Disney fined $10M for illegally tracking children on YouTube

A US federal court has approved a settlement between Disney and the Federal Trade Commission (FTC), requiring the company to pay $10 million for unlawfully collecting personal data from children under 13 via YouTube content. The investigation found that Disney violated COPPA by bypassing safeguards designed to protect children’s online privacy.

According to the complaint, Disney systematically labeled its YouTube videos as “not made for kids,” despite a significant portion of the content being clearly aimed at children. This classification allowed YouTube to collect personal data and serve personalized ads, a practice strictly prohibited for users under 13 without parental consent.

The issue was further compounded by Disney’s decision to apply this setting at the channel level rather than labeling individual videos. As a result, child-oriented content was effectively treated as adult content for advertising and tracking purposes.

The FTC stated that this approach enabled Disney to sidestep children’s privacy protections for years while benefiting financially from data-driven advertising.

The complaint was filed in September 2025 under the Children’s Online Privacy Protection Act (COPPA), which requires companies to notify parents and obtain verifiable consent before collecting personal data from children.

In addition to the financial penalty, the court ordered Disney to implement an internal compliance program to review and properly label each YouTube video as either made for kids or not made for kids. The company must also fully comply with COPPA’s parental notice and consent requirements.

The FTC chair described the ruling as “a major win for parents,” emphasizing that children should not be illegally tracked online.

This case highlights how even major media corporations can systematically undermine digital privacy rules through technical and administrative loopholes. The Disney fine sends a clear message to the industry: mislabeling content does not exempt companies from responsibility, especially when children’s data is involved.