CCPA opt-outs and identity parity: where do privacy stacks break?

TL;DR: Privacy programs fail when opt-out scope, consent workflows, and identity resolution do not line up across logged-out users, brands, and non-web surfaces, according to Ketch's analysis of the February 2026 Disney CCPA settlement. The technical lesson is that compliance must follow the identity graph and the monetisation graph, not the narrowest component in the stack.

Editorial analysis by NHI Mgmt Group, based on content published by Ketch: “The real lessons of the Disney CCPA settlement: a technical guide for privacy leaders”.

Key questions

Q: What breaks when opt-out controls are split across consent, DSR, and ad-tech systems?

A: The programme loses enforcement continuity.

Q: Why do logged-out users create a harder compliance problem than logged-in users?

A: Logged-out users are harder because the obligation still follows identity resolution, not authentication state.

Q: What are the signs that a privacy programme is not honoring opt-out signals?

A: Common signs include different outcomes for logged-in and logged-out users, opt-outs that apply on one device but not another, and consent logs that show success while outbound tracker traffic keeps flowing.

Practitioner guidance

• Audit identity parity across advertising and opt-out scope Identify every point where anonymous, device-level, or pseudonymous signals are linked to a consumer profile, then verify that opt-out logic reaches the same graph.
• Unify consent and DSR enforcement paths Test whether a request captured by the webform actually changes tag firing, partner notification, and downstream suppression in the CMP and adjacent systems.
• Verify cross-brand opt-out propagation Confirm that a consumer choice submitted on one brand or property automatically suppresses selling and sharing across every related property and account context.

Bottom line: The Disney settlement shows that privacy compliance fails when identity resolution, consent capture, and downstream suppression are not governed as one system.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →