The Attorney General alleged that Disney’s opt-out choices worked only partly. Toggles applied to one service or device rather than the whole account, the web-form opt-out still let embedded third-party ad tech receive data, and Global Privacy Control signals applied to one device even when users were logged in. Disney agreed to pay $2.75 million and to put in place opt-out methods that fully stop sale and sharing across its businesses and products.
On 11 February 2026, California Attorney General Rob Bonta announced a $2.75 million settlement with the Walt Disney Company over how it handled requests to stop selling or sharing personal data. His office called it the largest settlement to date under the California Consumer Privacy Act. The case grew out of a January 2024 sweep of streaming services, and it was the second action to come from that sweep.
The Attorney General alleged that Disney's opt-outs worked only in part. A toggle on its sites and apps applied to the service a person was watching, and often only to the device in hand, so the request did not reach the rest of the account. Its webform stopped data going through Disney's own advertising platform, but not to third-party ad-tech companies whose code was built into its sites and apps. Many of its connected TV apps had no in-app opt-out at all. And a Global Privacy Control signal counted on one device only, even for people who were logged in.
Disney agreed to pay $2.75 million. Under the settlement it must also put in place opt-out methods that fully stop its selling and sharing of people's personal information.
Nothing here involved a hacker or a leaked database. The claims were about the ordinary tags that load on a website or app: ad-tech code that keeps receiving data after a person has said no. That is why a working opt-out has to reach every tag, not just the company's own systems.
Disney is not the only streaming service the office has looked at. In October 2025, Sling TV settled with the Attorney General for $530,000. The office alleged, among other things, that Sling sent people to cookie settings instead of offering a proper opt-out tool.
Any business that sells or shares data through its website can ask itself a few plain questions. When someone says no, does that choice follow them across every device and service tied to their account? Does it stop third-party tags as well as your own? And do your tags stop when a browser sends a Global Privacy Control signal?
Why it matters for your siteAn opt-out has to follow the person across every device and service tied to their account.
The transcript
Two point seven five million dollars. That's what Disney agreed to pay California's Attorney General, in the largest settlement yet under the state's consumer privacy law. It came out of a 2024 sweep of streaming services.
So what was it accused of? The Attorney General alleged that when people asked Disney to stop selling or sharing their data, the request didn't follow them. It often worked on one device, or one streaming service, and not across their whole account.
Here are the specifics. The opt-out toggle on Disney's sites and apps covered only the service being watched, and often only that device. Its webform stopped Disney's own ad platform, but not the third-party ad-tech code built into its sites and apps. And Global Privacy Control signals counted on one device only, even for logged-in users.
And what did it pay? Two point seven five million dollars, in a settlement with the Attorney General. Disney must also put in opt-out methods that fully stop its selling and sharing of people's data.
Notice what this was not. No hacker. No leaked database. Just ordinary ad tracking, and an opt-out that stopped short.
And it's not alone. In 2025, the same office settled with Sling TV for five hundred and thirty thousand dollars, alleging, among other things, that it sent people to cookie settings instead of a proper opt-out.
Regulators now look for exactly that gap: between the choice a brand says it gives its customers, and what its website actually does. Most brands can't say whether a no reaches every tag, or whether their tags stop when the browser asks them to.
That's what Tolbrook checks. We go through your site the way a shopper would, and show you what we find, with the evidence.
Each summary is ours, drawn from the public announcement it links to. Allegations are the regulator’s own, and a settlement usually comes without any admission. This page reports what was announced. It is not legal advice, and it says nothing about any site we audit.
Find these problems before anyone else does
The digital compliance problems behind actions like these are the ones we look for. We find them on your site and show you exactly where each one sits.