Disney Privacy Policy

This document is The Walt Disney Company's global Privacy Policy, governing data collection, use, sharing, and consumer rights across Disney's portfolio of digital and physical services including Disney+, ESPN+, Hulu, parks, merchandise, and third-party integrations, with consent and legitimate interest cited as legal bases depending on jurisdiction. The policy states that Disney collects a broad range of personal information including identifiers, device and usage data, precise geolocation, payment information, demographic data, inferences drawn from activity, voice and audio data, and information derived from connected devices and third-party sources; the terms authorize sharing of this information with affiliates, business partners, service providers, and in certain jurisdictions, third parties in ways that may constitute a 'sale' or 'sharing' under applicable state law. The policy's cross-contextual advertising provisions, inference-drawing from viewing and interaction data, and collection of children's information through family account structures are operationally significant; the document states that Disney does not knowingly collect personal information from children under 13 without verifiable parental consent, though the policy governs services used by families with children and the actual implementation of age-gating and parental consent mechanisms requires independent verification. The policy engages GDPR for EU/EEA users, CCPA and CPRA for California residents, COPPA for child-directed services, and references compliance frameworks for Brazil (LGPD), Canada, and other jurisdictions; enforcement authority is distributed across the FTC at the federal level, state attorneys general, and EU data protection authorities depending on the user's location and the specific data practice at issue. Material compliance considerations include the adequacy of consent mechanisms for sensitive data categories, the completeness of data subject rights fulfillment infrastructure, the accuracy of data retention disclosures, and whether cross-border data transfer mechanisms are current and documented.