Fingerprinted by Mickey Mouse
#INVESTIGATION | Disney maintains that using your fingerprint to enter its parks is *optional* but it only represents the (finger) tipping point when it comes to the Mouse's data bounty on all of us.
Despite my own ardent interest in data privacy, and concern about surveillance, I found myself, like millions of others each year, in line to enter Disney World wearing a trackable MagicBand bracelet and convinced that a fingerprint was the only way to enter the park.
But when it comes to navigating this new digital world my own MO allows for these types of wobbles. Because finding a comfortable place between giving up too much privacy, letting companies profit from our data, and trying to mitigate future risks, is all any of us can do. But millions of us doing it TOGETHER… now that is mighty powerful.
And there is no better case study to explore this negotiation than Disney. With robust online and in-person properties, $90 billion in revenue, and hundreds of millions of customers across a vast array of properties, Disney’s influence can’t be overstated. So let’s dig into what they collect on us and why.
Who Cares, You Say?
A natural response these days to privacy concerns sounds a bit like this:
“It’s for our protection”
”Why would my data matter, I’m just one person?”
”I have nothing to hide”
”I have more important things to worry about”
But here’s the thing, any of us could be saying instead: “Why me?”
But even absent of a breach we should be asking:
What do we get out of this exchange for our data?
What does the full picture of data collection look like?
How is our data used? How will it be used in the future?
What happens when it all goes wrong? e.g., data breach, theft, fraud, etc.
So, let’s unpack the issue with Disney.
Why Disney Uses Fingerprints & How it Works
It’s important to note that Disney is not using your fingerprint for some nefarious purpose. The stated intent is to avoid fraud (i.e., lose money from ticket sales). They also maintain that the data is deleted once given a numerical value.
That said, Disney’s privacy policy is standard in giving itself wide latitude to use the data it secures across the Disney portfolio of businesses, and to select third parties as it deems necessary.
Capturing Biometrics Since 1996
Disney first started collecting biometric data in the mid 90s. But of course there was a higher threshold to exploit the information at that time.
The big leap came in 2013 when the company upgraded its biometric system to the current fingerprint recognition program (“Ticket Tag”) as part of the MyMagic+ initiative.
The current program captures a fingerprint, assigns a numerical value, and then deletes the data.
Fingerprinting Process & *Consent*
“In order to use Ticket Tag, you simply place your finger on a reader. The system, which utilizes the technology of biometrics, takes an image of your finger, converts the image into a unique numerical value, and immediately discards the image. The numerical value is recalled when you use Ticket Tag with the same ticket to re-enter or visit another Park. Ticket Tag does not store fingerprints.”
In breezy language the privacy policy states that using your finger to enter the park is *optional* and that you can visit guest relations to instead access a photo ID.
But having raised concerns at the gate myself, I was not told that I could visit guest relations. So now I add “read privacy policy” to my travel checklist after “check the 10-day weather forecast.”
Other Data Disney Captures…
You didn’t think that was everything, did you?
Disney has always pursued cutting-edge technology, and has a robust digital marketing operation.
But the difference now is the way in which the data they secure is more personal, sensitive, and available to mimic and exploit us.
What the Company Collects
[Note: this is not a comprehensive list, but gives you enough of an idea to explore data privacy for yourself]
Facial Detail » Disney has piloted a facial recognition test at its parks and has hopes of rolling it out based on the results. Besides concerns about facial recognition technology overall, there are legitimate questions about whether that data will also be used for AI research.
Emotional Data » Disney has been integrating Emotional AI into attractions to better gauge and respond to guest emotions. This involves using sensors and AI algorithms to track emotional reactions ( the goal is a “more emotional” experience). It’s also been a way to reimagine advertising as well.
In Room Connected Devices » Alexa is available in-room at some Disney resorts. If that makes you uncomfortable (🙋🏼♀️) then be sure to disconnect the device when you arrive.
Location Tracking » If you wear a MagicBand, MagicBand+, or DisneyBand+ or enable location tracking via the app while visiting the parks and experiences, then yes, your location is tracked, and the data stored.
Commerce » Especially if you have enabled tracking, or wear a MagicBand, you can assume a comprehensive profile of your commerce activity also exists. You might even find that what you buy at the park (or even browse) ends up informing the advertising you see in the future on Disney+ or Hulu.
Park Activities » Are you in and out, there all day, do you ride the roller coasters, or watch from the benches? Do you linger in the Magic Kingdom or prefer Epcot? You get the picture: how you experience the park is part of the data held on you.
Data from Digital and Entertainment Accounts » Speaking of Disney+ and Hulu, ESPN and more: what you watch is also part of the picture. Have you commented on Disney social media accounts? That too.
It’s not to say that this isn’t intended to make your experience at Disney parks better, or the media you consume online more tailored, that is the point. But it’s also an awful lot of information from you, so understanding how its used, stored, and how to opt out is key.
How the Information is Used
Artificial Intelligence » It’s no surprise that Disney would create an AI taskforce. Not only do they have the rich data, but the company sees AI as a way to continue to delight consumers while saving the company hundreds of millions in current costs. The task force is also looking at ways to use AI to personal Disney experiences and add “autonomous characters” to the park (aka robots).
Some of the public news on the effort include:
Project Kiwi → This effort involved the creation of a free-roaming robot modeled after the character Baby Groot from "Guardians of the Galaxy." The goal has been to bring emotionally intelligent characters into the parks that can interact with guests in a more “personal” and engaging way (aka “believable”).
Living Character Initiative → A more general effort for a decade now, this initiative has been about developing characters that can exhibit emotional responses and lifelike behaviors. While it’s like to Project Kiwi in the “robot” sense, this is a more sweeping effort to make all automated characters more “lifelike.”
Emotional AI in Attractions → As mentioned above, Disney is also integrating Emotional AI into attractions to better gauge and respond to guest emotions.
Data Sharing Between its “Family of Companies”» Remember Disney is massive corporation and any data they secure from you can be used between companies (to understand the scope, I’m listing them all here), as well as, for marketing purposes (and that is a broad category).
So any assurance of a “just between our businesses” type of messaging in privacy policies could mean more than you think.
ABC Entertainment, ABC News, Adventures by Disney, Aulani, a Disney Resort & Spa, Bamtech Media, Bindass, Buena Vista Catalog Company (including Disney Movie Club), D23 | The Official Disney Fan Club, Disney Baby, Disney Channels & DisneyNOW, Disney Cruise Line, Disney Digital Network, Disney Family Movies, Disney Movie Insiders, Disney on Broadway, Disney on Ice and Disney Live!, Disney PhotoPass Service, Disney, Rewards Visa Card, Disney Store, Disney Vacation Club, Disney+, Disneyland Paris, Disneyland Resort, DisneyLife, El Capitan Theatre, ESPN, ESPN CricInfo, ESPN Deportes, ESPN+, FiveThirtyEight, Freeform, FX Networks, Genx Entertainment Limited, Hollywood Records, Hulu, Hungama TV, Lucasfilm (Star Wars), Marvel, Marvel Shop, Marvel Digital Comics, Muppets, National Geographic, Pixar Animation Studios, Radio Disney, Read Riordan, The Undefeated, 30 for 30 Podcasts, United Home Entertainment Private Limited, UTV Software Communication Limited, Walt Disney Pictures, Walt Disney Studios Home Entertainment, Walt Disney World Resort
Research » When thinking about “downstream” uses of data (e.g., how park data can ultimately be used by other Disney businesses) research can often sit off the radar.
Disney Research has been in operation since 2008 with two businesses “Los Angeles” (more entertainment, including robotics, AI, and ”immersive”) and “Studios” covering machine learning and visual learning. The latter business is located in Switzerland.
Without going too far down a rabbit hole, even a cursory look at these two research paper examples, the first on facial recognition, and the second on replicating eyes, shows where Disney’s aggregate data can end up.
What You Can Do
It’s not about avoiding Disney, but understanding what how our information is collected, and what you can do about it if you want to put the breaks on.
Each of us needs to decide which elements enhance our experiences when patronizing brands, and what we want to keep to ourselves. It’s possible and includes:
Understanding where you can “opt out” and using the option too.
Asking to have you information deleted. In this case after you’ve visited a Disney Park, or even via any affiliated website/account you aren’t using anymore.
Flexing your power to say “no.” Had I pushed a bit more surely I would have been told I could visit guest services instead of using my fingerprint to enter Disney World.
Reading privacy policies — it’s a habit we all need to get more comfortable with doing.
Speaking up… online, in person, in your community, with your family and friends. Remember, we are powerful together.
Disney is also unique in how they will begin to integrate more robots into their parks without much notice. But we need to understand how much of “us” goes into creating “them.” The value of our humanness is something only we can fight for in the end.