Customer and Fan Consent

Oct 9

What Disney+, Hulu, ESPN+ and recent tracking enforcement reveal about privacy choices, personalization and audience growth.

Sports and media companies connect customer information to deliver more relevant experiences. Ticket purchases, streaming activity, app interactions and merchandise transactions can help an organization understand its audience and strengthen commercial relationships.

Those connections create a corresponding governance responsibility: ensuring that customer and fan privacy choices remain effective wherever their information is used.

Recent U.S. enforcement, particularly in California, illustrates the consequences when privacy controls fail to keep pace with connected data systems. For sports and media leaders, the practical priority is to build consent and preference management into the customer relationship, from initial collection through personalization, sponsorship activation and withdrawal.

What can sports and media companies learn from Disney’s streaming settlement?

On February 11, 2026, California’s Attorney General announced a $2.75 million settlement with Disney, resolving allegations that the company failed to fully honour requests to opt out of the sale or sharing of personal information across devices and streaming services associated with customer accounts.

The enforcement summary identifies Disney+, Hulu and ESPN+. According to the Attorney General, Disney connected devices and information for advertising purposes but did not consistently apply customers’ opt-out choices across those same connections. Some controls applied only to a particular service or device; other mechanisms did not stop all relevant third-party advertising disclosures. [1], [2]

The business lesson extends beyond streaming. An organization pursuing a unified fan profile should also understand how privacy choices apply to the information connected to that profile.

There is an important legal distinction. California’s sale and sharing opt-out rights are different from requirements to obtain prior consent. These cases do not establish a nationwide U.S. requirement to obtain consent for every cookie. They demonstrate that applicable privacy rights must be implemented effectively.

A unified fan profile needs unified privacy choices

Consider a hypothetical fan who purchases tickets, watches highlights through an app, subscribes to a streaming service and joins a loyalty program.

Connecting those interactions may help a sports organization recognize the fan across channels. But the organization also needs to understand the scope of the fan’s choices. Permission to receive team emails, preferences about personalized advertising and authorization for sponsor communications serve different purposes.

A unified profile should preserve those distinctions while making each choice effective across the relevant systems.

The operational questions are straightforward:

Which purposes and channels does each permission cover?
Can the organization identify the notice and choice presented to the fan?
Do changes reach the relevant customer records, advertising systems and partners?
Can the organization demonstrate that a withdrawal or opt-out changed the actual processing?

A central preference centre can help. Its value depends on whether the connected systems act on the choices recorded there.

Why are cookie banners and preference tools attracting enforcement?

Recent actions show that regulators are examining both the interface people see and the tracking that continues behind it.

Sling TV provides a directly relevant streaming example. California’s Attorney General announced a $530,000 settlement on October 30, 2025, addressing allegations involving difficult opt-out processes and children’s privacy. The investigation found that Sling TV directed consumers to cookie preferences even though disabling cookies did not fully stop the sale or sharing of their personal information. Consumers faced additional forms and confirmation steps, and opt-out methods were missing from certain connected-TV apps. [3]

Healthline illustrates the risk of a control that does not do what it promises. In July 2025, California announced a $1.55 million settlement resolving allegations involving tracking, advertising disclosures and ineffective opt-outs. The Attorney General alleged that Healthline’s consent banner did not disable tracking cookies despite representing that unchecking a box would do so. The action also addressed missing contractual protections and disclosures of article titles suggesting medical diagnoses. [4]

Honda demonstrates that the design of the choice matters. In March 2025, the California Privacy Protection Agency announced a $632,500 settlement addressing allegations that included excessive verification requirements and an online privacy tool that did not present choices symmetrically. [5]

Together, these actions support a practical conclusion: purchasing a consent-management platform does not establish that privacy choices work.

Sports and media companies should test whether their controls change cookies, pixels, advertising disclosures and relevant downstream processing. They should also test mobile apps and connected-TV experiences, where a website-only control may leave gaps.

That assessment should happen before a new audience segment or campaign is activated.

Does existing consent cover AI-powered personalization?

Canada’s joint OpenAI investigation, published on May 6, 2026, provides a concrete example of the consent questions AI raises. Federal, Quebec, British Columbia and Alberta privacy regulators examined practices involving GPT-3.5 and GPT-4.

Three findings are particularly relevant:

Providing information did not establish consent to model training. Under the federal, Alberta and British Columbia analyses, express consent was required for training on user interactions where information was sensitive or the use fell outside reasonable expectations.
Notice must reach people at the right time. Regulators criticized a one-time warning, including its appearance after the first interaction in the account-free service.
Third-party data needs permission for the recipient’s purposes. Recommendations required checking that consent covered OpenAI’s intended processing. [7]

The outcome was nuanced. Following new safeguards and changed expectations, the federal Commissioner conditionally accepted implied consent for certain future training practices. Provincial conclusions differed. This was not a blanket requirement for express consent for every AI use. [8]

The investigation concerned ChatGPT’s development and deployment, rather than sports marketing. For sports and media companies, the practical implication is to distinguish using information to provide a fan experience from reusing it to train or improve an AI system.

A fan might provide information to receive a recommendation, ask a customer-service question or purchase tickets. Before using those interactions for model training, predictive profiling or a vendor’s product development, the organization should assess the specific purpose, information sensitivity, applicable law and permissions.

This requires asking:

Does the disclosed purpose cover the proposed AI use?
Is the vendor processing information solely to deliver our service, or also for its own model development?
Would the fan reasonably understand and expect that use?
Is the notice presented before the relevant collection or use?
What form of consent or other legal authority applies?

The lesson for fan personalization is that an existing customer relationship does not settle permission for every subsequent AI use. Organizations need to assess what their AI systems—and their vendors—actually do with the information.

What permission travels with sponsorship activation and audience matching?

Sponsorship teams may want to demonstrate audience value, match customer records with a partner or target offers to particular fan segments.

The governance implications depend on the arrangement. Aggregate audience reporting differs from transferring identifiable fan records or matching identifiers through an advertising platform. Using hashed identifiers also requires assessment; hashing alone does not establish that information is anonymous or that an activation is permitted.

UK Information Commissioner guidance on online advertising emphasizes explaining who receives information and why, ensuring consent covers the relevant sharing chain, and communicating withdrawals to third parties. Those are UK requirements and guidance, but they provide a useful operational reference for organizations designing partner controls. [9]

For sports and media companies, the implementation priority is to document the activation before sharing begins: its purpose, participants, data, applicable permissions, contractual restrictions and process for honouring changed choices.

A partner agreement should support those controls. It cannot create permission that was never obtained or otherwise legally established.

Why do young fans need a different consent experience?

Junior fan clubs, youth-oriented content, games and family streaming experiences require organizations to consider who is actually using the service.

An adult account holder does not establish that every viewer or participant is an adult.

In a separate U.S. matter concerning YouTube content, Disney agreed to pay $10 million to settle FTC allegations that personal information was collected from children viewing child-directed videos without the required parental notice and consent. This was a children’s privacy case, distinct from the California streaming opt-out settlement. [10]

The FTC’s amended COPPA Rule also requires covered operators to obtain separate verifiable parental consent for certain third-party disclosures, including those connected to targeted advertising, subject to applicable exceptions. COPPA’s coverage centres on children under 13 and specified operators; it should not be treated as a rule covering every young fan in every setting. [11]

Canada’s 2025 joint TikTok investigation provides another relevant reference, examining age assurance and meaningful consent for tracking, profiling, targeted advertising and content personalization. [12]

For sports and media organizations, age-appropriate notices, protective defaults, suitable parental controls and careful assessment of youth-directed advertising should form part of the design process.

How can organizations make fan choices work?

The enforcement examples point to a practical governance agenda:

Connect permissions to purposes. Record what each choice authorizes and where it applies.
Carry choices through relevant systems. Include customer platforms, streaming apps, advertising tools, AI workflows and partners.
Test the outcome. Check actual tracking and disclosures after refusal, withdrawal and opt-out.
Review new commercial uses. Assess personalization, audience matching and sponsorship activation before launch.
Design for younger audiences. Address age, comprehension, parental involvement and protective settings.
Assign ownership. Make privacy, technology, marketing and commercial teams accountable for maintaining the controls.

Consent and preference management influence which audience opportunities an organization can pursue with confidence. Clear permissions can help teams evaluate campaigns and partnerships more consistently, while effective controls give customers a reason to trust the choices they are offered.