On February 11, 2026, California Attorney General Rob Bonta announced [1] a $2.75 million settlement with the Walt Disney Company (“Disney”), resolving allegations that Disney failed to honor consumers’ requests to opt out of the sale and sharing of their personal data under the California Consumer Privacy Act (“CCPA”) and the Unfair Competition Law (“UCL”). [2] The settlement is the largest civil penalty obtained under the CCPA to date and carries important lessons for any business operating streaming or multi-platform digital services in California.
What Happened
The enforcement action stems from the Attorney General’s (“AG”) January 2024 investigative sweep of streaming services for CCPA compliance. The investigation found that Disney’s opt-out mechanisms were fragmented and incomplete, allowing the company to continue selling and sharing consumer data even after consumers explicitly asked it to stop.
According to the AG, the problems were pervasive across Disney’s opt-out methods. When a logged-in consumer used an opt-out toggle within a Disney website or app, the request was applied only to that specific streaming service and, in many cases, only to the device the consumer was using at the time. A consumer who opted out on Hulu via a smart TV, for example, could still have their data sold through Disney+ on a mobile device — all under the same Disney account.
Disney’s webform fared no better in the eyes of the AG. While it stopped data sharing through Disney’s own advertising platform, it did not stop the flow of consumer data to third-party ad-tech companies whose code was embedded in Disney’s websites and apps. And for consumers who sent opt-out signals through the Global Privacy Control (“GPC”), Disney treated the signal as applying only to the specific device, even when the consumer was logged in to their account.
Disney also failed to provide an in-app opt-out mechanism in many of its connected TV streaming apps, instead directing consumers to a webform. The AG’s office alleged this effectively left those users without a way to stop data sales from those apps.
Why California Acted
The AG’s theory is straightforward: the CCPA’s opt-out right is not a per-device or per-service right. When a consumer asks a business to stop selling their data, the business must stop across all of its systems, services, and devices associated with that consumer. Piecemeal compliance is not compliance.
This action is the seventh CCPA enforcement action by the AG and the second to arise from the 2024 streaming sweep (following the Sling TV settlement in October 2025). It reflects a clear regulatory focus on whether businesses are substantively honoring opt-out requests rather than merely offering an opt-out button.
What the Settlement Requires
Under the proposed Final Judgment and Permanent Injunction (“Judgment”), filed in Los Angeles Superior Court, Disney must implement a consumer-friendly, easy-to-execute opt-out process across all Disney streaming services. When a logged-in consumer opts out—including via a universal Global Privacy Control (GPC) signal—Disney must apply that choice across every streaming service associated with the consumer’s account. The settlement also requires Disney to provide clear and conspicuous notice that it conducts cross-context behavioral advertising using personal information obtained from third parties, and to direct consumers to its opt-out mechanisms.
Disney must report on its compliance progress every 60 days until full implementation and must maintain an ongoing compliance monitoring program for three years, with annual reports to the AG. The $2.75 million penalty is payable within 30 days of the judgment’s effective date.
Takeaway
The message from California’s regulators is unmistakable: offering an opt-out mechanism is not enough. The mechanism must actually work comprehensively, across every platform, device, and service tied to a consumer’s account. Businesses that operate across multiple brands, apps, or device ecosystems should audit their opt-out workflows now to ensure a single consumer request is honored universally. With the AG’s investigative sweep model producing a steady cadence of enforcement actions, the cost of fragmented compliance is rising.
[1] Press Release, Cal. Dep’t of Justice, California Won’t Let It Go: Attorney General Bonta Announces $2.75 Million Settlement with Disney, Largest CCPA Settlement in California History (Feb. 11, 2026), https://oag.ca.gov/news/press-releases/california-wont-let-it-go-attorney-general-bonta-announces-275-million.
[2] Proposed Final Judgment and Permanent Injunction, California v. The Walt Disney Co.(Cal. Super. Ct. Feb. 11, 2026), https://oag.ca.gov/system/files/attachments/press-docs/9%20-%20%5BProposed%5D%20Final%20Judgment%20and%20Permanent%20Injunction.pdf.
