Children’s Privacy Breach Costs Disney $10 Million

Disney has agreed to pay a $10 million penalty after the Federal Trade Commission found the company failed to protect children’s data on YouTube.

The FTC said Disney did not properly label some videos as “Made for Kids,” a requirement under federal law to prevent data collection and targeted advertising for users under 13.

The Children’s Online Privacy Protection Act, or COPPA, requires parental consent before collecting information from children.

“Our order penalizes Disney’s abuse of parents’ trust, and, through a mandated video-review program, makes room for the future of protecting kids online — age assurance technology,” FTC Chairman Andrew Ferguson said in a statement.

Disney responded, saying it remains committed to child privacy. “Supporting the well-being and safety of kids and families is at the heart of what we do,” the company said.

“This settlement does not involve Disney owned and operated digital platforms but rather is limited to the distribution of some of our content on YouTube’s platform. Disney has a long tradition of embracing the highest standards of compliance with children’s privacy laws, and we remain committed to investing in the tools needed to continue being a leader in this space.”

The FTC complaint explained that YouTube had notified Disney in June 2020 that around 300 videos from films like The Incredibles, Coco, Toy Story, Tangled, and Frozen were not labeled correctly.

YouTube redesignated the videos, but Disney continued to post child-focused content to channels labeled “Not Made for Kids.” This included cartoons, sing-alongs, and storytime videos with actors reading children’s books.

Because of these errors, YouTube collected personal data from viewers and displayed targeted ads on Disney’s behalf. The FTC also noted that some features, such as comments and autoplay, are disabled on “Made for Kids” videos, which were not properly applied to many Disney uploads.

Under the settlement, Disney must maintain an Audience Designation Program to correctly classify all videos posted to YouTube. The agreement also allows YouTube to introduce age assurance technology to automatically determine viewers’ ages, removing the need to tag individual videos.

Disney has a strong reputation in children’s media, but this case shows that even big companies can make mistakes online. The settlement and new classification system are steps in the right direction for protecting kids’ privacy. What do you think about Disney’s $10 million penalty and how it handles children’s data? Share your thoughts in the comments.