Disney Plus

STREAMING & ENTERTAINMENT

LAST UPDATED 1 OCT 2026

OF 100

PARANOIA SCORE

WHAT THE POLICIES SAY

Disney+ operates under The Walt Disney Company's centralized privacy policy, which discloses collection of a broad range of personal information — including location, device, and activity data — gathered directly, from linked platforms, and from advertising and analytics partners. The policy states Disney may "sell" or "share" personal information with third parties or use it for "targeted advertising." The company's privacy-related track record includes a 2025 FTC COPPA settlement concerning children's data collected via Disney's YouTube channels, a 2011 COPPA settlement involving subsidiary Playdom, and civil litigation stemming from a 2024 corporate data breach — none of which is alleged to have involved the Disney+ application itself. Separately, in a 2024 wrongful-death suit over a restaurant death at Disney Springs, Disney's lawyers argued that the terms of a Disney+ free trial the plaintiff signed up for in 2019 required the case to go to arbitration; Disney later waived arbitration, and the suit was voluntarily dismissed in February 2026, per Allergic Living.

TRACK RECORD

3 ENFORCEMENT ACTIONS

[2025-12-31]

In December 2025, a federal judge approved a $10 million FTC settlement against Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC resolving allegations that Disney enabled the unlawful collection of children's personal data through improperly labeled "Made for Kids" videos on YouTube.

ftc.gov ↗

[2025-09-03]

The FTC's September 2025 complaint alleged that Disney's practices related to videos posted on its YouTube channels violated the COPPA Rule by failing to designate some child-directed videos as "Made for Kids," allowing collection of children's personal information without parental notice or consent.

consumer.ftc.gov ↗

[2025-09-02]

In a September 2, 2025 press release, the FTC announced that Disney would pay $10 million to settle FTC allegations under the Children's Online Privacy Protection Rule (COPPA). The FTC alleged, via a complaint filed by the Department of Justice, that Disney failed to properly label some videos it uploaded to YouTube as 'Made for Kids,' which allowed personal data to be collected from children under 13 viewing child-directed videos and used for targeted advertising. The allegations concern Disney's YouTube channels, not the Disney+ service, and the release describes a proposed settlement of allegations.

ftc.gov ↗

TIMELINE

2 ENTRIES

[2026-10-01] · NEW RECEIPTS

6 new sources on file for Disney Plus.

Disney Plus's file gained 6 new sourced claims since its last review.

web.archive.org ↗

[2026-09-01] · NEW RECEIPTS

11 new sources on file for Disney Plus.

Disney Plus's file gained 11 new sourced claims since its last review.

privacy.thewaltdisneycompany.com ↗

ULTIMATE PARENT

TOOLS WE RECOMMEND

PLUS

RECEIPTS

17 ON FILE

COLLECTION

For California/US state privacy notices, Disney discloses that categories of personal information collected can include identifiers, demographic information, commercial information, internet/network activity, geolocation data, and audio/visual information, along with inferences drawn from that data.

privacy.thewaltdisneycompany.com ↗

[2025-09-30] · COLLECTION

Disney's privacy policy discloses collection of location information (precise or approximate), device/IP-associated identifiers, and "activity information" about users across its sites, applications, and physical properties, including via beacon technologies.

privacy.thewaltdisneycompany.com ↗

OWNERSHIP TRANSPARENCY

For Korea, Disney's supplemental privacy policy identifies "The Walt Disney Company (Korea), LLC" as the specific data controller for Disney+ users in that jurisdiction, distinct from the global Walt Disney Company entity.

disneyplus.com ↗

[2023-11-01] · OWNERSHIP TRANSPARENCY

Disney's corporate ownership of the Hulu streaming service, which is bundled and integrated with Disney+, was clarified through a series of publicly disclosed transactions; Disney announced in November 2023 it would purchase Comcast/NBCUniversal's remaining 33% stake in Hulu, with the acquisition ultimately closing in 2025.

thewaltdisneycompany.com ↗

SHARING

Disney's US state privacy rights notice discloses that the company may "sell" or "share" personal information with third parties, including for targeted advertising purposes.

privacy.thewaltdisneycompany.com ↗

[2024-07-15] · TRACK RECORD

Variety reported on July 15, 2024 that Disney was investigating a hack of the company's internal Slack channels. Per Variety, a group calling itself Nullbulge claimed to have obtained and leaked more than 1 terabyte of data from Disney's internal Slack channels, and the Wall Street Journal, which first reported the story, viewed files described as including conversations about maintaining Disney's corporate website, software development, and candidate assessments. The report describes Disney's internal corporate messaging data, not Disney+ subscriber data, and the claims about the data's scope are the group's and the outlet's, with Disney stating only that it was investigating.

variety.com ↗

[2024-08-14] · TRACK RECORD

NPR reported on August 14, 2024 that, in a Florida wrongful-death suit brought by Jeffrey Piccolo over the death of his wife, Dr. Kanokporn Tangsuan, after she ate at a Disney Springs restaurant, Disney's lawyers filed a motion in late May asking the court to order Piccolo to arbitrate the case rather than litigate it. Per NPR, the stated reason was a clause in the terms of use Piccolo accepted when he created a Disney+ account for a monthlong trial in 2019, which say that 'any dispute between You and Us, Except for Small Claims, is subject to a class action waiver and must be resolved by individual binding arbitration.' Piccolo's lawyers called that argument 'outrageously unreasonable and unfair.' This describes Disney's legal argument as reported, not a ruling by any court, and the underlying suit concerned a restaurant meal, not the Disney+ service.

web.archive.org ↗

[2024-08-19] · TRACK RECORD

Deadline reported on August 19, 2024 that Disney was waiving arbitration in the Piccolo wrongful-death suit. Per Deadline, Walt Disney Parks and Resorts had argued that by signing up for a free 30-day Disney+ trial in 2019, and again when buying theme park tickets through his Disney+ account in 2023, plaintiff Jeffrey Piccolo agreed to terms under which 'all disputes' with 'The Walt Disney Company or its affiliates' go to arbitration; the company then said it had waived that arbitration and would 'have the matter proceed in court.' Deadline quotes Disney Experiences Chairman Josh D'Amaro describing the decision as a 'sensitive approach' to the family's loss. The report concerns Disney's procedural position in the suit, not the merits of the claim.

deadline.com ↗

[2024-10-10] · TRACK RECORD

Disney faced a proposed class action lawsuit filed in October 2024 in Los Angeles Superior Court alleging negligence and breach of implied contract following a July 2024 data breach in which roughly 1.1TB of internal Slack data — including guest and employee personal information — was exposed by a hacker.

classaction.org ↗

[2025-05-05] · TRACK RECORD

SecurityWeek reported on May 5, 2025, citing the Justice Department, that Ryan Mitchell Kramer, 25, of California, has pleaded guilty to accessing a computer and obtaining information and to threatening to damage a protected computer, in connection with the 2024 hack of Disney's internal Slack channels that he carried out while posing as the NullBulge 'hacktivist' group. Per SecurityWeek, Kramer got in using credentials stored on an employee's personal computer, which gave access to the Slack account the employee used for his Disney job, and stole data from thousands of Slack channels. The report concerns Disney's internal corporate Slack, not the Disney+ app or subscriber data.

securityweek.com ↗

[2025-09-02] · TRACK RECORD

ftc.gov ↗

[2025-09-03] · TRACK RECORD

consumer.ftc.gov ↗

[2025-12-31] · TRACK RECORD

ftc.gov ↗

[2026-03-03] · TRACK RECORD

Allergic Living reported on March 3, 2026 that Jeffrey Piccolo voluntarily dismissed his wrongful-death lawsuit against Walt Disney Parks and Resorts, Raglan Road Irish Pub and its owner on February 27, 2026, with a notice that 'voluntarily dismisses with prejudice all causes of action.' Piccolo's attorney told the outlet only that 'the case has been resolved,' and Allergic Living states it is unclear whether the suit was simply dropped or financially settled. The outlet also recounts that Disney's May 2024 motion argued the Disney+ trial terms required arbitration, and that Disney dropped its bid to force arbitration in August 2024 'following a barrage of public backlash.' No court ruling on the merits or on the arbitration question is reported.

web.archive.org ↗

[2026-06-22] · TRACK RECORD

In 2011, the FTC obtained a $3 million settlement against Playdom, Inc. — which became a Disney subsidiary in August 2010 — over allegations it collected personal information from over 400,000 children under 13 without parental consent across roughly 20 virtual-world websites.

legalclarity.org ↗

[2024-02-20] · TRACKING TECH

Disney's Privacy Center states that the company monitors user and device activity on its sites and applications using tracking technologies including cookies and Flash cookies.

privacy.thewaltdisneycompany.com ↗

[2025-09-30] · TRACKING TECH

The privacy policy discloses that Disney may collect precise or approximate location data from a device interacting with its sites or applications through beacon technologies, a location-tracking mechanism distinct from standard cookies.

privacy.thewaltdisneycompany.com ↗

LAST REVIEWED 2026-10-01 · METHODOLOGY v1.7