalty but also adhere to a permanent injunction prohibiting future COPPA violations. The order mandates the creation of a robust Audience Designation Program requiring Disney to individually assess and label each video uploaded to YouTube. This compliance mechanism is intended to ensure that any video targeting children is appropriately designated and that personal data is not collected without the required parental consent.
Additionally, Disney must:
- Provide clear notice to parents and obtain verifiable parental consent before collecting data from users under 13.
- Implement annual staff training on COPPA compliance and video classification procedures.
- Maintain comprehensive compliance records for a period of 10 years.
This case reinforces that large content providers cannot delegate their legal responsibilities to hosting platforms like YouTube. As FTC Chairman Andrew N. Ferguson noted in earlier remarks, the outcome sends a clear message that regulators expect both platforms and content creators to adopt proactive measures, such as age assurance technologies, to comply with evolving privacy standards.
From the parents’ perspective, they should review the privacy settings of accounts used by their children, limit data collection, and enable YouTube’s “Restricted Mode” or use parental features where available.
Leave a Reply