Children’s Data Breach Is About to Cost Disney $10 Million
Disney has agreed to pay a $10 million civil penalty after the Federal Trade Commission found that the company allowed children’s data to be collected from YouTube videos.
The FTC said Disney failed to mark some of its videos as “Made for Kids,” a designation required by law to protect children from targeted advertising.
The Children’s Online Privacy Protection Act, or COPPA, requires parental consent before collecting data from users under 13.
According to the FTC, Disney’s practices on YouTube violated that law. “Our order penalizes Disney’s abuse of parents’ trust, and, through a mandated video-review program, makes room for the future of protecting kids online — age assurance technology,” FTC Chairman Andrew Ferguson said in a statement.
Disney responded, saying it is committed to following child privacy laws. “Supporting the well-being and safety of kids and families is at the heart of what we do,” the company said.
“This settlement does not involve Disney owned and operated digital platforms but rather is limited to the distribution of some of our content on YouTube’s platform. Disney has a long tradition of embracing the highest standards of compliance with children’s privacy laws, and we remain committed to investing in the tools needed to continue being a leader in this space.”
The issue stems from YouTube rules requiring content providers to label videos as either “Made for Kids” or not. YouTube had informed Disney in June 2020 that about 300 videos from movies like The Incredibles, Coco, Toy Story, Tangled, and Frozen were incorrectly labeled. While the company adjusted the videos, the problem continued with additional uploads over the following years.
Disney’s policy was to designate videos at the channel level, but many child-focused videos ended up on channels labeled “Not Made for Kids.” This included cartoons, sing-alongs, and storytime videos featuring actors reading children’s books.
The FTC said that because of these mistakes, YouTube collected personal information and served targeted ads on videos directed at children, including on Disney’s behalf.
Under the settlement, Disney must maintain an Audience Designation Program to ensure all videos are properly classified. The agreement also allows YouTube to adopt age assurance technology in the future, which could automatically identify the age of viewers and remove the need to tag individual videos.
Disney has long been seen as a leader in children’s content, but this case shows how strict oversight is needed in the digital space. The settlement and the new classification program are steps in the right direction. What do you think about Disney’s fine and how it handles children’s data online? Share your thoughts in the comments.