TWDC offers a range of websites and apps that are directed to children, some of which are primarily targeted at children, and others that are intended for users of all ages and their families. Those websites and apps provide a variety of offerings, some of which may collect information from children. Below we summarize potential instances of collection and outline how and when we will provide parental notice and/or seek parental consent. In the event we discover we have collected information from a child in a manner inconsistent with COPPA’s requirements, we will either delete the information or immediately seek the parent’s consent for that collection.

Registration

Some of our websites and apps allow children to register to view content, play digital games, save gameplay progress, log achievements, participate in contests, and engage in interactive experiences, among other things. During the registration process, we may ask the child to provide certain information for notification and security purposes, including a parent’s contact information, such as an email address, and the child’s first name, gender, member or account username, and password. We may also ask for a date of birth from children to validate their ages. We strongly advise children to never include any personal information in their usernames. Please note that children can choose whether to share their information with us, but certain features cannot function without it. As a result, children may not be able to access certain features if required information has not been provided. We will not require a child to provide more information than is reasonably necessary in order to participate in an online activity.

About the Collection of a Parent’s Contact Information: Consistent with the requirements of COPPA, on any child-targeted website or app, or in any instance where we ask for age and determine that the registered user is under the age of 13, we will ask for a parent’s email address, or other contact information, before we collect any personal information from the child. If you believe your child is participating in an online activity that collects personal information and you or another parent has not received an email or message providing notice or seeking your consent, please feel free to contact us at privacycontact@twdc.com. We will not use contact information obtained for parental consent purposes to advertise to the parent.

Content Generated by a Child

Certain activities on our websites and apps allow children to create or manipulate content and save it with TWDC. Some of these activities do not require children to provide any personal information and therefore may not result in notice to the parent or require parental consent. If an activity potentially allows a child to insert personal information in their created content, we will either pre-screen the submission to delete any personal information or we will seek verifiable parental consent by email for the collection. Examples of created content that may include personal information are stories, open-text fields, and drawings that allow text or free-hand entry of information. If, in addition to collecting content that includes personal information, TWDC also plans to post the content publicly or share it for a third party’s own use, we will obtain a higher level of parental consent, as described below.

About Verifiable Parental Consent:

Email Consent. In the event TWDC wishes to collect online personal information from a child, COPPA requires that we first seek a parent’s consent by email. In the email, we will explain what information we are collecting, how we plan to use it, how the parent can provide consent, and how the parent can revoke consent. If we do not receive parental consent within a reasonable time, we will delete the parent’s contact information and any other information collected from the child in connection with that activity.

High-Level Consent. In the event TWDC collects online personal information from a child that will be posted publicly or shared for a third party’s own use, we will seek a higher level of consent than email consent. Such “high-level” methods of consent include, but are not limited to, asking for a credit card or other payment method for verification (which may include a nominal charge), speaking to a trained customer service representative by telephone or video conference, or requiring a signed parental consent form by mail, email attachment, or physical submission. After providing high-level consent, a parent may have the opportunity to use a PIN or password in future communications as a way to confirm the parent’s identity.

Contests and Sweepstakes

For contests and sweepstakes, we typically require only the information necessary for a child to participate, such as a first name (to distinguish among family members) and parent contact information, such as an email address (to notify the parent where required by law). We only contact parents to request additional personal information for prize-fulfillment purposes when the child wins the contest or sweepstakes.

Of course, some contests and sweepstakes ask the child to submit their own created content along with the child’s entry. In those instances, we may require parental consent prior to submission. Please see Content Generated by a Child section above for more information on our collection, notice, and consent policies.

Email Contact with a Child

On occasion, in order to respond to a question or request from a child, TWDC may need to ask for the child’s online contact information, such as an email address. TWDC will delete this information promptly after responding to the question or request.

In connection with certain activities or services, we may collect a child’s online contact information, such as an email address, in order to communicate with the child more than once. In such instances, we will retain the child’s online contact information to honor the request and for no other purpose, such as advertising. One example could be a newsletter that provides occasional updates about a website, game, activity, movie, television show, or character. Whenever we collect a child’s online contact information for ongoing communications, we will simultaneously require a parent’s email address in order to notify the parent about the collection and use of the child’s information, as well as to provide the parent an opportunity to prevent further contact with the child. On some occasions, a child may be engaged in more than one type of ongoing communication, and a parent may need to “opt out” of each communication individually.

Push Notifications

Push notifications are app-related notifications on mobile devices that can communicate with the device holder even when the app is not in use. We will require a child to provide a parent’s email address before the child can receive push notifications from any of our child-directed apps that collect a device identifier. We will then seek parental consent via email. We will not associate the device identifier with other personal information without contacting the parent to get consent.

Geolocation Data

If a child-directed TWDC website or app collects geolocation information from a child that is specific enough to equate to the collection of a street address, we will first seek parental consent via email.

Audio Files

We may offer opportunities to use interactive voice features in some child-directed contexts. In such cases, we implement appropriate technical measures to ensure that we do not collect or retain personal information, including voice recordings, from children as users of our online products or services.

Persistent Identifiers

When children interact with us online, certain information may automatically be collected to make our websites and apps more interesting and useful, and for various purposes related to our business and operations. Examples include the type of operating system, the child’s IP address or mobile device identifier, the web browser, the frequency with which the child visits various parts of our websites or apps, and information regarding the online or mobile service provider. This information is collected using technologies such as cookies, pixels, tags, software development kits (SDKs), application program interfaces (APIs), web beacons, and other unique identifiers (which we describe further in our Online Tracking Technologies and Advertising page). This information may be collected by TWDC or by our service providers. This data is principally used for internal operation purposes, in order to:

• provide children with access to features and activities on our websites and apps;
• customize content and improve our websites and apps;
• conduct research and analysis to address the performance of our websites and apps;
• generate anonymous reporting for use by TWDC;
• show contextual advertising and ensure users do not see the same ads over and over again;
• help users stay safe while using our services and help our services stay protected; and
• help ensure compliance with the rules and laws in the places where we operate.

On applicable child-directed websites and apps, or where we knowingly collect persistent identifiers from children, we take steps to ensure that the use of persistent identifiers is necessary to:

• maintain or analyze the functioning of the website or app;
• perform network communications;
• authenticate users of, or personalize the content on, the website or online service;
• serve contextual advertising on the website or online service or cap the frequency of advertising;
• protect the security or integrity of the user, website, or online service; and/or
• ensure legal or regulatory compliance.

We have also implemented appropriate administrative, technical, and organizational measures on these websites or apps to ensure that persistent identifiers are not used or disclosed to contact a specific individual, including through behavioral advertising, to amass a profile on a specific individual, or for any other purpose except internal operations specified in this Children’s Online Privacy Policy. These measures include:

• restricting the use of behavioral advertising to children on our child-directed websites and apps;
• restricting the use of features or services that involve building profiles based on the persistent identifiers of children on our child-directed websites and apps;
• contractually obligating our service providers to adhere to relevant restrictions in this Children’s Online Privacy Policy; and
• verifying that our child-directed websites and apps adhere to the requirements set forth in this Children’s Online Privacy Policy.

In the event we collect (or allow others to collect) other types of personal information from children on our websites and apps for other purposes, we will notify parents, obtain consent prior to such collection, and provide a supplement to this privacy notice, as applicable.

Visit the Internal Operations Service Providers page to see the list of our service providers who, as operators, may collect persistent identifiers on our websites and apps subject to contractual processing limitations.

Please contact us at the mailing address, email, or phone number below with questions about the operators’ privacy policies and collection and use practices:

Disney DTC LLC
500 South Buena Vista Street
Mail Code 7830
Burbank, CA 91521-7830
United States of America
Phone: (877) 466-6669
Email: privacycontact@twdc.com

In addition to those rare instances where a child’s personal information is posted publicly (after receiving high-level parental consent), we also may share or disclose personal information collected from children in a limited number of instances, including the following:

• We may share information with our service providers if necessary for them to perform a business, professional, or technology support function on our behalf.
• We may disclose personal information if permitted or required by law, for example, in response to a court order or a subpoena. To the extent permitted by applicable law, we also may disclose personal information collected from children: (i) in response to a law enforcement or public agency’s (including schools or children services) request; (ii) if we believe disclosure may prevent the instigation of a crime, facilitate an investigation related to public safety, or protect the safety of a child using our websites or apps; (iii) to protect the security or integrity of our websites, apps, and other technology, as well as the technology of our service providers; or (iv) to enable us to take precautions against liability.

At any time, a parent can refuse to permit us to collect further personal information from their children in association with a child’s account and can review or have deleted from our records a child’s personal information. Please contact us to request to review, change, or delete your child’s personal information by sending an email to privacycontact@twdc.com. Please include the child’s username, if applicable, and the parent’s email address and telephone number in your request. To protect children’s privacy and security, we will take reasonable steps to verify a parent’s identity before granting access to any personal information.

Please keep in mind that a request to delete records may lead to the termination of an account, membership, or other service.

To learn more about other privacy rights that may be available in accordance with applicable U.S. state privacy laws, please visit the Your US State Privacy Rights page.

In any instance in which we collect online personal information from a child, we will retain that information only as long as reasonably necessary to fulfill the activity request or allow the child to continue to participate in the activity, to ensure the security of our users and our services, or as required by law. Please visit our Privacy Policy for more information on our data retention practices.

Please visit our Privacy Policy for more information on our data security practices.

From time to time, we may change this Children’s Online Privacy Policy to accommodate new technologies, industry practices, or regulatory requirements, or for other purposes. We will provide notice to you if these changes are material and, where required by applicable law, we will obtain your consent. Notice may be sent by email, by posting notice of such changes on our websites and apps, or by other means, consistent with applicable law.

If you have a comment or question about this policy, please contact us at:

Disney DTC LLC
500 South Buena Vista Street
Mail Code 7830
Burbank, CA 91521-7830
United States of America
Phone: (877) 466-6669 (U.S. and Canada)
Email:  privacycontact@twdc.com