Did the company that centers itself around making kids’ dreams come true, create a messy situation for their target audience?  On September 5, 2025, a lawsuit was filed against Disney for violating children’s privacy laws by failing to mark its YouTube videos as “made for kids.”[i]   By failing to apply this designation, Disney allegedly categorized many of its child-oriented videos as “not made for kids,” which kept features like targeted advertising, autoplay, and comments activated, allowing the data belonging to kids under thirteen to be collected and monetized.[ii]  The lawsuit, brought by a minor’s family, centers itself around whether this practice violates federal privacy protections: namely, 15 U.S.C. sections 6501–6506 and 18 U.S.C. section 2710. These code provisions are, respectively, the Children’s Online Privacy Protection Act (“COPPA”) and the Video Privacy Protection Act (“VPPA”).[iii]

Congress and the Federal Trade Commission (“FTC”) have drawn bright lines around how children can be treated online. 15 U.S.C. sections 6501–6506 and 16 C.F.R. part 312 make it unlawful for operators of websites or services directed at children to collect, use, or disclose personal information without verifiable parental consent.[iv]  “Personal information” covers more than just names and addresses. It includes persistent identifiers like cookies or IP addresses, geolocation, and even a child’s image or voice in a video.[v]  Operators must also give parents clear notice of what is being collected, allow them to review or delete data, and avoid conditioning access on unnecessary disclosures.[vi]

18 U.S.C. section 2710 takes a different angle.  This law prohibits video service providers from disclosing information about what specific videos a person watched without consent.[vii]  The VPPA carries teeth: $2,500 in statutory damages per violation, plus attorneys’ fees and potentially punitive damages.[viii]  Additionally, the FTC treats COPPA violations as unfair or deceptive practices.[ix] The FTC has enforcement authority and has already reached a $10 million settlement with Disney over these same issues.[x]

To see how Disney’s conduct stacks up under these rules, it is important to first analyze COPPA sections 6501–6506. The videos in question—Mickey Mouse shorts, Frozen sing-alongs, and Encanto music clips—are as “child-directed” as it gets. Under the rule, Disney should have flagged them as “made for kids.”[xi]  By instead tagging them as “not made for kids,” Disney left the door open for YouTube to collect persistent identifiers, track childrens’ viewing habits, and serve behavioral ads.[xii]  Significantly, it is never alleged that parents were ever asked for consent. That is a COPPA problem on its face.[xiii]

Notice and transparency are another sticking point. 15 U.S.C. sections 6501–6506 require operators to tell parents, in plain terms, what they are collecting and why.[xiv]  But parents of children, such as the plaintiff, had no idea their children’s data was being gathered or shared with advertisers.  That omission undermines parents’ ability to exercise their statutory right to review and delete their child’s data.

18 U.S.C. section 2710 strengthens the case for parents.  Children who watch Disney videos on YouTube are “consumers” under 18 U.S.C. section 2710.[xv]  Disney, as the provider of that content, allegedly disclosed information identifying those children as having accessed particular videos—for example, “Mickey Mouse Clubhouse” or “Toy Story Shorts”—to advertisers.  This action is exactly what 18 U.S.C. section 2710 is meant to stop.  Its narrow exceptions for “ordinary course of business” do not include behavioral advertising.[xvi]  Selling a list of what children are watching to help target ads does not qualify “order fulfillment” or “debt collection.”[xvii]

The complaint also adds negligence and unjust enrichment.[xviii]  Negligence is proper because YouTube had already flagged hundreds of Disney videos in 2020 as wrongly labeled, but Disney did not change course.[xix]  Such action by YouTube followed by Disney’s inaction diminishes an argument that the discrepancy was an “innocent” mistake. Unjust enrichment captures the profits that Disney allegedly gained from advertising data it should not have been collecting in the first place.

In its defense, Disney might argue that YouTube’s designation system was confusing, or that parents, not companies, are ultimately responsible for supervising kids online.  But 15 U.S.C. sections 6501–6506 provides rules designed to cut off such arguments by imposing strict duties on operators of child-directed services, regardless of parental oversight.[xx]  Disney could also try to stretch the VPPA’s “ordinary course of business” exception to cover advertising, but that might be a tough sell given the statute’s narrow interpretation.[xxi]

Disney is facing a serious legal challenge. By failing to label its videos as “made for kids,” it appears to have enabled a large-scale collection of children’s data without parental consent and disclosed that information to advertisers.  Such conduct sits squarely within COPPA and VPPA.

The FTC has already extracted a $10 million settlement and mandated compliance changes, but the private class action is just beginning.[xxii]  Since Disney’s channels receive billions of views, certification of the action could result in the skyrocketing of damages—specifically from the $2,500 fine per violation set out by 18 U.S.C. § 2710.[xxiii]  The outcome is uncertain, but the legal framework is not: 15 U.S.C. sections 6501-6506 and 18 U.S.C. section 2710 give children special protections online, and companies cannot sidestep those rules for the sake of ad revenue.

This case is a reminder that for all of the talk about “family-friendly” branding, even the biggest names in entertainment are not immune to privacy laws. Courts now have the chance to say plainly that children’s privacy is not a commodity—even when the content is wrapped in Mickey Mouse ears.

[i] Ufonobong Umanah, Disney Hit With Children’s Privacy Lawsuit Over YouTube Videos, Bloomberg L., (Sep. 5, 2025), https://www.bloomberglaw.com/product/blaw/bloomberglawnews/bloomberg-law-news/XCE8RRFO000000 [https://perma.cc/F3CZ-DPGR].

[ii] Id.

[iii] See 15 U.S.C. § § 6501–6506 (2013); see also 18 U.S.C. § 2710 (2013).

[iv] See 15 U.S.C. § § 6501–6506; see also 16 CFR § 312.9 (2017).

[v] See 15 U.S.C. § § 6501–6506.

[vi] Id.

[vii]18 U.S.C. § 2710.

[viii] Id.

[ix] 16 CFR § 312.9.

[x] Umanah, supra note i.

[xi] Complaint at 1, E.G. v. Walt Disney, et. al. (S.D.N.Y. 2025) (No. 1:25-cv-07359).

[xii] Umanah, supra note i.

[xiii] See 15 U.S.C. § § 6501–6506.

[xiv] Id.

[xv] See 18 U.S.C. § 2710.

[xvi] Id.

[xvii] Id.

[xviii] Complaint, supra note xi at 20, 22.

[xix] Id.

[xx] 15 U.S.C. § § 6501–6506.

[xxi] 18 U.S.C. § 2710.

[xxii] See Fed. Trade Comm’n, Disney to Pay $10 Million to Settle FTC Allegations the Company Enabled the Unlawful Collection of Children’s Personal Data (Sep. 2, 2025), https://www.ftc.gov/news-events/news/press-releases/2025/09/disney-pay-10-million-settle-ftc-allegations-company-enabled-unlawful-collection-childrens-personal [https://perma.cc/N5AF-RLFH].

[xxiii] See 18 U.S.C. § 2710.