Privacy Enforcement Is Heating Up: Disney's $2.75M CCPA Penalty and a TCPA Lawsuit Against an Insurance Lead Buyer

Case Overview

Cases Covered: Disney CCPA Settlement | Smartmatch Insurance TCPA Class Action

Verticals: Consumer Privacy | TCPA

Last Updated: February 2026

Privacy Enforcement Is Heating Up

California hits Disney with a record $2.75M CCPA penalty while an insurance agency faces a TCPA class action. See what these 2026 cases mean for consumers.

Privacy Enforcement Is Heating Up: Disney's $2.75M CCPA Penalty and a TCPA Lawsuit Against an Insurance Lead Buyer

Two recent privacy and telemarketing cases underscore a consistent message from regulators and plaintiffs' attorneys alike: technical compliance gaps and third-party lead purchases carry real legal exposure. From California's largest-ever CCPA civil penalty to a class action targeting an insurance agency over unsolicited calls, February 2026 brought a fresh wave of enforcement activity worth following.


1. Disney Settles California CCPA Claims for $2.75 Million

Settlement Amount: $2.75 million

Enforcing Authority: California Attorney General

Who Is Affected: California consumers whose opt-out requests may not have been fully honored by Disney's digital platforms

On February 11, 2026, California Attorney General Rob Bonta announced a settlement with The Walt Disney Company — the largest civil penalty ever imposed under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). According to a detailed analysis of the settlement, California alleged that Disney's opt-out mechanisms did not fully satisfy CCPA requirements, despite the company having some compliance measures in place.

The central lesson from this enforcement action: partial compliance is treated as noncompliance under California law. The AG's office alleged that while Disney had opt-out tools available to consumers, those tools did not effectively capture and honor all required opt-out signals across its platforms. Under the CCPA, California consumers have the right to direct businesses to stop selling or sharing their personal information — and businesses must honor those requests completely.

The $2.75 million figure sets a new benchmark for CCPA civil penalties and signals that even well-resourced companies with existing privacy programs are not immune from enforcement if gaps remain in execution. The settlement also serves as a roadmap for what regulators are scrutinizing: the end-to-end functionality of opt-out mechanisms, not just their existence.

What this means for consumers: California residents who submitted opt-out requests through Disney's platforms and believe those requests were not honored may want to monitor developments in this matter. Details on any consumer relief components of the settlement were not immediately available.

For more information: Follow updates from the California Attorney General's office at oag.ca.gov.


2. Smartmatch Insurance Agency Named in TCPA Class Action Over Purchased Leads

Case Status: Active class action litigation

Estimated Exposure: Potentially $500–$1,500 per alleged violation under TCPA

Who May Be Affected: Individuals who received unsolicited calls allegedly connected to leads purchased by Smartmatch Insurance Agency

Smartmatch Insurance Agency is facing a Telephone Consumer Protection Act (TCPA) class action lawsuit stemming from its alleged purchase of consumer leads from third-party lead vendors, according to reporting on the case. The lawsuit illustrates a recurring legal risk in the insurance industry: buying leads from outside vendors does not insulate a company from TCPA liability if those leads were generated without proper consumer consent.

The complaint, as reported, alleges that Smartmatch received leads from major vendors and used them to initiate calls to consumers who had not provided the required prior express written consent to be contacted by Smartmatch specifically. Under the TCPA, prior express written consent must identify the specific seller or caller — a general consent to be contacted by "insurance companies" may not satisfy the statute's requirements when applied to a specific company the consumer never identified.

The case follows a broader pattern of enforcement and litigation in the lead generation space. The TCPA allows consumers to seek $500 per negligent violation and up to $1,500 per willful violation, making class action exposure significant for companies that routinely purchase and dial large lead lists.

The lawsuit has not yet been adjudicated, and Smartmatch has not had a final opportunity to respond publicly to the allegations through the courts. The claims in the complaint remain allegations at this stage.

What this means for consumers: Individuals who received unsolicited calls from Smartmatch Insurance Agency and believe they never provided consent to be contacted may want to consult with a TCPA attorney to understand whether they could potentially have a claim. Eligibility and any potential compensation would depend on the specific facts of each individual's situation.


Key Takeaways

  • Partial opt-out compliance is not enough under the CCPA. California's AG has now demonstrated willingness to pursue penalties even when a company has some privacy infrastructure in place — the full opt-out chain must function correctly end to end.
  • Buying leads doesn't transfer TCPA risk. Companies that purchase consumer contact lists from third-party vendors may still face direct liability if the underlying consent doesn't meet the TCPA's specificity requirements.
  • Enforcement momentum is building. The Disney settlement sets the largest CCPA civil penalty on record, a signal that California is escalating its privacy enforcement posture heading into 2026.
  • Class action exposure in telemarketing can be substantial. At $500 to $1,500 per call, TCPA class actions involving large dialing campaigns can generate significant aggregate liability claims.
  • Consumer rights in both areas are well-defined by statute. Californians have codified rights to opt out of data sharing; all U.S. consumers have codified rights against unsolicited telemarketing without proper consent.

Are you a California consumer who submitted an opt-out request to Disney, or have you received unsolicited calls from an insurance agency? Share your experience in the comments below.


InjuryClaims.com reports on litigation developments for informational purposes only. Nothing in this article constitutes legal advice. Eligibility for any settlement or lawsuit is determined by attorneys and courts, not by this publication.

Latest News

Loading...

Illustration of a mobile device getting an email notification