Disney will pay a $10 million penalty over allegations that it mislabeled videos on YouTube and allowed personal data to be collected from children without notifying parents or getting their consent, the FTC said in an announcement on Tuesday.
The complaint filed in a US District Court alleged that Disney uploaded videos to YouTube in channels that defaulted to “Not Made For Kids” when the videos should have been labeled “Made For Kids.”
Due to the mislabeling, videos intended for children collected more information than they should have and used that information to target advertising to children under 13, the FTC said. The error, which enabled features like autoplay on the videos, allegedly violated COPPA, the Children's Online Privacy Protection Rule.
“Supporting the well-being and safety of kids and families is at the heart of what we do. This settlement does not involve Disney-owned and operated digital platforms, but rather is limited to the distribution of some of our content on YouTube's platform,” a Disney spokesperson told CNET. “Disney has a long tradition of embracing the highest standards of compliance with children's privacy laws, and we remain committed to investing in the tools needed to continue being a leader in this space.”
In addition to the $10 million civil penalty for allegedly violating COPPA, Disney has agreed to ensure COPPA compliance by notifying parents and getting consent for videos that are “Not Made For Kids” and establishing a review program on how videos should be labeled. According to the FTC, “this forward-looking provision reflects and anticipates the growing use of age assurance technologies to protect kids online.”
Separately, the FTC also took COPPA-related action against toy maker Apitor Technology, which makes robots aimed at children ages 6 to 14. The FTC alleges the company collected geolocated information from children via a third-party app in China. The FTC is imposing a $500,000 penalty.
When even big companies ‘miss the mark'
Since COPPA was passed in 1998, technology that can reach young people has evolved dramatically, but enforcement hasn't eased off as regulators shift their expectations of how companies should comply. That can be a challenge even for companies like Disney.
“For any company that interacts with children or collects children's data, getting privacy compliance right means investing in the internal knowledge and resources to meet these evolving standards,” said Cobun Zweifel-Keegan, managing director of the Washington, DC office of the nonprofit International Association of Privacy Professionals.
In addition to the federal rules, there are also state laws that companies have to keep up with.
“This means more protections for consumers and families. It also means a lot of work for privacy teams in a wide variety of organizations,” Zweifel-Keegan told CNET. “As standards change, and given the complex ecosystem involved in providing kids with a safe online experience, even businesses that invest a lot in privacy compliance can miss the mark.
“When they don't, they can miss the mark by a wider margin.”
Disney has missed the mark on child privacy before, however: in 2011, the company paid a $3 million FTC fine over similar allegations against its Playdom social networking service.
“If a company with Disney's reputation is doing this, you can bet many other brands, big and small, are too,” said Mark Weinstein, a privacy expert and author of Restoring Our Sanity Online. “Disney is one of the most trusted brands in the world, yet they knowingly broke the rules. YouTube reportedly warned them in 2019, but Disney still went on for years collecting ad revenue likely worth millions of dollars while hoping they wouldn't get caught.”
Weinstein said there's emerging legislation that may do more to protect kids from targeted ads and other online dangers, especially amid the emergence of AI and increased spyware. “Fines alone won't solve this because dominant companies like Disney and Google pay them as ‘costs of doing business,'” Weinstein said.
