Cross-Service Data Combination and Profiling

What it is

Disney can combine data from all its services and from third parties to build a detailed profile of your personality, habits, and preferences, which it uses for advertising and personalization.

Why it matters (compliance & governance perspective)

A profile built from data across Disney+, Hulu, ESPN+, parks visits, merchandise purchases, and third-party sources could be significantly more detailed than any single service's data, potentially revealing sensitive information about your household and lifestyle.

Consumer impact (what this means for users)

Data from your streaming activity, park visits, purchases, and third-party sources may be combined to create a profile that includes inferences about your psychological traits and aptitudes, which can be used for targeted advertising across Disney's services and beyond.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Profiling and inference-drawing from combined data sets engages GDPR Article 22 (automated decision-making and profiling) for EU/EEA users, which grants users the right to object to profiling and requires transparency about the logic involved when profiling produces legal or similarly significant effects. CPRA classifies inferences drawn to create consumer profiles as personal information subject to access and deletion rights. The FTC's framework on unfair or deceptive practices also applies to misleading profiling disclosures. GOVERNANCE EXPOSURE: Medium. The policy's explicit statement that inferences include 'psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes' is operationally significant because these categories overlap with special category data protections under GDPR and heightened sensitivity expectations under CPRA. The combination of data across multiple services and third-party sources amplifies the depth of profiling possible. JURISDICTION FLAGS: EU/EEA users have GDPR Article 22 rights regarding profiling; the right to object to processing under Article 21 may also apply. California residents have the right to know about and delete inferences held about them under CPRA. Users in other US states with comprehensive privacy laws (Colorado, Connecticut, Virginia, Texas, and others) have similar rights. CONTRACT AND VENDOR IMPLICATIONS: Third-party data contributors to the profiling process should be identified and governed by appropriate data sharing agreements. If inferences are shared with advertising partners, those flows should be documented and disclosed. B2B partners integrating with Disney's data platform should assess whether receiving inferred profile data creates independent obligations under applicable privacy laws. COMPLIANCE CONSIDERATIONS: Compliance teams should assess whether Disney's profiling activities trigger GDPR Article 22 obligations; verify that consumers can access and delete inferences about them through the Privacy Rights Center; review whether third-party data sources used to enrich profiles are disclosed and legally obtained; and confirm that profiling for advertising purposes is covered by the opt-out mechanisms available to California and other covered-state residents.

Applicable agencies

Provision details

Other risks in this policy

• Broad Personal Data Collection medium
• Targeted Advertising and Data Sharing with Third Parties medium
• Children's Privacy and Parental Consent high
• Precise Geolocation Collection medium
• Voice and Audio Data Collection medium
• Data Sharing with Affiliates and Business Partners medium