Introduction
In recent years, as families travel to Disney World, they embrace technology. They use apps and MagicBands – password-protected smart bracelets employing radio frequency identification (RFID) – to check in and out of hotels, enter their rooms and the parks, manage and redeem FastPass reservations, and pay for meals and souvenirs, often without ever speaking to a cast member. As Disney World-type technologies are introduced into the real world, it is vital to investigate the institutionalization and acceptance of pervasive monitoring via complex networks of unnoticed sensors and integrated systems. We discuss the values and functions of these technologies and how they ultimately shape our privacy preferences and expectations.
We frame Disney as a lab for public technology applications and use it to explore information governance challenges associated with pervasive location monitoring, facial recognition, data integration across contexts, and the seamlessness of smart experiences and interactions, facilitated by MagicBands. We employ Disney as an analytical model for potential challenges and governance strategies in other public applications alongside a number of privacy challenges.
We examine Disney’s complex balance between adhering to social privacy and security norms and their various, covert and explicit, violations of privacy and security expectations. For example, Disney’s prioritization of security puts many parents and consumers at ease.Footnote 1 Yet Disney has long identified a false trade-off between privacy and security, making extreme “invasions of privacy” in pursuit of “absolute security” (Smoodin 1994). Disney World, as an immersive and contained environment, holds more surveillance per square inch than the average American prison and is somewhat singular in that the surveillance is designed to promote consumption and not necessarily to protect visitors or the public (Project on Disney 1995). This is analogous to the relevant conflicts of interest associated with privacy in governing smart cities and public surveillance in other contexts.
We use the contextual integrity (CI) framework to analyze privacy implications and harms (Solove Reference Solove2005) of information aggregation. CI defines privacy as appropriate information flows in a given context (Nissenbaum Reference Nissenbaum2009). We explore normative violations around seamless integration of information flows in public spaces and extending to other Disney media. We also explore how this seamlessness is facilitated over time through processes of techno-social engineering creep (Frischmann and Selinger Reference Disney2018), with the MagicBand – designed for use as a ticket and pass to reserved attractions or experiences and extended as a room key, method of payment, and means of location-tracking – at the center of this process. Beyond studying normative agreement and disagreement, through the language used to frame perceptions and discussions of specific systems and technological innovation objectives, we investigate the perceived differences between the space of Walt Disney World (WDW) and other contexts, so as to understand the governance implications for parallel adoptions of technology.
Methodology
In this empirical case, we combine GKC and CI frameworks to explore institutions and institutionalization around data practices and information flows (Sanfilippo, Frischmann, and Strandburg Reference Sanfilippo, Frischmann and Standburg2018) in the reality of cross-context data integration in practice at Disney world. We examine how data collection and processing are changing, the social perceptions of those practices, and what smart cities can learn from Disney, relative either to practice or governance. We also sought to understand the underlying norms, values, and objectives associated with different stakeholder groups, technologies, and outcomes.
We structured our analysis of the formation of these norms, as well as governance in effect through the Governing Knowledge Commons (GKC) framework (Frischmann, Madison, and Strandburg, Reference Frischmann, Madison and Strandburg2014). We frame our privacy analysis in terms of contextual integrity (CI) to compare information flows within contexts, based on characterization in terms of five attributes: (1) information senders, (2) information subjects, (3) information types, and (4) information recipients, as well as (5) transmission principles, which reflect contextual norms of appropriateness (Nissenbaum Reference Nissenbaum2009). We then empirically documented the prevalence and visibility of data collection within Disney Parks, various identifiable categories of sensors that interact with apps and with MagicBands. Following the Shvartzshnaider et al. (2019) methodology, we annotated statements that describe information-handling practices in terms of relevant CI parameters in prescribed flows analysis of the Walt Disney Company privacy policy and My Disney Experience – Frequently Asked Questions (FAQs) page.
Furthermore, we evaluated stakeholder groups’ perceptions within privacy and surveillance action arenas, at Disney World, via sentiment analysis of text discussing each of these issues from public blog posts. We differentiated between official Disney perspectives, endorsed travel blogs, and perspectives of Disney consumers; note that Disney consumers are a distinct, nonrepresentative subset of the general public. We also analyzed news articles and Disney documentation for additional perspective and context. A total of 12,506 posts, from 112 blogs were considered in total. More details on the methodological approach are published by Sanfilippo and Shvarzshnaider (2021).
Background
Walt Disney World has adopted many technologies and integrated smart systems in a quasi-public space, prior to other applications in public. Before diving into the case study, we articulate the ways in which Disney World is a smart city and the ways in which it compares to other smart cities. Understanding both the conceptualization and the limits of the analogy supports appropriate conclusions and implications from this study.
First, Disney is a quasi-public place, in which a private actor controls a large space open to consumers from the general public. Second, Disney employs numerous digital technologies and multiple networks of sensors to enhance services and experiences, as well as to provide feedback. While nonconventional, the relationships between people, technology, and institutions within Disney spaces constitute a specific type of smart city. Still, there are many contextual differences. In comparison to public spaces and the public–private partnerships that often guide other smart cities, Disney is distinct not only in its extensive private control and decision-making, but also due to normative distinctions, differences in objectives, and the unique history of Disney as a planned space.
Normative differences are rooted in context: Disney exists primarily to provide entertainment, while cities must address social needs of local populations. Further, objectives are distinct between actors pursuing commercial interests in comparison to public safety or services. Intentional and planned spaces are also distinctly different from other public and urban spaces. Though Disney does have numerous parallels to other quasi-public spaces and actual intentional communities, such as Irvine, CA, which was thoroughly planned and engineered in pursuit of normative values in ways that have shaped development over time and human interaction with place (e.g. Kling and Lamb Reference Kling, Lamb and Eveno1997), much as at Disney.
Disney is also distinct in serving as a lab for technologies in public places (Martin Reference Martin2019; Walt Disney 1966). Many key smart city technologies were employed in Disney spaces earlier than in other contexts, yet with many distinct uses and applications. This practice raises caveats to how lessons learned might apply elsewhere.
Tomorrowland
Technological futures have long been present in the “wonderful world of Disney,” as imagineers – the official job title of creative engineers employed by Disney corporations – have fused technical knowledge and objectives with creative imagination (Knight Reference Knight2014). In addition to the embrace of technology and immersive branding, Disney expertly sanitizes plots and environments to adhere to Disney norms and simultaneously provides “commodity-satisfying entertainment … [to promote] the power by which people self-police themselves” (Hollinshead 1999). Beyond early innovations presented at the 1964/65 World Fair (Cotter and Young Reference Cotter and Young2004), which have been integrated into parks as attractions, and the pervasive adoption of various technologies to streamline tourism, consumption, and security, Disney has sought to showcase specific technological achievements and possible tomorrows.
Over the years, Disney has innovated and employed cutting-edge technology to realize the “great big beautiful tomorrow, shining at the light of every day.”Footnote 2 Decades before the Experimental Prototype Community of Tomorrow (EPCOT) opened to the public, Walt Disney envisioned EPCOT as the first smart city, though that label did not yet exist (Mosco Reference Mosco2019). “[EPCOT] will take its cues from the new ideas and new technologies that are now emerging from the creative centers of American industry. It will be the community of tomorrow, that will never be completed” (Walt Disney 1966).Footnote 3 Disney hoped that EPCOT would serve as an ever-changing model for what communities could be, incorporating technological solutions to community problems for better resource management, safety and sanitation, and techno-social engineering of a growing population.
While EPCOT never became that prototype community, “Disneyfication” has influenced development worldwide as communities and organizations seek to become more like Disney (Warren Reference Warren1994), from universities to small towns to competing firms to forthcoming smart cities (Matusitz and Palermo Reference Matusitz and Palermo2014; Wylie Reference Wylie2018). In addition to inspiring a specific type of development, Disney has taken a hands-on approach to building communities in its likeness and under its purview, first in Celebration, FL in the mid-1990s, and more recently in the Golden Oak community, in collaboration with the Four Seasons.
These communities embrace Disney culture and innovation beyond the theme park environment that tightly interconnects culture and business in a way that parallels their development and branding around immersive experiences and beloved cartoons. Disney exports their managerial philosophies to other places and industries, as it is so successful (Matusitz and Palermo Reference Matusitz and Palermo2014; Souther Reference Souther2007). Specifically, this blend of culture and commercial has been oriented around family-friendly and historically “sanitized” depictions of fantasy and reality, encouraging “traditional gender roles and old-fashioned morality” in their idyllic blend of futurism and nostalgia (Wills Reference Wills2017, 5).
Mickey after Dark
All iterations of immersive Disney spaces have embraced techno-futurism and data collection, including innumerable information flows in the current context and many historical examples. Disney has notably been the first to deploy particular technologies at scale or in public spaces. For example, the use of RFID to track luggage was first deployed in the United States by Disney, as opposed to at airlines or airports, where it happened globally and which is much more widely known. Further, CCTV represents one of the first technical applications of pervasive surveillance in both Disney stores and parks and is one of the earliest commercial applications of digital multiplexing within CCTV to scale (Coleman and Sim Reference Coleman and Sim1998). Human surveillance has always complemented monitoring cameras, with cast members throughout the park in real time, as well as Mickey after Dark teams.Footnote 4 Detailed surveillance data, collected invisibly and intrusively, is analyzed in real time to not only provide security, but also to minimize lines and customer wait times (Goldfarb and Tucker Reference Goldfarb and Tucker2012). At Disney, changes to technology, and security technology in particular, happen rapidly.
There are subtle but apparent differences in the way visitors engage with technology in the park over time. There are also exemptions or unique circumstances that lead to different experiences for some guests. For example, guests at Disney resorts and parks are free to refuse to register a fingerprint with their MagicBand through the Ticket Tag system,Footnote 5 with options to use an adult’s fingerprint in place of a child’s;Footnote 6 to provide photo ID to security, in place of a fingerprint; or to allow security to photograph children as identification with their ticket. What happens to fingerprints and photographs after guests’ interactions with security is less straightforward.
Disney assures guests that their system “converts the image into a unique numerical value and immediately discards the image” of a fingerprint, associating only that unique numeric representation with their ticket. While that may sound reassuring to the average consumer, the “unique numerical value” is unique to their fingerprints, not random, and will therefore correspond to any representations of their fingerprints through other biometric identification systems or law enforcement databases. Law enforcement professionals assert that Disney policy and practices do not prevent law enforcement access,Footnote 7 via subpoenas or court orders, or intelligence interest in this personal information. The justification for this biometric program, overall, is to prevent ticket fraud through a fingerprint-based biometric authentication system (Jain and Nandakumar Reference Hasan, Zhou and Griffin2012).
Results
Information Resources
User and behavioral data are the primary information resources. Disney employs a massive network of sensors and cameras in multiple systems to understand, predict, and often influence everything users do and purchase throughout their experience at Disney World. This includes the steps they take, the amount of time they browse shops, the food and souvenirs they purchase, the lines they wait in and the entertainment and attractions they engage with.
Some of this data collection is visible, yet many of these interactions are designed to seamlessly minimize visibility, as will be discussed in Action Arena 1. Further, the scope of this visible data collection is not obvious in aggregate.
MagicBands
MagicBands and step tracking represent newer streams of data collection about visitors, with many similarities to fitness trackers. MagicBands facilitate location data collection both through active (e.g., point-of-sale) and passive interaction (e.g., sensors, triangulation) (Stone Reference Stone2017). The MagicBand represented the first deployment of wearable RFID in the tourism industry outside the established use of RFID identification and security badges in transportation and sensitive, primarily government and military research, labs (Hasan, Zhou, and Griffin 2011; Roberts Reference Roberts2006; Stone Reference Stone2017). MagicBand sensors are pervasive all over the resort and theme park spaces, some unobtrusive, or even invisible, while others are visible as ubiquitous silver balls with a Mickey silhouette encircled by LED lights. This latter type of sensor, along with smart devices employed by cast members, is intentionally and visibly interacted with, as visitors wave their MagicBanded wrists over sensors for a variety of activities and tasks. There are additional points for active use of MagicBands via sensors that unlock individuals’ hotel rooms or check them in for transportation to and from the airport. Yet while the hotel room example represents a narrower flow of information, given the nonpublic context and limited proportion of park visitors who stay onsite, the transportation examples that occur outside Disney Parks include third parties and are extremely broad information flows.
Apps
Apps provide another major means of data collection about park visitors, as well as the wider population of Disney customers. In addition to individual apps tailored to each Disney Park worldwide, the My Disney Experience app, and a Disney transportation app, there are various consumer-directed apps such as Disney+ and a Shop Disney app. There are also a number of apps directed at children, some of which are educational, while others are purely for entertainment; one specifically supports interactivity within Disney Parks, entitled Play Disney Parks. Data from all of these apps are integrated in ways that not only facilitate the popularity of particular films, shows, and products, but also how these perceptions correspond with traffic and interaction with various features in and across the parks. The Play Disney Parks app is interesting because it directly integrates location data and behavioral data about children, as a protected population, with data from other sensors and systems within the park. Yet this app does not have a unique privacy policy, despite its target population and leveraging an extensive number of permissions, including full network access and approximate and precise location tracking.
Cameras
An extensive network of cameras collects data resources within the parks. Specifically, in addition to CCTV surveillance, there are a number of other unobtrusive cameras in quasi-public spaces, including those on rides or within attractions to capture the “action” and visitors at play. There are also visible cameras that document visitors during character interactions or photo opportunities that consumers knowingly choose to interact with; sometimes, this latter category of camera is accompanied by photographers or other humans in the loop, who link photos to individuals via their MagicBands. Additionally, “automatic photographer machines” are distributed throughout the parks. We note that these automated photographers are distinct both from human photographers with cameras, who roam the parks, and surveillance cameras, for which footage and images are not distributed to visitors via any of their photography packages, such as PhotoPass, or accounts.
Community Members
Relevant community members and stakeholders in the Disney World context span very different relationships to and with Disney, as well as interests associated with governance issues. While individuals have unique preferences, understanding stakeholder groups and their consensus on particular values and objectives is important to understanding governance processes and outcomes.
The diversity of actors within the Disney organization – including approximately 70,000 union, salaried and nonunion hourly employees at the Disney Parks without decision-making roles – spans interns, “imagineers,” cast members, musicians, a business office, and management roles, as well as many Disney subsidiary organizations. A major proportion of those hourly, nonunionized employees – who number approximately 43,000 – include veterans who fill security roles within the Disney Parks.
Outside of the Disney organization, there are two distinct aggregate groups: (1) visitors and (2) business partners. First, among visitors, different stakeholder groups are represented, not limited to, though including: those associated with conferences and events; families with children; multigenerational families; local visitors versus tourists; adults without children; individuals with disabilities; techno-futurists; and military families.
Second, the businesses and organizations that partner with Disney, to provide services or connect supply chains, have very distinct interests and more significant influence on privacy and surveillance than do individuals. Given the limited transparency about some of these relationships, their outsized influence on and role in information flows is likely to be surprising to many visitors. Third parties, completely distinct from the multifaceted Disney organization, include the Transportation Security Administration (TSA), the Orlando International Airport (MCO), and the City of Orlando, which partner to provide smart transportation solutions and safety throughout transit; various hotel chains in and around Disney parks, specifically including joint properties with Marriott and the Four Seasons; and consumer products and retailers, including Ziplock, Target, and AppleMusic.
Disney World serves many stakeholders. To the visitors it is pitching a unique and unforgettable experience, while to other partners it offers access to a lucrative dataset of information. The recent partnership with Target has potentially fostered information flows of customers’ data between the two companies. This new partnership with the retail sector follows previous collaboration with retail giant JCPenney,Footnote 8 which was established in 2015. More recently, Disney partnered with Lyft to provide a Minnie Van serviceFootnote 9 as supplementary transportation around the resort.
Goals and Objectives
In order to understand the current state of governance around surveillance and personal data at Disney, it is important to have a sense of how goals and objectives diverge among stakeholders. We analyzed the perceptions of (a) visitors and Disney enthusiasts, (b) bloggers endorsed by Disney, and (c) the Disney organization on key governance action arenas around privacy and surveillance. Figure 7.1 specifically depicts how positively or negatively (as measured through sentiment polarity) each of these groups viewed each action arena.
Figure 7.1. Categorical perceptions of action arenas
While there is divergence among these groups on all action arenas, those individuals whose blogs are endorsed by Disney, not surprisingly, generally represent their views as more similar to the Disney organizational perspective on these issues than to that of the general public. We noted that the greatest consensus among all three groups in their perceptions of personalization in Disney experiences and planning; specifically, all three groups frame personalization through language that is generally and similarly favorable. The greatest divergence in opinions is evident in discussions of tracking, wherein users and visitors view tracking practices as generally negative, and specifically excessive and non-transparent, while Disney represents tracking in a slightly positive way. Discussions of safety provide the second most significant gap, though in that arena the public views safety technologies and information flows as slightly positive – emphasizing outcomes and intent, rather than means – while Disney represents safety technologies and information flows in ways more positive than any other action arenas analyzed. More in-depth discussion of each arena is provided in the next section.
Governance
Understanding both the current privacy practices as well as the normative negotiation around each of the identified action arenas and smart systems are matters of governance. In this section we explore the specific perceptions and arguments underlying the tensions around actions arenas, documented in Figure 7.1, in comparison to current rules, as documented in privacy policies and guest or user FAQs. This comparison is helpful to highlight congruence and identify disparities between consumer privacy expectations and the reality of practices.
Action Arena 1: Seamlessness and an Immersive Experience
Disney integrates systems and technologies to provide seamless experiences in ways that are both immersive and invisible to its guests, suggesting magic enables everything, rather than a combination of marketing and engineering. Everything is aimed towards smoothly getting everyone to the next ride, meal, or event as efficiently and unobtrusively as possible, with all of the technologies and processes that architect choices and experiences obfuscated or made invisible. One touch of MagicBand, as if by magic, opens doors or pays for souvenirs and food. The Disney app suggests the best rides for you and your family. Your photos are instantly connected to your apps and accounts. While the MagicBand is thus convenient, and arguably makes a Disney experience more enjoyable, questions about potential privacy implications behind the notion of seamlessness are rarely discussed by either Disney stakeholders or visitors.
Disney often describes innovations, particularly those that bring fiction and fantasy to life, in terms of “magic” and “imagination,” which have highly positive connotations. “Invisible technology provides magical experiences for consumers.” Increasingly, these efforts incorporate invisible and seamless technological systems to enhance visitors’ experiences and allow them to immerse themselves, as Disney creates a “realm of magic and enchantment where they are not only dazzled and entertained, but may also have a chance to be part of the show.” Disney’s values around innovation and illusions are evident as they frame and promote particular systems and in direct value statements made by employees, such as “we all work toward the same goal each day – to uphold the legacy set forth of inspiring those around us and creating new experiences.”
This idealization of technological innovation, coupled with invisibility of technology, so as to create “magic” is echoed on blogs that are elevated and endorsed by Disney, including the Disney Mom’s blog, which often emphasizes how “amazing” technology is, alongside the preference that it “seems real” for their children.
In contrast, broader populations of users and visitors describe seamlessness and immersiveness slightly differently. While there is general agreement between stakeholders about how positive it is that systems are integrated – most seem to agree about issues of “convenience,” ease, and minimization of confusion – and the experiential aspects of immersiveness, the disagreement tends to fall around whether the technology is visible or “behind the scenes.” Even those who are enthusiastic supporters of Disney, on the whole, express their desire to make things more transparent, rather than less visible; many blogs seek to uncover how something works.
The dataset did not include any posts expressing concerns about privacy or data governance associated with applications of facial and voice recognition technology in attractions for children, such as “Turtle Talk with Crush,” though there were blog posts analyzing and articulating the technological design. In contrast, some blogs about immersiveness, seamlessness, and recognition technologies outside of attractions express hesitation and worries about whether people understand “concern over privacy,” particularly with MagicBands outside of rides. In this sense, there is also a suggested distinction between rides and more general experiences at Disney World within the minds of the general public and visitors. This also raises additional dimensions to social dilemmas around seamlessness and immersiveness in the form of questions about whether alignment between information controllers and consumers is sufficient to accept the privacy governance status quo as “good.” Seamlessness of data collection also seems to render some of the downstream and long term implications invisible to consumers, though not necessarily inapplicable.
Action Arena 2: Public Safety and Security
A second major action arena, around which both governance and technical interventions have diverged from the expectations of visitors and the general public is that of public safety and security. Innovation at Disney has historically been coupled with a close relationship to military and law enforcement interests (Knight Reference Knight2014; Shearing and Stenning Reference Sanfilippo and Shvartzshnaider1985, Reference Shearing and Stenning1987), which have also driven technological innovation in a number of other contexts such as the relationship between academic computing research and DARPA (e.g., Roland, Shiman, and Aspray Reference Roland, Shiman and Aspray2002). Yet Disney also has a history of supporting privacy, both in alignment with family values and the sanctity of “home” and more directly through investment in privacy research (e.g., supporting past iterations of the annual Privacy Law Scholars Conference). More recently, this dynamic has changed as they shifted to narratives around safety and security preferences, in 2016Footnote 10 and 2019,Footnote 11 as well as emphasize a false trade-off between privacy and innovation or transparency.
Despite the peace of mind that many may feel due to Disney’s prioritization of security, relative to both their children and their accounts, Disney has long identified a false tradeoff between privacy and security, taking extreme “invasions of privacy” in pursuit of “absolute security” (Smoodin 1994, 2013). Disney World, as an immersive and contained environment, holds more surveillance per square inch than the average American prison and is somewhat singular in that the surveillance is designed not to protect or promote production, but rather consumption (Project on Disney 1995).
Yet a cultural emphasis on the safety of children and families is supported by this surveillance environment, in ways that are consistent in practice. For example, fingerprintsFootnote 12 and facial images, along with scans of MagicBands can be used to locate and reunite small children who may wander away from families or otherwise get separated in crowds. The ability to leverage technology to quickly overcome separation minimizes anxiety and uncertainty, as multiple technologies can confirm and triangulate identities and relationships. A five-year-old girl, separated from her parents upon exiting a store on the right, rather than the left, was reconnected with her family by cast members within minutes, using her MagicBand and photo. A cast member noticed her, alone and looking upset, asked to scan her wrist and promised to help; the iPad she carried connected to a map that identified her parents’ location and the nearest cast member to them. The cast member then took her photo to positively confirm her identity and allow their counterpart to share with the parents.
Official Disney sources promote a dialogue prioritizing security over privacy. Disney offers compelling and well-packaged arguments about safety and security, while assuring visitors and readers, in vague terms, that data will be “secure,” as opposed to actually discussing privacy or the tradeoff being made. The language that they use around safety and security is highly assertive and positive in tone, communicating why visitors should trust them and need not worry, and providing clear examples in which they succeed, such as the anecdote from the previous paragraph.
Endorsed perspectives are similarly favorable; they communicate their trust in Disney and their positive experiences, without interrogating any tradeoffs between privacy and security. In fact, these perspectives from parents and Disney youth and Disney marathon runners often continue to focus on their positive experiences, even when faced with questions about privacy or skepticism about public safety. For example, a question posed to the Disney Parks Moms Panel by a general visitor focused on biometric privacy: “Are fingerprints stored to your name or just to your MagicBand?” The response was framed in terms of safety and security; the only mention of privacy was in the link to the Walt Disney company’s privacy policy.
While the general public frames these issues as slightly positive, in comparison to the extremely positive narratives directly from or endorsed by Disney, the action arena is more fragmented. There is a definite sense that the overall objectives around safety and security are meaningful and important, given that there are so many children in these spaces, as well as that outcomes are good. People feel very safe and many blogs discuss the same incidents in which security and surveillance identified individuals with handguns and prevented them from entering the parks.
Yet the general public’s norms about safety extend beyond security to include privacy and Disney either fails to acknowledge this or willfully ignores it. Further, there are differences between noticeable security, perceived as trustworthy, to inconspicuous or invisible surveillance, that many feel is an infringement of privacy. For example: “I have noticed increased security at my last few visits. Not enough to make me feel uncomfortable, but definitely more obvious. I’m sure there’s stuff going on that I can’t see as well.” This blogger went on to explain that feeling safe is important, but a sense of being watched without knowing who is watching is uncomfortable, and asked readers to comment on their own opinions about security and surveillance at Disney.
There are underlying, and sometimes stated, questions about whether there are more privacy-protecting ways to manage these data flows. In addition to the blog posts that discuss or hint at these tensions – and much more often express uncertainty (e.g., “though I don’t know if…” or “I’m not really sure how…” data is stored or protected) – many news articles convey these questions, from the perspective both of journalists and in quotations from travelers. While journalists have raised questions about things like data retention, bloggers suggest similar concerns in discussing long-term tracking around MagicBands, including that they “don’t expect to continue being watched … after [they] go home.” Further, they express greater trust in Disney than in privacy or security of technology in any context, including Disney technology. Similarly, consumers question the increasing presence of security personnel in these spaces, with third-party “backup” from “more uniformed and plain-clothes police officers, security guards, and dogs patrolling the parks” at particularly busy times of year. In this sense, while Disney appears to be trusted, consumers don’t necessarily trust Disney’s third-party partners or understand the nature of those relationships around privacy and security.
Action Arena 3: Personalization
Disney works very hard to process user and visitor data in order to offer personalized experiences, both within the parks and in planning trips (Stone Reference Stone2017). In addition to technologies supporting personalization, such as recommendation and planning systems, there are also social and sociotechnical systems that extend personalization to face-to-face interactions within Disney Parks. Characters and staff greet people, particularly children, by name and interactive games and rides are tailored personally based on children’s interests and experiences with other attractions or characters in the parks. While all of this is supported by technologies that are invisible to visitors, it extends the sense of magic.
Discussions of personalization around rides and characters are overwhelmingly positive, no matter the stakeholder. One underlying system to facilitate personalization is called MyMagic+, which Disney explains “is using technology to make it easier than ever before for guests to make the most of their Walt Disney World visit.” It connects many technologies and integrates all of the datasets in a way that both supports users’ choices and makes recommendations, during both the planning and visiting stages. Not only are official Disney posts about this very positive, but so too are unendorsed blogs, on which descriptions range from “empower[ing]” to “favorably impressed.” The only complaints made about this system, within the dataset collected, were about system outages, in the first year it was rolled out (2013).
Disney has become more ambitious in the space of personalization, developing an AI virtual assistant, the Disney Genie, which was finally released to the general public in 2021 after extensive testing to limited users over two years. Those bloggers – both endorsed and not – who have had a chance to test the system or to witness demos are nearly as positive as official Disney sources, though more tentative, using language that is hopeful. Other differences in sentiment, if not overall favorability, are actually present on endorsed blogs that are generally positive about personalization at Disney, but with very different emotional charges. For example, various Disney Mom posts that address experiences traveling to Disney with disabled family members emphasize how important personalization, and associated accommodations, are to them, given how excluded they feel in other spaces. They emphasize a willingness to share details about health and disability needs in order to have happy family travel experiences that would otherwise be impossible.
Overall, the general public is much more enthusiastic about personalization efforts by Disney than any other action arena, which leads to the greatest normative agreement in this space, in addition to consumer satisfaction. Many blogs, both endorsed and representing an array of average visitors, convey their customer loyalty to Disney in experiential terms: it is a one-of-a-kind experience for them or for their children. Many share tips on planning or suggestions, all while frame them with statements such as “how to make sure your dreams really DO come true” and the use of the tag #DisneyMagicMoments. A shared sense of exceptionalism and the belief that the experiences are unique to you align value and preferences around personalization between Disney and visitors. While there are financial costs associated with personalization, and Disney more broadly, most blogs equate the value of the experience with the cost.
Few acknowledge the nonmonetary value associated with all of this personalization – in contrast to the extensive number of blogs about hidden financial costs, including around some personalized services – though one blogger astutely provides a counterpoint to the prevailing positive sentiments around personalization: in terms of “our perception of value for money and worthwhileness” around “enchanting extras,” upcharges for luxury and/or personalized add-ons to attractions or events, you also have to be “willing to splurge” your data and your money.
Action Arena 4: Guest Tracking
Guest tracking is an important priority for Disney Parks, given that it intersects with a number of different objectives and other action arenas – including, personalization, safety and security, and optimization of lines and experiences – and promotes economic interests by introducing a number of granular metrics by which to assess and monitor interest in various attractions, experiences, and products. Despite the many interdependencies, it is notably an objective in its own right and presents unique governance dilemmas.
This action arena is by far the most contentious. Not only does Disney shy away from promoting many of the technologies employed to achieve objectives associated with their tracking agenda, but they frame many of these systems using somewhat defensive language within their attempts to convince visitors of the advantages and fend off criticism from media sources. For example, Disney has never explicitly blogged about step tracking – which is done through MagicBandsFootnote 13 – or embedded sensors within floors or walkways, yet various sources, including publications by Disney “imagineers,” assert they engage in these practices and have tested a number of different approaches (e.g., Andrews et al. Reference Andrews, Huerta, Komura, Sigal and Mitchell2016; Slyper, Poupyrev, and Hodgins Reference Shvartzshnaider, Apthorpe, Feamster and Nissenbaum2010). Instead, Disney glosses over them, while introducing the features or attractions that these forms of tracking support, mentioning the underlying technologies only in the vaguest terms, yet with highly positive language and framing. Further, as many visitors and bloggers can attest, location-based tracking is pervasive relative to in-app recommendation systems and estimates of lines and crowds, as well as in monitoring parking lots.Footnote 14
While most blogs in the dataset communicate in a positive tone about almost everything Disney, there is visceral negativity in explicit framing of tracking by most visitor blogs, along with negativity about cost, biometric scanning, and facial recognition. Notably, many of the tracking technologies and systems are framed more positively when the word tracking is not included, which perhaps provides an explanation for why Disney attempts not to use it. There are also very lukewarm framings on endorsed blogs, as they try to give the benefit of the doubt to Disney, while personally seeming skeptical that so much tracking is necessary to provide the features they enjoy. Disney has trouble selling tracking as positively, yet when framing many of the technologies that support the most extensive tracking as anything else, the criticism seems to vanish from other blogs, while still coming from the press. In this sense, tracking is unpopular with Disney customers, may also be poorly understood by those customers, and may be even more unpopular with the general public.
MagicBands and apps represent the two most significant mechanisms for tracking individuals around the park, as opposed to the use of biometrics, which facilitates tracking day-to-day and authenticates tickets. MagicBands also address other objectives – such as crowd control, children’s safety, seamlessness, and invisibility – yet tracking locations is the least popular. “Through various forms of tracking and data gathering, Disney is able to amass lots of information about their guests.” While some perceive this to enable “cool” things, like locating guests to bring them food in crowded restaurants or helping users to “get directions” in real time, others are more critical: “By tracking your location, Disney gains an added benefit. They receive big data that’s otherwise incalculable” and inaccessible to them. These more critical bloggers see the purpose as more in Disney’s financial interest than in the interest of visitors.
Other criticisms of the tracking arrangements around MagicBands parallel those concerns voiced around seamlessness, centering on whether or not users consent to the system, which is implicit in purchase. However, the photos, as with PhotoPass and Memory Maker, are taken and linked to individuals, regardless of purchase, with those not purchasing being offered additional opportunities for purchase after the fact.
Others are more concerned about the privacy implications of “missing photos.” Three separate blogs discussed the “cons” of PhotoPass and Memory Maker in terms of how “inappropriate” and “unsettling” it is to find someone else’s photos among your own, as well as to express their discomfort with the idea of someone else having their personal family photos. However, this phenomenon is more widely discussed in terms of frustration when photos of a favorite experience are never linked to the account, which bizarrely implies there are people who may value more extensive tracking. There are formal protocols to pursue in order to identify and claim photos mistakenly attributed to someone else or not attributed to anyone at all:
[S]ubmit a missing photo claim form within 30 days of the date of the photo. The PhotoPass cast members were able to locate a missing set of photos from my visit, but there is no guarantee that missing photos will be found. If there is something that you really want to make sure you have a picture of, be certain to have the PhotoPass photographer use your camera, too.
In this case, there are existing governance mechanisms to address misidentification, but not to compensate for privacy harms associated with this aspect of tracking.
Smart transportation provides another system in which there is very extensive tracking and real problems, despite this tracking, which lead to negative perceptions among those blogs that associate tracking with those problems. For example, tracking and predictive algorithms distribute buses based on current use and historical data, yet these systems seemingly leave humans out of the loop in making decisions that might better support visitors, such as allocating more buses to hotels following concerts and special events that the system wouldn’t otherwise account for. Further, the push to automate transportation systems is historical, with the monorail, which has seen recent problems, as an example; in part due to these challenges, they turned to more extensive tracking in this sector. Nevertheless, a majority of blogs are highly positive about the transportation systems, particularly around their responsive and dynamic nature, and the opportunity to seamlessly move from hotels to parks without difficulty or additional payments.
Action Arena 5: Optimization
Disney’s “operating system” manages resources and people; the objective is to guarantee an efficient, enjoyable, and smooth experience to all visitors, which helps maintain their high rate of return: “70% return rate of first time Disney visitors.” By “optimizing the mundane,” Disney makes “magic” and visitor satisfaction increases dramatically. As emerging technologies have been introduced to streamline guest experiences and minimize waiting times, as well as digitize and automate planning, Disney has framed these actions in terms of optimization, as a value in and of itself. They invest heavily in technological and human services to collect feedback from visitors about their priorities and their experiences, in order to better tailor future experiences and redirect customer service for the optimal Disney vacation. “Optimize” and “optimization” are often invoked to explain specific aspirations and innovations, associated with guest experiences, business practices, and park operations.
For example, posts across all three stakeholder groups – whether they are parents or adults without children – express satisfaction with efforts to entertain children who are waiting in line, through augmented reality games supported via app, play structures along the way, and physical games and characters throughout lines. However, the discussion of wait times, as framed among the different populations, illustrates the differences in current perceptions of existing systems, despite the clear alignment of preferences and satisfaction with new efforts made, though not yet resolved. Many independent sources, including popular consumer blogs, crowd-sourced datasets to monitor average and current wait times for specific attractions before Disney introduced this feature, and continue to do so even though the Disney Parks app does now include their estimates. Disney estimates are often overly optimistic or update more slowly than the crowd-sourced sets, replicating the same perceived problem, predating apps, with the physical clocks showing the approximate wait times at the start of lines: “I don’t know if they’re just slow to update or if they want you to get in line, even if it will take longer.” To paraphrase a question asked on multiple blogs: if they have so much user data, why can’t they estimate more accurately? Some of these posts expressed the belief that optimization priorities around crowd control were adversely impacting visitors’ experiences by raising unreasonable expectations about how many attractions they would be able to fit into a day. In contrast, another blogger simply felt that optimization would improve visitors’ experiences in the long run, but that in the short term, Disney hadn’t yet figured out how to achieve it aims or process all of the data generated.
Yet there is also evidence that many visitors obfuscate and create workarounds to circumvent both the perceived faults within technical systems for fast-pass and other data governance and systems. Various blog posts soon after MagicBands were introduced and before paper FastPasses were completely phased out offered advice on how to game the system: book both sets of FastPasses before Disney integrated them. Other posts about gaming the system are more privacy-aware; they provide advice on how to minimize observation, utilizing loopholes that emerge as Disney seeks to rapidly innovate and optimize particular systems, experiences, or features. As Disney pushes for optimization through technology, they almost always provide low-tech mechanisms to support opting out, in order to meet all possible accessibility concerns. Taking accessible alternatives to biometric scanning or metal detectors, or the use of MagicBands in restaurants, almost always involves screening by a human and minimizes documentation via data. While Disney does not make data available about how many people opt out, they have engineered opt-out procedures in such a way as to discourage them. Few consumers discuss or seem aware of them, many employees also lack information about them, and observation of entrances to WDW parks indicates that few navigate these low-tech, alternate processes.
Various customers and visitors opt out for other reasons, as Disney seeks to optimize (and automate) recommendation and planning systems. While overall there is satisfaction with customer services, documented via both our sentiment analysis and the extensive customer survey apparatus deployed to WDW guests, it is lower for these automated systems than for recommendation and planning. There is confusion about how to actually use many of the planning features without the support of humans in customer service. It is also notable that satisfaction with automated recommendation and planning systems has not changed significantly over time, likely indicating that frustrations and confusion are not only associated with the newly introduced systems.
Recommendation systems embedded in planning, which have been utilized by Disney for decades – albeit earlier iterations were less automated – do not receive as significant attention or garner as much enthusiasm from visitor blogs, and nor do various options to pick and choose so as to personalize travel plans. This hints at some tension with efforts to support personalization. Similarly, many bloggers express bemusement about or negative perceptions of suggested purchases made through Disney Parks apps, and some bloggers have speculated that the Disney Parks shopping app is no longer supported because visitors found the recommendations too aggressive. In contrast, recommendations about rides or attractions that are similar to rides that visitors have experienced are viewed much more positively.
As with other action arenas, there are disagreements between blogs representing the general population of visitors and endorsed blogs, some of which may correspond with the conflicts of interest represented by those endorsements. Endorsed blogs are much less likely to discuss financial concerns and this was most obvious in posts addressing optimization and automation. In contrast, endorsed blogs did diverge from official Disney posts overall, using language that was more hopeful and tentative, rather than confident.
Patterns and Outcomes
There are obvious lessons to be learned by smart cities from the case of privacy and surveillance at Walt Disney World. For example, social perceptions of appropriateness around wearable devices – people don’t like to be tracked outside the purpose or boundaries of the device, for example – and around children’s interactions with voice recognition and smart systems – interactive character features, which respond to children, have many parallels to step-tracking, triangulation between consumer and public surveillance, and to personal assistants like Alexa and Siri.
The majority of this discussion section focuses, however, on practical implications for smart cities and conceptual implications regarding cross-context data integration and aggregation. WDW is an interesting case in which to examine contextual integrity and the formation and change of norms over time because what is deemed to be appropriate is heavily shaped by the company. While it responds to norms and expectations of its customers, there are also spillover effects beyond the domain of Disney as the company’s practices serve as “industry-leading” and model information flows and governance for other public and quasi-public spaces. Much of this discussion will focus on the significant limitations around implications for smart cities, given the contextual differences between Disney World and smart cities, as associated with distinctions: in motivation and values, between consumers versus citizens as stakeholders, and in weight of consequences.
Disney World is carefully orchestrated to convey a sense of magic: a special place, where reality may be deluded. World Disney is a real-world, though privately owned, smart city, in which those who choose to be patrons, rather than a heterogenous public, are relevant community members and information subjects. As guests in Disney spaces, we leave our norms about the public sphere at the gate. This case, and previous research on Disney, documents the distinctions between norms at WDW and norms in other contexts. From the moment we scan our fingerprints on the Ticket Tag, we agree to be tracked, monitored and analyzed at every step we make, through apps, biometrics, facial recognition, MagicBands (as wearable devices), recommendation systems, smart assistants for planning, smart locks, transportation, and voice recognition. All to fulfill the illusion of magic. As our analysis shows, with use of clever fusion of fantasy and false trade-offs, along with misleading dichotomies, Disney has avoided broad scrutiny over many of its practices, yet has worked to coordinate governance of some information flows with the social expectations of their visitors. The use of smart locks, intelligent transportation, and biometric tracking are relevant examples.
Smart locks provide one example from which other contexts may learn from Disney’s early adoption. While Disney hotels are not unique in using a variety of technologies to unlock hotel doors, including both RFID and app-based entry, more hotels use magnetic cards to open doors.Footnote 15 However, increasingly apartment building are moving to smart locks, which concerns many residents about both privacy and questions of inequality,Footnote 16 given lower smart phone adoption rates among elderly and low-income populations. Interestingly, the reservations and criticisms that most Disney visitors express pertain to frustrations when their MagicBands or apps won’t work, which do align with some news articles that discuss challenges associated with deploying the technology before it is perfected. Yet the lack of discussion of privacy around this system may illustrate that Disney is more appropriately a model for other hotels, not permanent housing.
Tracking visitors in Disney Parks also has many parallels to tracking of consumers, either in automated storesFootnote 17 or busy retail spaces, and pedestrians, as with smart sidewalk projects, including the recently abandoned Sidewalk Labs project in Toronto.Footnote 18 While the specific systems may not translate well, the opportunities for users to provide feedback and actually have a response is a valuable model for cities to consider. The pairing of the Shop Disney Parks app with location tracking was considered by many visitors to be creepy, and Disney acknowledged that obvious normative gap by pulling that app from the market. Responsiveness to the public is important, which is why visitors’ relative comfort with MagicBand tracking, due the convenience and safety, as well as their “trust” in Disney, is unlikely to correspond with expectations and preferences in cities.
A major distinction between Disney and smart cities contexts, with respect to how these systems function and are perceived, relates to perceptions of and trust in decision-makers by other stakeholders. Many people trust Disney, implicitly, yet Disney often takes advantage of our confirmation bias. It promotes itself as a place of trust, kindness, and comfort, away from the reality. When people come to Disney World they see things differently, without fear or (too many) critical questions. Facial recognition keeps your children safe. Voice recognition enables “remarkable” interactions between visitors and their favorite animated characters. Location tracking makes sure we don’t stand in line. Yet some visitors do oppose particular systems or changes; Disney tries to be responsive, though it is important to note that visitors may not be sufficiently aware of how the technologies work to actually question everything they might normatively oppose, particularly in other contexts, namely those outside the border of Disney’s empire.
Seamlessness in design dissipates for renegades. You can refuse to provide fingerprints, in exchange for providing other proof of identity, or use a card for a ticket, rather than a MagicBand. These alternatives, however, diminish the overall experience; as so often happens in techno-socially designed systems, analog alternatives are presented as a less attractive option. For example, many employees are unaware of opt-out procedures and many services are made unavailable to those few who do opt out.
In this sense, Disney follows the worrisome trend in presenting false tradeoffs between information collection and quality of service. Given the relationship Disney maintains with its guests, opt-in would also likely work as well. This should serve as a warning to smart city advocates, who face a much more challenging task relative to “opt-in” options. Further, nudges to encourage opting in, when made by cheerful Disney characters, are likely to be perceived as much less sinister than those from police officers. Based on our analysis of blog posts, people seem to be more comfortable with nudges from Disney than with other commercial nudges. In addition, the information flows to Disney and to law enforcement within smart cities are more similar in effect than individuals realize, given the relationships between law enforcement and Disney. The implications of these information flows are thus similarly problematic, particularly in an age where mistrust of law enforcement is increasingly pervasive.
While Disney’s information flows, overall, often align with consumer expectations – whether organically or due to extensive marketing – many of their practices would not be appropriate for smart cities. The differences noted in social perceptions and acceptance reflect the fact that while Disney functions as a smart city, it is a distinct and private context, in contrast with public sector and public sphere contexts, reflecting very distinct norms. Even as cities partner with private sector firms, they should not assume this makes them more similar to Disney. Instead, they should question if those partnerships are appropriate and consider what types of governance are necessary to engender trust in decision-makers, other actors with access to data, and practices. A set of key overriding differences between these contexts is in the set of values being optimized, how they are selected, and who must accept them. Cities are not being optimized for profit, convenience, or a sense of wonder, while Disney is an escape. Cities must resist the temptation to buy vendors’ hype that it is possible or desirable to engineer the level of convenience or happiness present at WDW. To pursue this agenda would mean significant harms to the public with respect to privacy, transparency, fairness, and inclusion. Disney only works because it is an exception and bounded in time and space for its visitors.
However, a significant lesson to learn from this case, for smart cities and other public contexts, is the need to have a dialogue between the stakeholders even if they’re not all involved in decision-making. There are real similarities between Disney and its customers negotiating information flows, or other action arenas, and examples of privacy localism, just as there are parallels between Disney-specific norms and urban privacy norms. Privacy and surveillance practices and outcomes within Disney might not be normatively good from everyone’s perspective, just as local privacy governance in Seattle and Oakland differ from surveillance efforts in Atlanta and New Orleans, which are perceived to positively promote safety. In this sense, while many cities understand how contextual privacy is, smart cities can learn from this case procedurally. Two keys to Disney’s approach to information governance are the use of detailed social surveys and follow-up protocols with their guests to understand what expectations are not being met, and a commitment to iterative reevaluation.
Conclusions
Significant datasets collected by these, and other, systems feed Disney, as they construct a demi-reality. Walt Disney World provides an immersive environment for parents and children to experience the magical world of animation and imagination. There is no mistake in the name, it is indeed a “world” where our beloved characters come to life. To facilitate this real-life illusion, Disney needs and always has been in step with technological advances. Overall, Disney World attempts to make all visitors feel special and experience “magic.” Disney wants to protect us. Entertain us. Show us a good time. Visitors briefly relinquish the normative expectations of privacy that they have at home and in their cities. What may seem like an infringement of privacy in the middle of a busy public street, as a camera captures everyone and each move they make, may seem necessary or even desirable to guests at Disney World, in order to evoke an idyll and enable an absolute sense of safety. Disney World provides a great illustration of how context matters, but it also can be misleading to transfer the same norms to a real-life situation. When we step into this constructed world, we forget reality, but our concerns remain. Disney has to deal with the same concerns and tradeoffs as the real world. However, it often constructs a new normative reality that we would usually reject but, in case of Disney, accept as a necessary trade-off.
Behind the veil of false trade-offs, marketing slogans, and grand promises of a better world, there is an industry that is being built on aggregating our information. In the case of Disney, and Disney resorts in particular, tourists and consumers are the products, we supply Disney with our viewing habits (through Disney+), our favorite characters (through purchases in Disney stores), our preferred rides, and our daily routines when wearing MagicBands. All of this information is shared under pretenses associated with personalization, safety, immersiveness, and “magic.”
In making conclusions from this study, it is fair to criticize Disney’s lack of transparency and false trade-offs (e.g., Bowers Reference Bowers2019; Mosco Reference Mosco2019), but should acknowledge that they actively work to meet expectations in some action arenas. Where Disney and its customers are not diametrically opposed, they often meet in the middle or constantly revise to reach a mutually satisfactory outcome. Disney wants to keep its customers, who may not reflect the wider population. There are, however, significant tensions between these processes and actual outcomes. Despite the company’s status as an early adopter, it is difficult to use Disney as a model for smart cities, given the contextually specific preferences of visitors, in comparison to the general public, beyond replicating responsiveness.
In our day-to-day reality we now see a rapid adoption of technologies similar to those used by Disney, such as smart locks in apartments controlled by landlords, datafication of transportation systems,Footnote 19 and biometric authorization.Footnote 20 The public–private partnerships behind these efforts are often explicitly inspired by Disney (e.g., Mosco Reference Mosco2019; Souther Reference Souther2007). In a now familiar sleight of hand, they promote seamless, frictionless interactions, tailored service, and efficiency in their products, bringing the “magic” of Disney to our day-to-day lives – creating a smarter city. This is not always bad; technological progress is part of life. However, we argue that while some of these technologies can be beneficial, we shouldn’t manipulate the consumer, a Disney resort visitor, or a resident of a “smart” city to abandon their values, norms, and expectations when they immerse themselves in the new world. On the contrary, the new technologies should feed off users’ expectations to provide a safe and trustworthy environment that will nourish the creation of healthy sociotechnical systems that respect societal values and governing information norms.
Open access