Disney $2.75M CCPA Settlement Over Failed Opt Out of Data Sale Across Apps

California’s Consumer Privacy Act (CCPA) gives residents the right to tell businesses not to “sell” or “share” their personal information—terms that can include certain ad-tech disclosures, cross-app tracking, and data passed to third parties via embedded code. The dispute here centers on how modern streaming ecosystems work in practice: users often access Disney+, Hulu, and ESPN+ across multiple devices under one account, while behind the scenes various identifiers and tracking tools help personalize ads and measure engagement. Regulators argue that if an opt-out is supposed to stop data selling/sharing, it should be easy to find, easy to use, and effective across the consumer’s relationship with the company, not limited to a single app screen or device. California Attorney General Rob Bonta pursued the case alleging Disney’s opt-out mechanisms were confusing and incomplete—sometimes applying only to the specific service (e.g., Disney+ but not Hulu), only to the device used to submit the request, or only to Disney’s own ad systems while still allowing third-party data flows through tracking code. That alleged gap between what consumers reasonably expect from an opt-out and what technically occurred is why the $2.75 million settlement is significant: it’s described as the largest CCPA settlement to date and requires operational changes, not just a payment. Disney agreed to implement clearer “Do Not Sell or Share” style notices, an easier opt-out process, account-wide opt-outs for logged-in users across its streaming services, a way to confirm opt-out status, and ongoing compliance monitoring and reporting—key remedies under privacy enforcement because they change how the product works going forward. Broader implications extend beyond Disney because many companies have built opt-outs that function more like cookie/device settings than true account-level choices, and regulators are increasingly scrutinizing whether “global” signals like Global Privacy Control (GPC) are honored in a meaningful way. The CCPA (as amended by the CPRA) and enforcement expectations push businesses toward frictionless, conspicuous opt-outs and consistent treatment across platforms, especially when data sharing supports targeted advertising—an area where other major tech and media companies have faced similar complaints from regulators and plaintiffs. This settlement reinforces a growing compliance trend in streaming and ad-supported apps: opt-out rights must be implemented end-to-end across devices, services, and third-party integrations, not just presented as a checkbox that only partially works