DaVita Ransomware Attack: 2.7 Million Individuals ImpactedCOPPA Enforcement: Disney to Pay $10M for Children’s Privacy Violations

The Federal Trade Commission announced that Disney will pay $10 million to settle allegations that it violated the Children’s Online Privacy Protection Act by mislabeling YouTube videos and allowing the unlawful collection of personal data from children under 13.

Disney marked its entire YouTube channels as “Not Made for Kids”, even though many videos were clearly directed at children.

As a result, YouTube collected personal information (like identifiers used for targeted ads) from kids watching these videos.

The videos included popular child-directed content from Frozen, Toy Story, Mickey Mouse, Coco, and The Incredibles.

Even after YouTube flagged more than 300 misclassified videos in 2020, Disney continued its practice of channel-level designations.

Photo: https://pl.freepik.com/

Under the proposed settlement:

✅ Disney will pay a $10 million civil penalty.

✅ The company must comply with COPPA by notifying parents and obtaining verifiable consent before collecting data from children under 13.

✅ Disney must establish a video review program to ensure child-directed content is properly labeled, unless YouTube implements age assurance technologies that can automatically protect children across the platform.

The COPPA Rule is clear: websites, apps, and online services directed to children must notify parents and obtain consent before collecting personal information.

This is a perfect example of why complying with children’s privacy rules is crucial, even in the U.S. When we provide services here and process PII, we must understand and follow different privacy regulations. For children’s data, COPPA applies at the federal level — and at the state level, additional regulations like CCPA and others also protect minors. Organizations cannot afford to ignore these obligations when handling children’s data.

Author: Sebastian Burgemejster