Walt Disney Company Privacy Policy

This is the Walt Disney Company's unified privacy policy, covering personal information collected across Disney+, Hulu, ESPN+, theme parks, cruise ships, retail stores, and all other Disney-branded digital and physical properties. The policy authorizes collection of precise location data, device identifiers, viewing and activity history, camera images at physical properties, call recordings, and payment information, and permits sharing of identifiers or hashed email addresses with third-party advertising partners for targeted advertising on Disney and non-Disney sites. The policy additionally discloses that information shared with certain third parties, including Hulu's content and distribution partners and the National Geographic Society, becomes subject to those third parties' own privacy practices once transferred.

This privacy policy governs the collection, use, sharing, and retention of personal information across the full portfolio of Walt Disney Family of Companies properties, including digital platforms (Disney+, Hulu, ESPN+, ABC, Marvel, National Geographic), physical locations (theme parks, resorts, cruise ships, stores), and guest call centers, with applicable law identified as the legal basis for processing. The policy authorizes collection of registration data, transaction data, precise and approximate location information, device identifiers, IP addresses, viewing and activity data, still and video images from cameras at physical properties, call recordings, and public forum posts; it further authorizes use of this information for targeted advertising based on activity on Disney properties and on third-party sites and applications. The policy asserts that other members of the Walt Disney Family of Companies may access user information both as data processors on behalf of the data controller and independently as data controllers in their own right, and it discloses that when Hulu shares information with business partners including content programmers, distributors, and device partners, those partners then control that information under their own privacy practices. The policy engages GDPR and UK GDPR for EU and UK residents, CCPA and applicable US state privacy laws for US residents, COPPA for children under 13 in the United States, and the Brazilian LGPD for Brazilian residents, with jurisdiction-specific rights described in supplemental notices. Material compliance considerations include the breadth of intra-family data sharing across a large number of subsidiary brands, the assertion that cross-brand data flows may occur for each member's independent purposes, and the disclosure that information shared with third parties such as Hulu's business partners or National Geographic Society falls outside the scope of this policy once transferred.

The agreement authorizes collection of a broad range of personal information across digital and physical touchpoints, including precise location, device identifiers, viewing history, camera images at physical properties, and call recordings. Under these terms, personal information may be accessed by any member of the Walt Disney Family of Companies both in a service capacity and independently for their own purposes, and identifiers or hashed email addresses may be shared with third-party advertising partners for targeted advertising on Disney and non-Disney platforms. You can manage targeted advertising preferences, data sale or sharing opt-outs, and cookie settings through the 'Do Not Sell or Share My Personal Information' or 'Your Privacy Controls' links in Disney website footers or application settings, and you can submit data access, correction, or deletion requests through the Data Subject Rights Portal.