Logo text

Disney has been sued for deploying facial recognition technology at park entrances to verify tickets.

A class action accuses the entertainment giant of violating privacy, competition and consumer protection laws by implementing the technology at Disneyland, where photographs of guests’ faces are taken and compared with images when they first used the ticket or annual pass.

The company “does not adequately disclose the use of their biometric collection, so consumers – which almost always include children – have no idea that Disney is collecting this highly sensitive data,” reads the complaint, filed in California federal court on Friday.

The lawsuit challenges a trend spreading across major sports and entertainment venues of using facial recognition to prevent fraud, heighten safety and facilitate purchases. Sports stadiums lean on it to streamline entry; theme parks utilize it to manage crowd flow; and security for some musicians rely on it to identify stalkers. But mass adoption of the technology has sparked some concern over the specter of a privatized surveillance state and the commercialization of sensitive personal information. Madison Square Garden uses it to ban entry for the “enemies” of its owner, James Dolan. There have also been instances of companies turning over biometric data to law enforcement.

Disney implemented in April facial recognition at the entrance of Disneyland and sister park California Adventure. Most visitors opt into having their faces scanned, unaware of the technology. Company officials have said that it helps make entering and reentering the park easier and prevents fraud.

The lawsuit alleges that Disney doesn’t properly disclose to guests that it collects the data. There are signs of a slash through a silhouette at four entrances that allow visitors to avoid the technology, but the lawsuit says that it doesn’t constitute meaningful notice.

“Guests should be able to expressly opt in to this type of sensitive facial recognition technology with written consent – the onus of privacy rights should not be on the victim,” writes Blake Yagman, a lawyer for the proposed class of visitors, in the complaint. “Given how sensitive facial recognition data is, explicit written consent should be required to protect the privacy guests at Disney Theme Parks.”

In California, businesses can use facial recognition but must comply with a growing set of rules. They include disclosure and allowing consumers to limit the utilization and sharing of their data. Other states, like Illinois, Washington and New Jersey, have stricter laws that require consent and notice.

Disney, which didn’t respond to a request for comment, disposes of the data gained from its facial recognition technology within 30 days unless its necessary for legal or fraud prevention purposes, according to its privacy policy. The lawsuit contends the assertion “simply cannot be true given the biometric information is compared to when guests first bought tickets or annual passes and associated their pictures with those tickets or passes.”

Outside of Disney, the company collects biometric data at other theme parks when a visitor uses a “Magic Band” and as part of its “PhotoPass” program. The lawsuit says the information is highly valuable for the creation of consumer profiles that amass details on consumers across various arms of its business.

The proposed class action seeks to represent park visitors who have been subject to facial recognition. It seeks at least $5 million.

The filing of the lawsuit comes after Disney last year paid a $10 million to settle a complaint brought by the Federal Trade Commission over the collection of children’s data on YouTube videos.