California’s 2024 streaming privacy sweep: the Sling TV and Disney settlements that followed by 2026

On January 26, 2024, in Oakland, California Attorney General Rob Bonta announced an investigative sweep of streaming services under the California Consumer Privacy Act. His office sent letters to businesses with popular streaming apps and devices, alleging that they did not comply with the law’s rules for letting people stop the sale or sharing of their personal information. Two settlements have come out of that sweep, by the office’s account: with Sling TV on October 30, 2025, and with the Walt Disney Company on February 11, 2026.

The right the sweep tested

The law, known as the CCPA, lets California residents tell a business to stop selling or sharing their personal information. In the attorney general’s explanation, “sharing” means passing data on for cross-context behavioral advertising, which targets ads using what a person does on other sites and services. A business that sells personal information must offer a clear “Do Not Sell or Share My Personal Information” link, cannot require an account to opt out, and must honor a browser’s Global Privacy Control signal as a valid request. It has up to 15 business days to act and must wait at least 12 months before asking a person to opt back in. Selling the data of children it knows to be under 16 requires an opt-in, from a parent for those under 13.

When it announced the sweep, the office described what it expected from streaming services: someone using a smart TV should be able to find a “Do Not Sell My Personal Information” option in the settings menu of the service’s mobile app, and a choice made while logged in to an account should be honored across different devices. Bonta said the requirements had been in place since 2020.

Sling TV, October 2025

Sling TV is an internet-based live TV service with a paid subscription and a free, ad-supported tier. The attorney general’s office alleged that it mixed its cookie preferences with the CCPA opt-out, so that switching off cookies did not complete the request, and that even logged-in customers had to fill in a webform with their name, address, email and phone number. It also alleged that Sling TV offered no opt-out inside its apps for living-room devices and no kids’ profiles to limit targeted advertising when children were watching.

Under the judgment the office published, Sling TV and its affiliate Dish Media Sales agreed to pay $530,000 in two installments of $265,000. They must offer an opt-out in each device app, such as a simple toggle (or, where that is not practicable, a simpler route such as a QR code), apply a logged-in viewer’s choice across the whole account, and stop sending people to cookie settings to opt out. Parents must be able to set up kids’ profiles that default off the sale and sharing of data. Channels made for children, 43 of them listed in an exhibit, must also default off. The release of October 30, 2025, said the settlement was subject to court approval.

Disney, February 2026

The Disney case concerned Disney+, Hulu and ESPN+. According to the office, an opt-out toggle on Disney’s websites and apps applied only to the service being watched, and often only to that device. The office said its webform stopped data flowing to Disney’s own advertising platform but not to certain outside ad-tech companies whose code ran in its sites and apps, and that many of its connected TV apps had no opt-out of their own. It also said a Global Privacy Control signal was applied only to the device that sent it, even for logged-in viewers.

Disney agreed to pay $2.75 million, which the office called the largest CCPA settlement to that date. Its judgment requires a logged-in viewer’s opt-out, including one sent by an opt-out preference signal, to apply across all of Disney’s streaming services linked to the account. Each service must carry an opt-out link, viewers must be able to confirm that their request was processed, and Disney must pass the request on to outside companies that received the data between the request and Disney acting on it. It must update the office on its progress every 60 days until all its services comply.

The companies’ position

Both judgments were agreed by the companies, and the copies the office published are signed by Los Angeles Superior Court judges: Sling TV’s on October 31, 2025, and Disney’s on February 11, 2026, the day the court stamped it filed. Each says it was agreed without trial or any ruling on the facts or the law, that it is not evidence of or an admission of anything alleged in the complaint, and that the companies admit no liability. When he announced the Disney settlement, Bonta said that “businesses can’t force people to go device-by-device or service-by-service.”

What applies now

The opt-out right described above is in force, according to the attorney general’s CCPA guidance, last updated on August 28, 2026. It belongs only to California residents. The office’s privacy enforcement page, checked on November 13, 2026, lists both cases as stipulated judgments and shows no other streaming service case since the Disney settlement, by our reading. The same page lists a larger CCPA settlement since then: $12.75 million from General Motors, announced in May 2026, over alleged violations of the CCPA and the state’s Unfair Competition Law.

The office invites people to report a business whose opt-out link or other opt-out method is not working or is difficult to find, through its online complaint form.