A Salesforce rules engine that made privacy review a required pre-launch step for 700+ Disney apps and digital products.

The Role

Sole technologist, business analyst, and Salesforce administrator · The Walt Disney Company, Corporate Legal (Privacy Compliance) · 2012–2019

The Challenge

In May 2011, Disney's newly acquired subsidiary Playdom and its CEO agreed to a $3 million civil penalty and a consent decree to settle FTC charges that its online games collected children's personal information without parental consent, in violation of the Children's Online Privacy Protection Act (COPPA). Disney needed a way to show that every app and website it released met children's privacy rules. I joined Corporate Legal's Privacy Compliance team in 2012 to build it, using Salesforce and FormAssembly to create a privacy compliance tool used across the enterprise.

Disney's mobile apps and websites could launch in international app stores with a single click, but every region set its own rules for child safety, data collection, advertising, and in-app purchases.

Products came from internal studios, co-developers, and licensees across Disney, Marvel, Lucasfilm, ABC Digital, and ESPN. Corporate Legal had no central, real-time view of what each product collected, which third-party SDKs it included, or whether its marketing practices met company policy and the law. Compliance often turned up late, as a last-minute obstacle to release.

My approach

I built the Rules Engine and Accountability Database (R.E.A.D.) as the team's embedded technologist.

• A mandatory intake gateway. I connected FormAssembly intake forms to Salesforce so every public-facing app and website went through privacy review during pre-production. Most questions were yes/no or picklists, which kept the form quick for producers to complete.

• Audience classification. I designed a data model that scored each product on 14+ factors, including characters, visual style, target age groups, audio, subject matter, and gameplay complexity, and placed it in one of three regulatory audience categories: Kids, All Ages, or Adults.

• A multi-area rules engine. Review workflows covered 11 areas: audience categorization, third-party SDKs, age gates, single sign-on and registration, in-app purchase disclosures, first- and third-party ads, parent corners, push notifications, regional legal guidance, social media, and user-generated content contests.

• A vendor compliance library. A central component database tracked each third-party SDK's approval status at three tiers (Pre-K, Family Friendly, General Audience), so reviewers could check any SDK against a product's classification.

• Technical verification. I worked with Disney Interactive QA to add network-traffic scans before launch, which confirmed that the endpoints a live app actually called matched the approved vendors.