Sometimes, Disney really does help make obvious things more obvious.
I can’t count how many times people have told me that the language included in a vendor’s privacy policy really doesn’t matter all that much because it was “probably written by lawyers” and that the company would never try and enforce it, or act on it in any meaningful way.
I have been told this by product manufacturers, people with purchasing and decision making authority in higher ed and K12, senior leadership at nonprofits that claim to understand and care about privacy, academic researchers at R1 universities, researchers at nonprofit and for profit orgs, and more.
Some of these people were willfully obtuse, some were bad faith actors, but the overwhelming majority were people who just wanted to believe what they needed to believe: that their faith in good intentions was enough. It’s an incredible manifestation of privilege, of course, and they were as blind to the embedded privilege as they were to the inaccuracy of their claim.
My response, whenever confronted with a person making the claim that language in a privacy policy didn’t matter if it didn’t align with the perceived intent of the company always ran something like this: “Intent is great for marketing copy. The legally binding terms set the rules of engagement, and when a person or a company tells you the rules they operate under, we need to believe them.”
The latest example of this comes from from Walt Disney. In October 2023, Kanokporn Tangsuan — a medical doctor with food allergies — ate with her husband and mother in a restaurant in Disney Springs shopping area in Orlando. They chose this restaurant specifically because it advertised that it paid careful attention to preparing food for people with allergies. Despite this, it appears the restaurant failed to meet this commitment. Tangsuan died of anaphylaxis shortly after eating the meal.
When the husband filed a wrongful death suit, Disney tried several ways to get the case dismissed, including falling back on the forced arbitration clause embedded in the husband’s Disney+ subscription, and the terms of service on the site people use to buy tickets to Disney parks.
In an under-the-radar filing in late May, Disney offered a new defense: that the complaint is subject to arbitration based on Piccolo’s Disney+ subscription, as well as his use of the company’s website in 2023 to buy theme part tickets.
Disney backed off after their attempts became public, and people rightly commented on the despicable nature of this legal strategy. But — and this can’t be emphasized strongly enough — Disney only backed down after negative public attention. Up until that point — from May to August — Disney was completely fine with a legal strategy that attempted to use a binding arbitration clause buried in their legal terms.
So, yes – the next time someone tries to tell you that the language in privacy policies needs to be interpreted more broadly, or in a different way, or that is shouldn’t be taken seriously because it’s not what the company means, hold your ground. The person you are speaking with doesn’t know what they are talking about.
When push comes to shove, companies will use their legally binding privacy policies and terms of service in any way possible to ensure their advantage.
Image credit: screen capture from Steamboat Willie, which entered the public domain in January 2024.