Are Disney MagicBand privacy concerns legit?

December 4, 2013, 2:34 PM · Are you worried about your privacy while wearing a MagicBand around the Walt Disney World Resort?

MagicBand
Photo courtesy Disney

Some visitors — and would-be visitors — have expressed concern. They're worried that Disney will be tracking their movements around the park, including what they do and what they buy throughout the day, and that Disney could use that information in ways that those visitors won't like.

MagicBands are the RFID-enabled bracelets that Disney's issuing to selected hotel guests as part of its new MyMagic+ system for managing Walt Disney World vacations. Visitors can use the MyMagic+ section of Disney's website or apps to make advance reservations for attractions, shows, and restaurants during their stay at Disney World, then use the MagicBands Disney supplies to access their hotel room, enter the theme parks or be admitted to their reserved ride, show, and meal times.

Visitors tap their MagicBands on their hotel room door or at checkpoints at park and attraction entrances. But the RFID chips in each MagicBand can be read from up to 30 feet away as well, as Kevin Yee detailed this week. Disney's already using that functionality to take on-ride pictures of MagicBand users on selected attractions. But inside sources have told us that the technology will play a part in creating interactive "moments" elsewhere in the parks, such as in Animal Kingdom's Avatar land, now in development.

Disney had planned to have expanded MyMagic+ to more visitors by now, but bugs and glitches as Disney attempts to scale up the system have slowed the roll-out. Yet it's clear from Disney's statements that it envisions more aggressive use of MagicBands in the future.

Let's face it: If Disney didn't track its customers while they were on company property, that would put Disney in the minority of large retail corporations. Smile for the security cameras next time you enter a store — they're there. And those discount cards you get from the grocery and other retailers? They're tracking every purchase you make.

Heck, when you carry a Visa or Mastercard credit card, you might as well be wearing a GPS device, as the card issuer is tracking the location of your payments, as well as their amounts. If you're carrying a cell phone, you are carrying a GPS device — one that cell carriers (and even the federal government) have the ability to track.

Want to go through life without being tracked? Use cash. Ditch the cell phone, the credit cards, and the discount "club" cards and carry nothing but cash. Walk up to the ticket booth and pay cash for a one-day, one-park ticket. As soon as you're through the front gate, throw that ticket away. Disney won't know who you are and won't be able to track anything you do.

Of course, that means you won't be able to use the Fastpass system for ride reservations. Nor will you be able to park-hop. Photopass pictures are out, too. But Disney will collect no data about your whereabouts and activities throughout the day, save for noting that one more (anonymous) person's ridden each ride you board, or that the company made those extra dollars for the stuff you've bought.

Most visitors, though, would like to have the opportunity to reserve no-wait ride times. Or to get on-ride photos automatically. (Or to get discounts when they go to the grocery store.) Such benefits are the price that companies pay to entice us to use systems that allow those companies to track us. Companies make that money back when their tracking efforts lead them to tailor offers or experiences that cause us to spend more money with those companies than we would have without those deals and discounts. In fact, Disney's facing lower-than-planned revenue in its theme park division now because MyMagic+ hasn't rolled out to the point where it's led to the big increases in guest spending that the company had anticipated.

If customers don't like the benefits of participating in a tracking system, they won't stick with them. Right now, the hassles of navigating MyMagic+ in beta testing have led many Disney hotel guests either to decline to participate, or to switch back to more traditional admission and room key cards, plus paper Fastpasses. But reports from in the parks suggest that's more due to people being unable to collect the benefits of MyMagic+ due to lost reservation times or dysfunctional MagicBands than to privacy concerns.

Let's not completely dismiss those concerns, though. While corporate tracking of consumer activity has become the norm in America, consumers ought to know more about who else will have access to that tracking data. We've raised concerns before about Disney cast members using MyMagic+ data as a "stalking app" to find out where individual guests they want to meet will be later in the day, then showing up off the clock to "just happen to bump into them." Disney should be making clear that anyone who tries something like that will be fired on the spot.

We've also wondered if Disney could use MagicBands to track alcohol sales more closely. Imagine getting cut off at Epcot because MyMagic+ has recorded that you've bought enough alcohol over the past couple hours to get an average-sized person to his legal limit. One of the challenges for tracking system is to ensure they don't feel creepy to the people who use them. While cutting off a drunk might be good practice (one that servers are supposed to be doing already), have a computer make that call automatically probably fails the "creepiness" test for many visitors.

Throw such concerns onto the pile of bugs, glitches, and challenges that Disney must overcome to make MyMagic+ scale to the level where it earns the company enough money to justify the billion-dollar investment. But if Disney fans and visitors object to the idea of Disney tracking their activity while on Disney property, well, they're going to have to do much more than refuse to wear a MagicBand to prevent Disney and other companies from tracking where they go and what they do.

Replies (21)

December 4, 2013 at 4:08 PM · Like you said. Privacy died a long long time ago.

December 4, 2013 at 4:40 PM · I agree that privacy has gone away a long time ago. The concern I would have is Disney's ability to ensure the system is not compromised to outside sources. I do not mind if Disney uses the information to help make my stay there better however with all of the problems the system has it makes me wonder about the Internal Security of the systems and the ability for Hackers to gain access and use the data in criminal ways. While this is a concern with any computer systems the number of problems with this system makes it even more concerning. Will this stop be from going to Disney, using fast pass and things like that no. But I would never attach a payment method to it.
December 4, 2013 at 4:53 PM · I don't really see how Disney could track you more with the Magic Band than they already could with your room key/park ticket/charge card/dining plan card.
December 4, 2013 at 4:57 PM · Privacy matters, but each person has a degree of acceptability. The MagicBand suggests everyone must agree to be tracked and it can't be avoided. That is an unacceptable condition. If the program is instead characterized as a way of benefiting the customer, it can shift the discussion. The privacy policy was a strange document to read. Instead of discussing the benefits, it suggests a warning message. This isn't necessary for a theme park trip. Maybe I'll opt out.
December 4, 2013 at 5:11 PM · Put me in the Anti-Magic Band/NGE group. This billion.5 dollar boondoggle of pure evil(at its core)will bite WDW's rear end at some point in the long-term and the ones that will suffer won't be the cm's. It will be us the fans and guests. This system doesn't solve the resort's present day core/main problem: Capacity-there aren't enough things to do at WDW's tired, stale parks not named MK.I didn't vote, but if there were was an option of "I wouldn't use MM+/Magic Bands anyway", I would've voted for that. First post on here and a thanks to the TPI crew for letting me join/participate here.
December 4, 2013 at 11:00 PM · I love the Magic Band system. On a trip to Orlando this last October everyone in my party had to have their park entrance ticket, room key, and an Express Pass while at Universal. During our Disney stay we only needed our awesome Magic Bands. I'll take this ease and convenience over the privacy concerns any day. Plus the excitement level in my family over receiving the Magic Bands and using them was tremendous. My kids and I were constantly racing down the hallway of the Boardwalk to see who could open our room door first. : ) And when my daughter got hers before the trip she wore it to school and all the other Disneyphiles were very jealous as she was the first to get one.
December 4, 2013 at 11:44 PM · Just because our privacy is being chipped away by other entities in this world doesn't mean that adding another to that list is not a big deal and that we shouldn't care. It IS a concern that we're being tracked by everyone else too.

The fact is that Disney is already tracking people via credit cards, cameras and who knows what else before we even bring up the MM+ situation. Sure it's probably not enough to make people not go to WDW based on privacy concerns alone, but if added to the list of other negatives -- specifically the FP+ system -- then it could be enough to at least make you think twice.

Having used the MM+ bands and knowing that they ultimately plan on going with a FP+ only system, I would certainly reconsider going to WDW in the future based on just that alone. The privacy concerns would only be a cherry on top of the issues I have with MM+.

December 5, 2013 at 1:11 AM · Personally, privacy is a minor concern because you are in a highly public place anyway -- a theme park full of people. My concerns with MagicBand are that Disney sunk over a billion into this (instead of into rides and park infrastructure) and it still works badly. Plus, I loathe being limited to just three fast passes -- how can you park hop with this crappy new system??
December 5, 2013 at 3:42 AM · Disney appear to be way too silent about security and data use for my liking.
In fact, MyMagic+ seems a little too 'secretive' right now.

The 'beta' phase need not mean 'secretive' phase. Yet guests are pretty much in the dark as to where Disney are headed with the technology.
Perhaps if Disney were a little more open, guests may have a little more confidence in the system.

At the moment a bank card needs a PIN. Most of us are very very certain that our PIN details are extremely safe thanks to trusted bank systems.
Disney have yet to prove themselves as keepers of critical data.
To my knowledge, this is relatively new territory for them and us as park guests.

So, to answer your question, no, I am not yet convinced about the security of MyMagic+ based upon the simple concern that the system is under development and that means that there's a higher risk than normal of data going missing or being copied by contractors. That of course can include PIN data.

December 5, 2013 at 6:15 AM · I may be an idiot but I am still very perplexed by the thought that Magic bands are going to increase spending? Personally I am not going to buy any more or any less food, drinks or souvenirs because I am wearing a stupid RFID chip on a rubber bracelet. Some of the personalizations they have planned for the bands sound cool but overall the system is a money pit. As expensive as Disney and Universal are getting to visit, our vacations are going to become an "either or" thing as compared to an "and" thing of the past. How are we going to decide which one to visit? I can assure you that its not because one has an RFID wristband system. Its going to be which has the newest and best attractions. So while Disney spends millions and millions of dollars on a system that guests didn't ask for Universal is spending money on new bigger, better lands and attractions that people will love. Don't get me wrong. I love Disney, but if the money they have to spend to get this system corrected is taking away from their future attraction plans they are making a mistake of epic proportions.
December 5, 2013 at 7:04 AM · If tracking me ultimately helps a company improve the product, and therefore, my experience...I say track away! I mean worrying about that is so 70's govt conspiracy whackiness. Then, like you said Robert, don't use a credit card...pitch a tent in the woods or sleep in your car...at some point you're "giving yourself away".

I agree with comments that this money could have been spent elsewhere...adding another gate to spread out the guests.

But my gut feeling is the reason Disney is sinking so much money into MB is to also market it as a product. They're already selling accessories for it and t-shirts celebrating it as if it were a new gaming system.

December 5, 2013 at 8:58 AM · I'm a huge privacy advocate. I barely use Facebook and I refuse to use twitter. As much as I value my privacy, I really feel like the privacy concerns over MagicBand are ridiculous. Disney World must be one of the most family friendly places in the world, so what kind of privacy concerns in that environment are that important? It's not like you're being tracked through Las Vegas or something. Honestly, I wouldn't mind if Disney did more tracking and data mining on me if it meant that my vacation was more affordable. It would be interesting if Google ever got into the theme park business, completely free but they play you a targeted add while you're on the roller coaster. The only thing I hope is that they keep billing information separate from the rest of the MagicBand system. I definitely don't want personal and billing information stored on the band itself. I'll give them the benefit of the doubt there (for now), because it's in their best interest as well as ours to keep guests' information safe.

And to the guy that said "trusted bank systems", that was a joke right?

December 5, 2013 at 9:16 AM · Anyone worried that Disney's Security is somehow better or worse than any other large company is wasting their time. Sony, Adobe, etc, etc have all been hacked. IF ther eis a way in someone will find it. Governments around the world are being hacked. The only way to have any privacy is to live in a cabin in the woods and hope no one knows you are there. Disney being able to secure your info is as effective as everyone else.

The Bands themselves were great to use, but arent a huge upgrade over the KTTW cards. A nice to have though. The hysteria over these things is getting to be laughable. However The reasons for it and the cost are staggering and a bit offensive. When company execs come out and say they are wilfully trying to get every penny out of you it's a bit of a kick in the pants to put it nicely. But how many of us were ever in doubt about this? Why else do they charge $5 for a ten cent pen? And why do we buy them? Because we love the characters and the Parks and the memories that are created.

I recently returned from a trip and loved it. Even my wife noticed things working that weren't previously. I have no complaints about the value for money because there has never been such a thing at WDW. If you want value for money go for a week all inclusive in Cuba where a family of 4 can stay and play and eat for $2500. IF you want what Disney sells, it's going to cost you. Just like the $179.99 I paid for a piece of luggage in the gift shop which I could have gotten at Walmart for $79.99. But hey it has a mouse and WDW written on it.

December 5, 2013 at 10:38 AM · I do not think Privacy matters so much to folks…

Since they put everything on Facebook and Twitter every time the Fart… Eat, Drink, nap, watch a movie, Post pictures of their breakfast, What kind of Sandals they are wearing…. I can go on…..

December 5, 2013 at 11:10 AM · @Trevor, from what I understand there isn't any information stored on the Magic Band itself other than a code specific to you...so the scanners read the code on your band, then pull up info from your account and give a yes or no back to the scanner. Not saying Disney's servers can't be hacked, but simply grabbing the code off the band won't help unless they also have access to the databases.
December 5, 2013 at 12:40 PM · @Kevin:

Disney has been allowing guests to charge to their room key (Keys to the World), which directly charges guest credit cards, for years now, so I think they have a little bit of experience keeping private data secure. That doesn't mean that they can't be hacked, but it's probably as secure as any online retailer or hotel chain that maintains credit card information for deposits/accounts. I think it might be a good idea for them to protect guests through the use of a PIN (similar to credit cards in Europe) so that potential criminals could not walk through the parks skimming and mimicing guests' MyMagic+ RFID chips and running up park charges. However, once you get off-site those RFID data are useless.

@Jeff:

The idea is that with the MagicBands, guests are likely to spend more because of more personallized experiences. Imagine how much more a kid will beg for a photo or video of a character meet and greet if that character says their name or knows they were just on a ride and asks what they thought of it. It is also theorized that because of the bands, guests will spend more becuase it will be far easier to pay for things (you won't even need to take your wallet out of your pocket or purse).

For those that are fearful of the tracking technology, you should just go off the grid and live in a cabin in northern Saskatchawan, because if you have a cell phone, internet access, e-mail, facebook, credit card, anything, you are being tracked. In fact, it was just reported the other day that the NSA collects over 5 BILLION pieces of data from cell phones every single day. Anyone with a smartphone that downloads apps, you're typically giving the creator of that app the authority to track your location and/or use. You're essentially giving Disney the same authority through the MyMagic+ system. Personally, I think anything that they want to do that can potentially make my experience better, easier, and more personalized, I'm all for that.

December 5, 2013 at 2:20 PM · I'm all about privacy ... But, a company keeping track of you while you're on private property doesn't really constitute an invasion of privacy. Everyone already pretty much knows what you're doing at Disney. It's not like they know what books you're checking out of the library.

Safety concerns at the parks far outweigh privacy issues, as far as I'm concerned. Finding a lost kid by checking their magic Band location would be priceless. Restaurants automatically knowing my girlfriend has a shellfish allergy would be awesome.

This is very, very different from companies or the government snooping and sharing your web browsing activity.

December 5, 2013 at 7:27 PM · Magic bands are all about incremental revenue and improved service as a differentiator in the market. Universal has matched Disney in many of their historical advantages and they believe this will be the new separation. At $1.5B, that probably is as little as $75 additional revenue per unique visitor over 5 years. Not a huge goal. Just mining the data for highly targeted marketing will make that back. That's before they sell any data to the data aggregators.

The concern is whether they can protect my information. Many businesses have proven they can't. I have heard unverified stories from cast members of some huge mistakes. Don't know if real, but if they are, just proves they are no different than other businesses. What is different is the extreme amount of detail the DSA :-) is collecting. Yes, it probably is pretty innocent now but what will they do with it in a few years. If the NSA, with all of their motivation and resources can't protect their data, can the DSA?

In the end, it is my job to control my data. I choose to share it with Disney now. If they keep being greedy, I have other options and also ways to limit what they collect without bunkering up.

December 6, 2013 at 3:12 PM · I will say it again: How is the Magic Band any different than the Key to the World Card? Disney is not getting any new info about the guests that they already know.

The advantage of going to the magic bands is that now Disney can expect people to make plans and reservations. While this might be an issue unto itself, at least it allows Disney to plan accordingly for the rush.

December 7, 2013 at 2:32 PM · I fully expect Disney to use the bands to track customers movements, etc. However, we have used the bands twice now(September and October, 2013)and despise the new advanced reservation fast passes. We found the limitation of but two per day in only one park very frustrating and the long wait times in line at rides without a fast pass to be irritating and we walked away more times than we could remember. To watch, waiting in line for an hour while hordes of fast passers rush by tends to make us wary of wanting to visit WDW anytime soon. We have been going for a week at a time twice per year for the past ten years, but this year's frustrations have about tested us to the limit. Disney is changing the whole tenor of the Walt Disney experience into something it was not. And, not for the better.
December 9, 2013 at 6:48 AM · We have a Disney Visa, Disney Premium Annual Passes, and a Tables in Wonderland membership. There's not much more the Mouse can find out about me, but I'm fine with it.

Privacy as we knew it has been gone for a long time and there is virtually no way to live "off the grid" now and seriously, 99% of the people out there have nothing to worry about and the other 1% are using an alias and not going to the Magic Kingdom...

This article has been archived and is no longer accepting comments.

Park tickets

Weekly newsletter

New attraction reviews

News archive