Targeted Advertising via Identifier and Hashed Email Sharing

What it is

The policy authorizes sharing of device identifiers or hashed email addresses with third-party advertising partners to deliver and measure targeted advertising both on Disney's own platforms and on external third-party sites and applications.

Why it matters (compliance & governance perspective)

This provision establishes a data sharing mechanism that extends beyond Disney's own platforms to third-party advertising ecosystems, using identifiers and hashed email addresses as linkage data. Under California law, this type of sharing may constitute a 'sale' or 'sharing' of personal information for cross-context behavioral advertising purposes, which triggers CCPA opt-out rights.

Consumer impact (what this means for users)

Under this clause, device identifiers or hashed email addresses may be transmitted to third-party advertising partners to enable targeted advertising based on user activity, both on Disney properties and on non-Disney websites and applications. Users can opt out of this data sharing through the 'Do Not Sell or Share My Personal Information' link in Disney website footers or app settings.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision engages CCPA's definitions of 'sharing' for cross-context behavioral advertising for California residents, GDPR's consent and legitimate interest requirements for EU and UK users in the context of third-party cookie and identifier-based advertising, and FTC Act Section 5 regarding unfair or deceptive advertising data practices. The EU ePrivacy Directive may also apply to identifier-based tracking technologies. 2) GOVERNANCE EXPOSURE: High. Sharing hashed email addresses and device identifiers with third-party advertising partners constitutes 'sharing' under CCPA as amended by CPRA, triggering opt-out obligations. The policy discloses an opt-out mechanism, which addresses this requirement, but the adequacy of that mechanism requires operational verification. 3) JURISDICTION FLAGS: California residents have a statutory opt-out right for this category of data sharing. EU and UK users require a valid legal basis, typically consent, for identifier-based third-party advertising data flows. Illinois residents should note that if device-derived biometric identifiers are implicated, BIPA considerations may arise, though this document does not explicitly address biometric data in the advertising context. 4) CONTRACT AND VENDOR IMPLICATIONS: The reference to third-party advertising partners receiving identifiers or hashed email addresses creates a vendor assessment obligation for organizations managing advertising spend or co-marketing arrangements with Disney. The policy does not name the specific advertising technology partners receiving this data. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the opt-out mechanism linked in website footers and application settings is operationally effective and applies across all Disney-branded properties. Data mapping should identify which third-party advertising partners receive identifiers or hashed emails, under what contractual terms, and whether those terms satisfy GDPR processor or controller requirements.

Applicable agencies

Provision details

Other risks in this policy

• Intra-Family Cross-Brand Data Sharing medium
• Hulu Business Partner Data Sharing and Loss of Policy Coverage medium
• Physical Property Camera and Call Recording Collection medium
• Children's Privacy and Parental Consent medium
• Global Data Transfer and Cross-Border Processing low
• US Residents' State Privacy Rights low