The FTC alleged that Disney did not label YouTube videos aimed at children as ‘Made for Kids’, so personal data was collected from viewers under 13 without notice to or consent from parents. A court approved an order requiring Disney to pay $10 million, follow the children’s privacy rule, and run a programme to review which videos should carry the label.
On 31 December 2025, the Federal Trade Commission announced that a federal judge had approved an order requiring Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC to pay $10 million. The Department of Justice filed the complaint in September 2025, on a referral from the FTC, under the Children's Online Privacy Protection Rule, known as COPPA.
The case is about YouTube. Following a 2019 settlement with the FTC, YouTube asks creators to mark each video as "Made for Kids" or "Not Made for Kids". The complaint alleged that Disney set this designation at the channel level rather than video by video, so some videos aimed at children were not labelled as made for kids. According to the FTC, that allowed YouTube to collect personal data from viewers under 13 without notice to or consent from their parents, and to use it for targeted advertising. The complaint also said YouTube told Disney in mid-2020 that it had changed the designation on more than 300 Disney videos, and that Disney receives a share of the advertising revenue YouTube earns on its videos.
Under the order, Disney must pay $10 million and follow the COPPA Rule, including notifying parents and getting their verifiable consent before collecting personal information from children under 13. It must also set up a program to review whether its YouTube videos should be designated as made for kids. That program is not needed if YouTube brings in age assurance technology, or stops letting creators use the label.
No data was hacked or leaked here. The case turned on a setting: an audience label chosen once for a whole channel.
It sits beside a larger case on children's data. In August 2026, TikTok and its parent company ByteDance agreed to pay $400 million to settle the Department of Justice's claims that children under 13 were let onto the app without their parents' consent.
The questions apply to any business whose content or site reaches children: who decides which audience each page or video is for, whether that choice is made item by item, what the tags on the page collect, and whether any of it happens before a visitor's age is known.
Why it matters for your siteHow content is labelled on a platform you do not own can decide whether children’s data is collected.
The transcript
Ten million dollars. That's what Disney was ordered to pay, under an order a federal judge approved at the end of 2025. It settled claims from the Federal Trade Commission under the children's privacy law, COPPA.
So what was it accused of? Since a 2019 settlement with the FTC, YouTube has asked creators to mark each video as made for kids, or not. The complaint alleged that Disney set that label once, for whole channels, instead of video by video. So some videos aimed at children weren't labelled as made for kids.
Why does that matter? The FTC alleged that the missing label let YouTube collect personal data from viewers under thirteen, without telling parents or asking for consent, and use it for targeted ads. It said YouTube told Disney in mid-2020 that it had changed the label on more than three hundred Disney videos.
And what did it pay? Ten million dollars. Disney must also follow the children's privacy rule, telling parents and getting their consent before collecting data from children under thirteen. And it must run a program to review which videos should carry the label, unless YouTube brings in age checks of its own. The Justice Department filed the case, on a referral from the FTC.
Notice what this was not. No hacker. No leaked database. Just a setting: one label, chosen once, for a whole channel.
And it's not alone. In August 2026, TikTok and its parent company, ByteDance, agreed to pay four hundred million dollars to settle the Justice Department's claims that children under thirteen got onto the app without their parents' consent.
Children's data now turns on small choices. Who is the content for? Who set the label? And what do the tags on a page collect before anyone knows a visitor's age?
That's what Tolbrook checks. We go through your site the way a shopper would, and show you what we find, with the evidence.
Read our sector reviews at tolbrook dot com slash reports. Find it. Fix it. Watch it.
Each summary is ours, drawn from the public announcement it links to. Allegations are the regulator’s own, and a settlement usually comes without any admission. This page reports what was announced. It is not legal advice, and it says nothing about any site we audit.
Find these problems before anyone else does
The digital compliance problems behind actions like these are the ones we look for. We find them on your site and show you exactly where each one sits.