By: Clara De Abreu E Souza & Susan Hintze
On December 31st, 2025, the FTC announced that a federal judge approved a $10 million dollar settlement with Disney for alleged violations of the Children’s Online Privacy Protection Rule (COPPA Rule).
The settlement centers on allegations that Disney allowed personal data to be collected from children under 13 who viewed kid-directed videos on YouTube without notifying parents or obtaining their consent as required by COPPA.
Background
In 2019, the FTC entered into a settlement with YouTube’s parent company, Google, for COPPA violations. That settlement resulted in YouTube requiring all content publishers to indicate if videos uploaded to the platform are “Made for Kids” (MFK) or “Not Made for Kids” (NMFK). When a video is marked as MFK, certain functionalities like comments, autoplay to NMFK videos, and most notably targeted advertising is disabled.
YouTube allows content creators to set the MFK/NMFK designation at either the channel or the individual video level. If a channel is marked as NMFK, all uploaded videos default to that status; however, creators can manually change the designation for any specific video to reflect content of a particular video.
Relevant COPPA Requirements
Under COPPA, absent an exception, if an online service is directed to, or attractive to, children under 13, the operator of that online service must not collect personal information from children without providing notice to the parent and obtaining verifiable parental consent. If a portion of an online service is directed to children, COPPA can also apply to that portion of the online service.
An operator of an online service, or portion of an online service directed toward children can also be liable under COPPA for allowing certain collection activities by third parties on the operator’s behalf. For example, an operator is typically responsible for allowing third-party collection of personal information from users of their service for targeted advertising.
The Complaint
In September 2025, the Department of Justice (DOJ) acting on referral from the FTC brought a COPPA complaint against Disney for actions related to its video channels on YouTube, and, specifically, videos within those channels that were alleged to be directed to children.
The complaint stated that, per Disney’s corporate policy, Disney set audience designations at the channel level which adhered those designations to videos it uploaded to a channel. Those videos were available for viewing within Disney’s channel, but viewers could also access videos outside the channel. Disney had the ability but did not designate individual videos as MFK or NMFK. Consequently, when a video was uploaded to a channel Disney had designated as NMFK, the video remained NMFK by default even when the video was accessed separately from the channel.
The complaint alleged that because of this practice, Disney failed to designate a significant number of child-directed videos as MFK. YouTube relied on Disney’s designation and treated all videos in Disney’s channel as NMFK making all videos, including child-directed videos, available for targeted advertising. Disney received advertising revenue from YouTube’s subsequent advertising as well as from advertisements that Disney placed in its videos. The FTC through the DOJ asserted that Disney bears COPPA responsibility for its actions and for allowing YouTube’s actions, resulting in collection and use of data from children for targeted advertising, without obtaining verifiable parental consent required by COPPA.
The Settlement
Under the settlement order, Disney is required to:
Pay a $10 million civil penalty for alleged violations of the COPPA Rule.
Comply with the COPPA Rule, specifically regarding parental notice and obtaining verifiable consent before collecting personal data from children under 13.
Implement a 10-year "Audience Designation Program": Within 180 days of the order, Disney must establish a formal program to review every video it publishes to YouTube. This program must remain in place for 10 years unless YouTube implements universal age-assurance technology or removes the "Made for Kids" (MFK) labeling feature.
Key Takeaways
The Disney settlement signifies the FTC’s position that in the context of an otherwise general audience media channel, if an individual piece of content within that channel is child-directed, that content may be treated as a portion of an online service that is child-directed and, thus, subject to COPPA requirements.
The settlement also underscores that if you are a content creator or control content, it is important to know how the platform on which you are publishing content works, especially when it comes to designating whether content is or is not directed to children, as well as channel-level and content-level settings. Here are some takeaways to consider if you are a content publisher:
Review Individual pieces of content for child-directedness: Absent some form of gaining age assurance of your audience members, you must not only determine whether a channel as a whole is general audience or directed to children, you must also determine if individual content is directed to children.
Review Default Designations: If you set channel-level audience settings indicating a channel is not directed to children, ensure you have a process to either ensure that no child-directed content is included in that channel or, if the platform allows, override that designation for any individual pieces of content that could be directed to children.
Define Compliance Roles: Establish clear roles and responsibilities for identifying and understanding platform-specific settings, such as YouTube's audience tools, to ensure they are used correctly.
Validate Implementation: Beyond setting policies, implement a validation process to verify that platform-provided age-designations and appropriate limitations on use of personal information are actually applied to child-directed content before such content is made available to individuals.
Monitor Third-Party Policies and Features: When distributing content on any third-party service, stay informed on how that platform's data practices and age classifications operate, including based on the audience age labels you provide.
Clara De Abreu E Souza is an Associate at Hintze Law PLLC. She has experience with artificial intelligence, data privacy, and the regulation of emerging technologies, including evolving state and federal privacy laws, algorithmic accountability, and health data governance.
Susan Hintze is Co-Managing Partner at Hintze Law PLLC, on the IAPP’s Board of Directors, and is also a Westin Emeritus Fellow with the IAPP.