- California's $2.75M CCPA settlement with Disney is the largest on record, ahead of the $1.55M Healthline Media settlement from July 2025.
- The violation was inconsistent opt-out mechanisms across streaming surfaces, not a missing cookie banner.
- A majority of Bonta's seven CCPA settlements so far center on opt-out violations, now the top CCPA risk category.
- In September 2025, four regulators (California AG, CPPA, Colorado AG, Connecticut AG) ran a joint sweep focused on Global Privacy Control compliance.
- The Disney settlement is a court order, so future noncompliance risks contempt sanctions on top of new penalties.
- Server-side GTM, Meta CAPI, and GA4 setups can all fail silently if consent state isn't shared across web, app, and CTV surfaces.
- Fix: store consent state in a shared record keyed to user or device ID, and test that opt-out propagates across every surface tied to that identity.
California Attorney General Rob Bonta announced a $2.75 million CCPA settlement with Disney in early February 2026. IAPP published follow-up analysis on Feb. 17. It's the largest CCPA settlement on record, beating the $1.55 million Healthline Media settlement from July 2025.
The Disney case didn't come from a missing cookie banner. It came from inconsistent opt-out mechanisms across streaming services. Some surfaces honored the opt-out. Others didn't. That gap is what triggered the fine.
What actually happened
The settlement traces back to a 2024 investigative sweep that looked at opt-out practices across streaming platforms. Bonta's office found Disney's opt-out controls didn't work the same way everywhere. A user could opt out on one property and still get tracked on another.
This wasn't an isolated finding. A majority of the seven CCPA settlements Bonta's office has reached so far center on opt-out violations. Opt-out compliance is now the dominant CCPA risk category, ahead of notice-and-consent issues.
There's a broader enforcement pattern behind this too. In September 2025, Bonta's office joined the California Privacy Protection Agency along with attorneys general in Colorado and Connecticut for a multi-state investigative sweep focused specifically on Global Privacy Control compliance. Four regulators, one signal: GPC has to work everywhere, consistently, or it doesn't count.
The Disney settlement is a court order. That matters mechanically. Future noncompliance isn't just a new investigation, it's a violation of a standing court order, which opens the door to judicial sanctions and renewed enforcement with per-violation penalties stacked on top.
Why this hits your consent stack directly
Most consent management platforms handle GPC and CCPA opt-out signals fine on the primary web property. The failures show up at the edges: mobile apps, CTV apps, subdomains, and any surface that doesn't route through the same consent layer as the main site.
If you're running server-side GTM, this is the exact seam Disney got caught in. A signal that reaches your sGTM container from the web client doesn't automatically propagate to a mobile SDK hitting the same backend, or to a CTV app pulling from a separate ingestion path. If your server container treats consent state per-request instead of per-user-identity, you can end up honoring an opt-out on one surface while a different surface keeps sending events with ad-targeting purposes attached.
Same problem shows up in Meta CAPI setups. If your web pixel respects a GPC signal but your server-side CAPI call for the same user, sourced from a different event stream (app install, CRM sync, offline conversion upload), doesn't check that same consent record, you've built the exact inconsistency the AG's office is now fining companies for.
GA4 has its own version of this. Consent Mode v2 signals need to reach every GA4 data stream tied to a property, not just the one where the user interacted with the banner. If you're stitching web and app data into one GA4 property, or running separate GA4 properties per brand or region, verify the opt-out state travels with the user identifier and not just the session.
What to check this week
Pull every surface tied to a shared identity graph: web, app, CTV, connected devices, server-side event streams. For each one, answer one question: does an opt-out or GPC signal captured on Surface A actually suppress tracking on Surface B, C, and D?
Test it directly. Set GPC in a browser, opt out, then check whether the same user ID or device ID still triggers events server-side through GTM, CAPI, or any first-party pipeline that isn't gated by the same consent check. If you find a path where the answer is no, that's the exact gap the Disney settlement fined.
Audit your consent state storage. If consent lives in a cookie that only the web client reads, and your server container makes its own tracking decision without querying that state, you have an architecture mismatch, not a policy mismatch. The fix means moving consent state to a shared source your server-side container can query per event, keyed to user or device ID, not per session.
Check your CTV and app integrations specifically. These are newer additions to most consent stacks and often get bolted on without the same rigor as the web implementation. Bonta's sweep targeted streaming services for exactly this reason: these surfaces frequently ship without full opt-out parity.
Document the test. If regulators come asking, "we have a consent banner" isn't the answer anymore. "Here's proof our opt-out signal reaches every surface within X seconds and we tested it on this date" is the answer that matters now.
The fine is $2.75 million. The bigger cost is a court order that turns your next mistake into contempt exposure. Fix the propagation gap before someone else finds it for you.
Sources
- https://iapp.org/news/a/california-s-attorney-general-issues-largest-ccpa-fine-to-date
- https://iapp.org/news/a/thought-for-the-week-lessons-learned-from-2-75m-ccpa-settlement