US Residents' State Privacy Rights

What it is

The policy identifies state-law privacy rights available to US residents depending on their state of residence, including rights to access, deletion, correction, third-party disclosure lists, targeted advertising opt-out, data sale or sharing opt-out, and processing restriction, subject to applicable legal exceptions.

Why it matters (compliance & governance perspective)

This provision consolidates US state privacy rights into a single notice, covering rights established under CCPA (California), and analogous frameworks in states including Virginia, Colorado, Connecticut, Texas, and others. The non-discrimination right referenced aligns with CCPA Section 1798.125 and similar provisions in other state laws.

Consumer impact (what this means for users)

Under this clause, US residents may submit requests to access, correct, delete, or restrict processing of their personal information, opt out of targeted advertising or data sale and sharing, and obtain a list of specific third parties to whom personal data has been disclosed, subject to state-specific eligibility and legal exceptions. These rights are exercisable through the Disney Data Subject Rights Portal and the 'Your US State Privacy Rights' page.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision engages CCPA (as amended by CPRA) enforced by the California Privacy Protection Agency, as well as Virginia CDPA, Colorado CPA, Connecticut CTDPA, Texas TDPSA, and other state privacy frameworks. The right to a specific list of third-party recipients is a requirement under some state laws (including California under CPRA) and distinguishes this provision from older CCPA-only disclosures. The FTC also has general authority over consumer data rights representations. 2) GOVERNANCE EXPOSURE: Medium. The enumeration of state-specific rights, including the right to a list of specific third-party recipients, requires that Disney maintain operational data mapping sufficient to respond accurately to such requests across its multi-brand portfolio. The phrase 'subject to exceptions' is not further defined in this provision and may create ambiguity about the scope of available exceptions. 3) JURISDICTION FLAGS: California presents the highest operational exposure given CPPA enforcement authority and CPRA's expanded rights framework. Texas, Virginia, Colorado, and Connecticut residents have analogous rights under their respective state frameworks. The policy's consolidation of rights across states warrants jurisdiction-specific review to confirm each state's rights are adequately addressed. 4) CONTRACT AND VENDOR IMPLICATIONS: The right to a specific list of third-party recipients creates a downstream obligation on Disney to maintain accurate records of all third-party disclosures across its portfolio of brands. Vendor contracts should include provisions enabling Disney to identify and disclose third-party recipients in response to consumer requests. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the Data Subject Rights Portal is operationally capable of processing all enumerated rights requests, including the specific third-party disclosure list requirement, within the timeframes required by applicable state laws. Response procedures should be tested against the multi-brand structure to confirm that requests spanning multiple Disney subsidiaries are captured and fulfilled.

Applicable agencies

Provision details

Other risks in this policy

• Intra-Family Cross-Brand Data Sharing medium
• Targeted Advertising via Identifier and Hashed Email Sharing medium
• Hulu Business Partner Data Sharing and Loss of Policy Coverage medium
• Physical Property Camera and Call Recording Collection medium
• Children's Privacy and Parental Consent medium
• Global Data Transfer and Cross-Border Processing low