Written by: Haim Ravia, Dotan Hammer
California AG Settles with Disney for $2.75 Million Over CCPA Violations. California Attorney General Rob Bonta announced a $2.75 million settlement with the Walt Disney Company, the largest civil penalty to date under the California Consumer Privacy Act (CCPA). The settlement resolves allegations that Disney failed to fully effectuate consumers’ requests to opt out of the sale or sharing of their data across all devices and streaming services associated with their Disney accounts.
The investigation, stemming from a January 2024 investigative sweep of streaming services, found that Disney’s opt-out processes did not allow consumers to completely stop all sales or sharing of their data, even when logged into their accounts. Disney’s webform allegedly limited sharing only within its own advertising ecosystem while continuing to disclose to third-party ad-tech partners. Opt-out toggles and Global Privacy Control signals reportedly applied only to the specific service or device where the request was made, rather than account-wide. Under the settlement, Disney must pay the civil penalties and implement opt-out methods that fully stop the sale or sharing of consumers’ personal information across all its properties. The settlement represents the seventh enforcement action under the CCPA.
UK ICO Fines Reddit £14.47 Million for Children’s Privacy Violations. The UK Information Commissioner’s Office (ICO) announced a £14.47 million fine against Reddit for failing to use children’s personal information lawfully. The ICO’s investigation found that Reddit failed to implement any robust age verification mechanism and therefore lacked a lawful basis for processing the personal information of children under the age of 13. Reddit was also found to have failed to carry out a data protection impact assessment to evaluate and mitigate risks to children prior to January 2025.
Although Reddit’s terms of service prohibited children under 13 from using the platform, the company did not introduce age assurance measures until July 2025, when it began requiring age verification for mature content and asking users to declare their age upon creating an account. The ICO informed Reddit that relying on self-declaration presents risks to children, as it is easy to bypass. UK Information Commissioner John Edwards stated that companies operating online services likely to be accessed by children have a responsibility to ensure those children are protected. Reddit has announced its intention to appeal the fine.
Click here to read the California Attorney General’s announcement of the Disney settlement.
Click here to read the ICO’s announcement of the Reddit fine.
