TL;DR: Privacy programs fail when opt-out scope, consent workflows, and identity resolution do not line up across logged-out users, brands, and non-web surfaces, according to Ketch's analysis of the February 2026 Disney CCPA settlement. The technical lesson is that compliance must follow the identity graph and the monetisation graph, not the narrowest component in the stack.
At a glance
What this is: Ketch analyses the Disney CCPA settlement as a technical privacy failure, arguing that opt-outs break when identity parity, workflow integration, and cross-surface enforcement do not align.
Why it matters: This matters because privacy programmes that cannot propagate consumer choices across identity-linked systems, brands, and devices will fail the governance test even if individual tools appear to work.
By the numbers:
- California Attorney General settled the Disney DTC, LLC and ABC Enterprises case for $2.75 million, the largest CCPA enforcement action in the regulation's history.
Context
The core problem in this settlement is not legal theory but control design. Privacy programmes often treat consent, opt-out, identity resolution, and data sharing as separate workflows, yet regulators judge them as one connected system. In practice, that means the same identity graph used for advertising can also define the boundary of opt-out enforcement.
For IAM and privacy leaders, the interesting question is not whether a user is logged in, but whether the organisation can recognise the same person, device, or profile across channels and then suppress processing consistently. That makes this a governance problem at the intersection of identity, consent management, and downstream data-sharing controls.
The Disney case is atypical only in scale, not in structure. The control failures described here are widespread wherever teams bolt privacy tooling onto fragmented customer, ad-tech, and app architectures.
Key questions
Q: What breaks when opt-out controls are split across consent, DSR, and ad-tech systems?
A: The programme loses enforcement continuity. A request can be captured in one channel while collection and sharing continue in another, which means the control exists on paper but not in processing. Teams should trace the request path end to end and verify that downstream systems actually consume the opt-out state.
Q: Why do logged-out users create a harder compliance problem than logged-in users?
A: Logged-out users are harder because the obligation still follows identity resolution, not authentication state. If the business can link a device or browser to a consumer profile for monetisation, it must also honour opt-outs for that linked profile. The control boundary is the resolved identity graph, not the login screen.
Q: What are the signs that a privacy programme is not honoring opt-out signals?
A: Common signs include different outcomes for logged-in and logged-out users, opt-outs that apply on one device but not another, and consent logs that show success while outbound tracker traffic keeps flowing. Any disconnect between request records and live network behaviour is a control failure.
Q: How should organisations enforce privacy choices across web, app, and connected TV experiences?
A: They should bind each choice to a persistent identity or profile record and push that state into every downstream system that uses the same consumer data. If consent lives only in the originating interface, it will drift. The control objective is consistent policy execution across all channels, not isolated banner compliance.
Technical breakdown
Identity parity and opt-out scope
Identity parity means the system that benefits from being able to resolve a user across devices must also honour opt-out choices across that same resolved identity. If an organisation can associate browsers, apps, or devices with one consumer for advertising, then an opt-out cannot stop at the login boundary. The compliance control follows the identity relationship, not the user interface that collected the request. This is why pseudonymous profiles matter: they are still governed if they are linked to monetisation activity. In IAM terms, the issue is not authentication alone, but identity correlation and policy propagation across a linked profile set.
Practical implication: Map every place where anonymous or device-level signals resolve into a known profile, then make opt-out enforcement follow that same linkage.
Why disconnected consent and DSR systems fail
A consent management platform and a DSR webform can both function correctly and still fail compliance if they do not share state. One system may capture the request while the other continues tag firing, third-party calls, or behavioural tracking. That is architectural fragmentation: multiple controls operating without a shared enforcement path. The privacy signal is only an intake event. The real control is downstream suppression across collection, sharing, and partner notification. In an enterprise stack, failure usually appears where the request path ends and the processing path begins, especially when vendors host forms on separate domains or separate environments.
Practical implication: Trace the request from submission to enforcement and close any break between intake, tag control, and partner notification.
Cross-brand propagation and non-web surfaces
Cross-brand propagation is a control requirement when monetisation spans multiple brands or properties under one data architecture. If one consumer choice applies to one property but not another, the programme has created a policy boundary that the business itself does not respect. The same issue appears on connected TV, apps, kiosks, and other non-browser surfaces, where web-native consent tools do not automatically apply. This is where privacy governance meets system architecture: the opt-out mechanism must exist where the data is collected, not only where the policy is documented. If the surface cannot enforce it natively, the architecture is incomplete.
Practical implication: Inventory every brand and consumer surface, then verify that opt-outs propagate across shared infrastructure and non-web channels.
Threat narrative
Attacker objective: The objective is not attacker gain but regulatory exposure through a privacy stack that keeps processing personal information after opt-out.
- Entry occurs when consumer identity signals are resolved across devices, apps, or brands and reused for advertising or sharing purposes.
- Control failure follows when opt-out requests reach one system but do not propagate to adjacent consent, ad-tech, or partner environments.
- Impact is continued cross-context behavioural advertising and data sharing after a consumer has attempted to opt out.
Breaches seen in the wild
- iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity parity is now a privacy control, not just a legal concept. When a business can resolve a consumer across devices for advertising, that same capability defines the boundary of opt-out enforcement. Privacy programmes that treat logged-in and logged-out users as separate governance classes are already misaligned with how regulators are reading modern identity graphs. Practitioners should treat identity resolution as a policy-bearing control surface, not just a marketing enabler.
Architectural fragmentation is the real failure mode. Many programmes have the right components but no shared enforcement state between CMPs, DSR flows, and downstream ad-tech controls. That means the organisation can truthfully say a request was captured while still violating the spirit and mechanics of the obligation. The governance lesson is simple: separate tools do not equal separate controls, and disconnected control planes create compliance debt.
Cross-brand propagation exposes where privacy governance stops following the business model. If data monetisation spans brands, sub-brands, or properties, then opt-outs must propagate across that same operating model. This is the same class of problem IAM teams see when account scope and access scope diverge across platforms. Privacy leaders should assume that any mismatch between customer identity scope and enforcement scope will become a regulator-visible gap.
Non-web surfaces are the next audit frontier. Browser-centric consent patterns do not control mobile apps, CTV, or other connected surfaces unless those environments have native enforcement. That makes surface coverage a design question, not a documentation question. The practical conclusion for security and privacy teams is to audit controls by processing surface, not by policy statement.
What this signals
Identity-parity gaps are becoming a standard audit question for privacy programmes. Teams that can resolve a consumer across devices for advertising must now prove they can suppress processing across the same resolution layer. That shifts the conversation from banner configuration to identity governance and downstream enforcement.
Connected TV and app-based data flows widen the gap between policy and implementation. Browser-native consent tools do not automatically extend to every consumer surface, so programme owners need surface-by-surface control testing rather than policy review alone.
For practitioners
- Audit identity parity across advertising and opt-out scope Identify every point where anonymous, device-level, or pseudonymous signals are linked to a consumer profile, then verify that opt-out logic reaches the same graph.
- Unify consent and DSR enforcement paths Test whether a request captured by the webform actually changes tag firing, partner notification, and downstream suppression in the CMP and adjacent systems.
- Verify cross-brand opt-out propagation Confirm that a consumer choice submitted on one brand or property automatically suppresses selling and sharing across every related property and account context.
- Inventory non-web surfaces for native opt-out controls Check mobile apps, connected TV, kiosks, and similar surfaces for in-environment opt-out mechanisms that do not depend on a different device or browser.
- Test third-party notification workflows Validate that every ad-tech or data-sharing partner receives and acts on opt-out instructions without relying on manual follow-up or batch reconciliation.
Key takeaways
- The Disney settlement shows that privacy compliance fails when identity resolution, consent capture, and downstream suppression are not governed as one system.
- The enforcement action identified four recurring technical gaps, including identity parity, fragmented opt-out architecture, and missing coverage on non-web surfaces.
- Privacy teams need to audit the full identity and data-sharing graph, because regulators are increasingly judging whether controls follow the way the business actually monetises data.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63C — Federation | Identity correlation and propagation across services is central to the opt-out parity problem. |
| Recommendation — Align identity-linked policy propagation with federation and linked-account governance. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about enforcing policy across linked identities and systems, not just collecting consent. |
| Recommendation — Map opt-out enforcement to identity-authorisation paths and verify scope consistency across systems. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Privacy workflows should restrict sharing and processing to the minimum authorised scope after opt-out. |
| Recommendation — Limit post-opt-out processing to the minimum necessary identity and data flows. | ||
| CIS Controls v8 | CIS-5 — Account Management | Cross-brand propagation failures reflect poor lifecycle governance across linked consumer identities. |
| Recommendation — Maintain consistent account and identity linkage governance across all consumer-facing properties. | ||
| GDPR | Art.21 — Right to object | The settlement logic closely mirrors objection and suppression obligations, even though the case is under CCPA. |
| Recommendation — Use objection workflows that propagate suppression across every system processing the same consumer identity. | ||
Key terms
- Identity Parity: Identity parity is the governance approach of managing human users, service accounts, and AI agents under the same access framework. It applies one policy model, one approval path, and one audit trail across all identity types. That reduces exceptions and improves consistency in access control.
- Opt-Out Propagation: Opt-out propagation is the movement of a consumer's suppression choice from the intake point to every downstream system that shares, targets, or profiles that consumer. It fails when requests are captured correctly but never reach the platforms, partners, or surfaces that continue processing data.
- Connected Surface: A connected surface is any consumer touchpoint outside the traditional browser, such as a mobile app, connected TV application, kiosk, or embedded device interface. These surfaces often need native privacy controls because web-based consent tooling does not automatically govern them.
- Architectural Fragmentation: Architectural fragmentation occurs when separate privacy or security tools each perform their own function but do not share enforcement state. In that condition, a control may appear to work in one product while the broader programme continues to process data or permissions in another.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and identity lifecycle controls. It helps security and privacy practitioners connect access governance to the systems that resolve, share, and suppress identity data.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org