[Enforcement library](/enforcement)

# Disney: check whether opt-outs reach every linked service

You can test an opt-out across devices and linked services. Disney’s 2026 settlement concerns gaps between those scopes.

California DOJ · CCPA · Settlement announced 11 February 2026

- Case record
- What happened
- Technical behaviour
- Checks for your own systems
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Authority | California Department of Justice (DOJ) |
| Defendants | Disney DTC, LLC and ABC Enterprises, Inc. |
| Jurisdiction and law | California, US · California Consumer Privacy Act (CCPA) and Unfair Competition Law |
| Action | Settlement and stipulated judgment |
| Announced | 11 February 2026 |
| Amount | USD 2.75 million in civil penalties |
| Source review | 16 October 2026 |

The judgment names Disney DTC, LLC and ABC Enterprises, Inc. The parties agreed to terms without a trial or an admission of liability. [Judgment, pages 1–3](https://oag.ca.gov/system/files/attachments/press-docs/CA_SUP_LAX_26STCV04425__Final_Judgment_and_Permanent_Injunction.pdf)

## What happened

The DOJ alleged that Disney’s opt-outs did not stop all sale or sharing across devices and services linked to a consumer’s account. The settlement covers Disney+, Hulu, and ESPN+. [DOJ announcement](https://oag.ca.gov/news/press-releases/california-wont-let-it-go-attorney-general-bonta-announces-275-million)

The settlement sets USD 2.75 million in civil penalties. Its terms call for opt-outs that reach associated services and an account choice that consumers can check. [Judgment, paragraphs 26–28 and 36](https://oag.ca.gov/system/files/attachments/press-docs/CA_SUP_LAX_26STCV04425__Final_Judgment_and_Permanent_Injunction.pdf)

## Technical behaviour

The DOJ described GPC opt-outs that applied only to the current device, even when a consumer logged into an account. Global Privacy Control (GPC) is a browser opt-out signal. These are allegations that the settlement resolves. [DOJ announcement](https://oag.ca.gov/news/press-releases/california-wont-let-it-go-attorney-general-bonta-announces-275-million)

Inth’s technical interpretation: a device choice and an account choice can reach different systems. A browser toggle cannot show whether another linked service received the same decision.

## Checks for your own systems

### In the repository

- Find where GPC becomes a decision about data use.
- Trace the decision to the account, device, and linked services.
- Check which rules apply before and after login.
- Find queues or server jobs that use an older choice.

### In the browser and network

- Use invented accounts on 2 test devices.
- Send GPC on 1 device while logged in.
- Check the account choice and data transfers on the other device.
- Repeat the test before login and after login.

### With the people responsible for data use

- Agree which services and profiles each choice covers.
- Compare that scope with the privacy text and signed contracts.
- Check evidence from systems that browser captures cannot show.

## Sources and limits

[DOJ announcement, 11 February 2026](https://oag.ca.gov/news/press-releases/california-wont-let-it-go-attorney-general-bonta-announces-275-million) · [Complaint](https://oag.ca.gov/system/files/attachments/press-docs/1%20-%20Complaint%20%28Disney%29.pdf) · [Judgment](https://oag.ca.gov/system/files/attachments/press-docs/CA_SUP_LAX_26STCV04425__Final_Judgment_and_Permanent_Injunction.pdf).

Source review: 16 October 2026. This page covers the cited settlement. It does not audit Disney’s current services or establish payment or every later legal action.

Inth wrote these technical checks. They cannot decide which laws apply or prove compliance with a law or contract. Browser captures cannot show all server operations.

Related: [Sephora and opt-out signals](/enforcement/sephora) · [Honda and unequal choices](/enforcement/honda).

[Consent banner](/consent-banner) · [Website audit](/website-audit) · [Code audit](/code-audit)