Disney+
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
Disney collects account, viewing, device, and location data and uses it for ads, with sharing opt-outs and deletion by request.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account info, viewing activity, device IDs, location, and sometimes park cameras and call recordings.
Read the exact line
Privacy policy
“Location information, including precise or approximate location information provided by a mobile or other device interacting with one of our sites, applications, or physical properties”
Training
They use it to run the service, personalize, send offers, and show targeted ads.
Read the exact line
Privacy policy
“Provide you with targeted advertising based on your activity on our sites and applications and on third-party sites and applications;”
Sharing
Other Disney companies, service providers, and ad partners can get some of your data.
Read the exact line
Privacy policy
“When we provide you with relevant advertising on third-party sites and applications, we may share limited personal information about you, such as certain identifiers or hashed email address, with third parties.”
Kept
They keep it as long as they say they need it, or longer if the law allows.
Read the exact line
Privacy policy
“We will retain your personal information for the length of time needed to fulfill the purposes outlined in this privacy policy unless a longer retention period is required or permitted by law.”
Controls
You can request access or deletion and turn off some ad and cookie sharing in settings.
Read the exact line
Privacy policy
“Click on “Do Not Sell or Share My Personal Information”, “Your Privacy Controls”, “Manage Your Cookies Settings”, “Modify Your Cookie Preferences” or “Manage (Privacy) Preferences” in our website footers or application settings”
Fine print
Material policy changes get notice; these papers do not cover suing, refunds, or account shutdown.
Read the exact line
Privacy policy
“We will provide notice to you if these changes are material and, where required by applicable law, we will obtain your consent.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Turn off sell/share and cookie ads
Website footer or app settings: Do Not Sell or Share My Personal Information, Your Privacy Controls, Manage Your Cookies Settings
Request access or deletion
Portal (Your Controls and Choices)
Update account or delete registration
MyDisney account
Change email and offer preferences
Privacy Choices or my.disney.com; Hulu Account Page for Hulu emails
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can collect where you are, including fairly exact location from your phone or park tech.
Read the exact line
Privacy policy
“Location information, including precise or approximate location information provided by a mobile or other device interacting with one of our sites, applications, or physical properties”
For example, opening the Disney+ app or walking near a park beacon could log your location.
They build ad profiles from what you watch and do, including on other companies’ sites.
Read the exact line
Privacy policy
“Provide you with targeted advertising based on your activity on our sites and applications and on third-party sites and applications;”
For example, a show you stream could be used to target ads to you elsewhere.
They send hashed email or IDs to outside ad companies.
Read the exact line
Privacy policy
“When we provide you with relevant advertising on third-party sites and applications, we may share limited personal information about you, such as certain identifiers or hashed email address, with third parties.”
For example, an advertiser could match your hashed email to show you Disney-related ads.
Lots of Disney-related companies can use your data for their own purposes unless the law blocks it.
Read the exact line
Privacy policy
“Other members of The Walt Disney Family of Companies may access your information where they perform services on behalf of the (as data processors) and, unless prohibited under applicable law, for use on their own behalf (as )”
For example, another Disney brand could use your Disney+ viewing to market its own products.
Phone calls to guest services can be recorded and kept as personal information.
Read the exact line
Privacy policy
“Call recordings when you call our reservation centers or other guest services phone numbers.”
For example, calling about a billing issue could leave a stored recording of your voice.
There is no clear delete-by date; they keep data as long as they think they need it.
Read the exact line
Privacy policy
“We will retain your personal information for the length of time needed to fulfill the purposes outlined in this privacy policy unless a longer retention period is required or permitted by law.”
For example, old viewing history might stay after you cancel if they still use it for analytics.
They say they use security measures, but they do not name audits or a bug-bounty program here.
Read the exact line
Privacy policy
“We have implemented technical, administrative, and physical security measures that are designed to protect guest information from unauthorized access, disclosure, use, and modification.”
For example, they claim to lock down guest data, without listing certifications.
Kids’ features are supposed to be limited and need extra parent steps when they collect kids’ data.
Read the exact line
Privacy policy
“When we intend to collect personal information from children, we take additional steps to protect children’s privacy, including:”
For example, a kids profile may collect less, and parents can ask to change or delete it.
Big privacy-policy changes should come with notice, and sometimes they must ask you first.
Read the exact line
Privacy policy
“We will provide notice to you if these changes are material and, where required by applicable law, we will obtain your consent.”
For example, they might email you or post a notice if they start a new use of your data.
Partner marketing emails only happen if you choose that, not by default.
Read the exact line
Privacy policy
“We do not share guests’ personal information with third parties for their direct marketing use unless a guest elects that we do so, for example, by agreeing to have your email address shared with a partner.”
For example, they will not give your email to a partner for ads unless you opt in.
Words to know
Legal words from the lines above, in plain English.
- targeted advertising
- Ads chosen for you based on what you have done across other apps and websites, not just this one. For example, you look at shoes in one app and see shoe ads in a totally different app the next day.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
- data controller
- The company that decides why and how your data is used, and is responsible for it under privacy law. For example, the app maker is the controller; the cloud company storing files for it is only a processor.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
How we got here · grade D · score 35/100 · 15 of 15 policy answers backed by a verified quote · 7 not stated
What does the app collect beyond what it needs to work?
They collect account and payment info plus viewing activity, device IDs, precise location, park camera images, and call recordings.
Does it record your voice, face or body, and what happens to that?
They record guest-service calls and say you may give info by voice commands; they do not say those recordings are deleted after the call.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They use your activity for targeted ads and share identifiers with third parties for ads on other sites.
Do they sell or share your data, and can you opt out?
Disney companies and ad partners can get data; they offer Do Not Sell or Share and cookie controls.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
You request deletion through a rights portal; they keep data as long as needed for listed purposes or longer if law allows.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe technical, administrative, and physical security measures in general terms.
Is there a real age gate, and are teens protected?
Bundle offers say 18+. Kids’ collection is limited and may need parent consent, but these pages do not describe age-proofing.
Will they tell you when the rules change, and is the policy specific?
They say they will notice material changes, but retention and many purposes stay high-level.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 3,285 words at a college graduate level (Flesch reading ease 31.4); the terms are 234 words at a college graduate level.
