CITT

    Scan results

    Disney+

    Android

    Disney+ is the premium streaming home for movies and series from Disney, Pixar, Marvel, Star Wars, and National Geographic. Enjoy exclusive originals, 4K content, multiple profiles with parental controls, and access to ESPN and Hulu content.

    CITT SCORE
    85
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Streaming fans comfortable with standard analytics

    What It Means For You

    Viewing habits and app activity are shared with analytics and engagement services including Braze, Sentry, Datadog, and Conviva. Notification preferences and billing interactions pass through Firebase and Google. OneTrust provides some control over consent, but data collection is active by default.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (13)

    Data Security

    3 total
    1 High
    1 Medium
    1 Info

    Network Security

    1 total
    1 Critical

    Code Security

    3 total
    1 High
    1 Medium
    1 Info

    Privacy

    3 total
    2 Medium
    1 Info

    Third-Party Risk

    3 total
    1 Medium
    1 Low
    1 Info

    Third-Party Services

    Braze SDK, Firebase Messaging, Sentry, Datadog RUM, Conviva, Google Play Services, Google Billing Library, OneTrust CMP, Google Cast SDK, Disney Streaming Services SDK

    Security Strengths

    • ✓Firebase Analytics explicitly disabled for privacy
    • ✓Android KeyStore integration with AES-256-GCM encryption capability
    • ✓All network endpoints use HTTPS
    • ✓Backup explicitly disabled (android:allowBackup=false)
    • ✓WebView file access disabled in Braze integration
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    streaming
    entertainment
    sensitive data
    ads
    location
    third party analytics

    Package

    com.disney.disneyplus

    Version

    26.1.2+rc2-2026.02.23

    Analysis Date

    Mar 3, 2026

    Classes Analyzed

    28,637

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Acceptable

    Key Findings

    Data Security - 3 findings (1 high, 1 medium, 1 info)

    Network Security - 2 findings (1 critical, 1 low)

    Code Safety - 0 findings

    Privacy - 3 findings (2 medium, 1 info)

    Privacy Concerns

    What Data is Collected

    Disney+ collects viewing activity, search history, device identifiers, and interaction patterns within the app. Account details, billing information, and notification preferences are gathered during normal use.

    Third-Party Data Sharing

    Data is shared with the following third-party services:

    • Braze - engagement and messaging platform
    • Sentry - error monitoring
    • Datadog RUM - real-user performance analytics
    • Conviva - streaming quality and behavioral analytics
    • Firebase Messaging - notification delivery
    • Google Play Services - platform services
    • Google Billing Library - payment processing
    • OneTrust CMP - consent management
    • Google Cast SDK - casting support
    • Disney Streaming Services SDK - internal platform services

    Understanding the Scores

    CategoryScore
    Security82/100
    Privacy88/100
    Data Security80/100
    Network Security85/100
    Code Safety90/100
    Data Collection100/100
    Data Sharing95/100
    User Control95/100

    Positive Security Features

    • Strong code safety practices reflected in a 90/100 Code Safety score
    • High user control score, indicating meaningful consent and preference options through OneTrust
    • Data sharing is limited to named, identifiable third-party services with defined purposes
    • Data collection scope aligns with app functionality, scoring a perfect 100/100

    Areas for Improvement

    • A network-level issue was identified that could leave data sent over public Wi-Fi with less protection than expected.
    • Some data-handling configurations could be tightened to reduce diagnostic information retained on the device.
    • Data collection is active by default, requiring manual adjustment through OneTrust settings to reduce sharing.

    About This Analysis

    This scorecard is based on automated static analysis of the Disney+ Android app binary. Scores represent the security and privacy posture at the time of the scan.

    App Details

    • App: Disney+
    • Package: com.disney.disneyplus
    • Version: 26.1.2+rc2-2026.02.23
    • Platform: Android
    • Scan Date: 2026-03-03
    • Analysis by: canITrustThat.com

    Right of Reply

    Developer not yet contacted