The FTC settlement over kids’ privacy violations signals a new era of liability for content providers on third-party platforms.

The Walt Disney Company has agreed to pay a $10 million civil penalty to settle Federal Trade Commission (FTC) allegations that it violated the Children’s Online Privacy Protection Act (COPPA) Rule. In a complaint (available below) filed by the Department of Justice (DOJ) on behalf of the FTC, the government alleged that Disney illegally enabled the collection of personal data from children under 13 by failing to properly label its kid-directed videos on YouTube.

The settlement is a landmark moment for the creator economy, sending a clear signal that the FTC holds content creators—not just the platforms they use—responsible for complying with children’s privacy laws. For any brand, influencer, or media company publishing content online, this case is a multi-million-dollar wakeup call.

How a Simple Setting Led to a Complex Problem

The case hinges on a specific feature within YouTube. Following its own $170 million COPPA settlement with the FTC in 2019, YouTube began requiring all content creators to designate their videos as either “Made for Kids” (MFK) or “Not Made for Kids” (NMFK). This is more than just a label; the MFK designation automatically disables certain features to protect children’s privacy. On MFK videos, YouTube does not collect personal information, serve personalized ads, or allow public comments. The MFK setting also ensures that videos will only autoplay other MFK content.

According to the FTC’s complaint, Disney’s violation stemmed from a corporate policy to apply these designations at the channel level rather than for each individual video. Disney designated many of its channels—such as Pixar, Disney Plus, and Walt Disney Studios—as NMFK. As a result, when the company uploaded child-directed videos to these channels, the videos were incorrectly labeled “Not Made for Kids” by default. However, the complaint notes: “the designation of a video as NMFK on an MFK channel deviated from Disney’s policy that all videos on a channel designated as MFK must also be marked as MFK.”

These mislabeled videos included clips and content from massively popular kids’ franchises like Toy Story, Frozen, Cars, and Mickey Mouse. Because they were not properly flagged, YouTube was able to collect persistent identifiers from the children watching them and use that data to serve targeted advertising, a practice prohibited by COPPA without parental consent. Disney, in turn, benefited financially, receiving a portion of the revenue generated from ads YouTube placed on its videos.

The FTC also noted that this mislabeling created other “downstream harms,” exposing children to unrestricted public comments and causing the autoplay feature to serve up other NMFK videos that may not have been age-appropriate.

Even after YouTube directly informed Disney in June 2020 that it had reclassified over 300 of its videos from NMFK to MFK, Disney did not change its policy of designating videos at the channel level, the complaint alleges.

A New Precedent for Platform Liability

This enforcement action demonstrates the FTC’s focus on holding individual channel operators accountable, a risk that has been looming over the creator industry since the 2019 YouTube settlement. Here’s a bit of what I wrote about the 2019 settlement in a law review article on creator economy law:

“As part of its 2019 settlement with YouTube, the FTC made it explicitly clear that channel owners could be held legally responsible for any violations of COPPA in the same manner as any other website or online service provider. The FTC’s 2019 complaint against YouTube specifically identified (but did not take action against) several of the defendants involved in the Jones class action, including CookieSwirlC […] as well as Mattel, for its operation of channels associated with its Barbie, Monster High, Hot Wheels, and Thomas & Friends brands.”

The 2019 complaint ended up leading to a class action lawsuit against both toy brands and influencers running YouTube channels. Fast forward and we’re now seeing this settlement announcement from an investigation that began under the Biden admin.

In a statement released this week, FTC Chairman Andrew N. Ferguson emphasized the agency’s position following this new settlement:

“This case underscores the FTC’s commitment to enforcing COPPA, which was enacted by Congress to ensure that parents, not companies like Disney, make decisions about the collection and use of their children’s personal information online. Our order penalizes Disney’s abuse of parents’ trust, and, through a mandated video-review program, makes room for the future of protecting kids online-age assurance technology.”

The settlement requires more than just a monetary payment. Disney must now establish and implement a formal “Audience Designation Program” to review each video it publishes to YouTube to determine if it is child-directed and label it accordingly. This requirement represents a significant operational shift away from a channel-level default to a video-by-video compliance system.

A Push Towards Age Assurance Technologies

Interestingly, the order includes a forward-looking provision that could waive this requirement if YouTube implements effective “age assurance technologies” that can reliably determine a user’s age and ensure COPPA compliance across the platform. This suggests the FTC is actively trying to incentivize platforms to build better, broader solutions for protecting minors online. If you want to quickly get up to speed on age assurance technologies, I’d recommend checking out this overview and infographic from the Future of Privacy Forum.

For creators and brands, the takeaway remains clear: relying on a platform’s default settings is not a sufficient defense against COPPA violations. The responsibility for accurately identifying content “directed to children” lies with the entity uploading it.

But what does that mean, exactly? Unfortunately, it’s not all that clear. The FTC’s own guidance even explains that “there is no one-size-fits-all answer about what makes a site directed to children.” Luckily, just because content might be seen by children doesn’t mean it’s automatically classified in this heightened treatment category.

This case makes clear that the FTC is prepared to enforce COPPA against even the largest content providers, and a $10 million penalty should be more than enough to make the entire creator economy reconsider its compliance strategies and content release processes.

Here’s the full Complaint:

Here’s the full proposed order:

AI Disclosure: This article is the result of a collaboration between my human creativity and artificial intelligence. The AI acted as a research assistant and writing partner, helping to organize my thoughts and improve the flow of the content. I review and approval any outputs.