Disney World’s RFID Tracking Bracelets Are A Slippery Slope, Warns Privacy Advocate

On Monday, the Walt Disney Company (NYSE:DIS) announced an ambitious plan to transform the visitor experience at its Disney World Resort near Orlando, Fla. The MyMagic+ program, which will roll out this spring, combines an interactive website and mobile app with an all-purpose electronic bracelet that acts as a guest’s room key, theme-park ticket and payment account all rolled into one. The bracelets, dubbed MagicBands, will also track which rides visitors use, which characters they interact with, where they go and what they buy within the park.

The bracelets monitor behavior with radio-frequency identification technology, or RFID, a wireless tracking system that transfers data from tiny tags attached to objects. RFID has long been used to track product inventory in various industries, but it has become increasingly invasive over the last decade, with tags being implanted in I.D. badges, transit cards and even passports.    

In a blog post, Tom Staggs, chairman of Disney Parks and Resorts, stated that Disney World’s RFID bracelets will be optional for theme park visitors, but some privacy advocates say Disney’s use of the technology in a wearable bracelet is still troubling, particularly as it is being used on children and touted as fun.

Katherine Albrecht, a longtime consumer privacy advocate and co-author of the 2005 book “Spychips,” said MyMagic+ seems more appropriate for lab rats than Mouseketeers. She expressed deep concerns for the broader implications of the world’s largest "family entertainment" company normalizing RFID technology in the eyes of young people, and she worried that MyMagic+ was only the first step toward a surveillance society that will ultimately invade every aspect of our  lives.

“They’re basically conditioning young children to wear tracking devices,” Albrecht said. “Well, one day these kids will be lawyers and doctors, and they’ll grow up thinking it’s completely normal to have their whereabouts tracked and their behavior monitored.”

A spokesperson for Disney World did not return a request for comment regarding privacy concerns. However, the company said in its announcement that MyMagic+ is meant simply to enhance the visitor experience in a whole host of ways, including allowing guests to bypass long lines by signing up for rides before they leave their hotels. Currently, visitors can get Fastpasses at each ride and return at a given time.  

“Like most people who visit Walt Disney World Resort, my family and I have our ‘must-do’ attractions, and, as the father of three boys, those attractions often end with the word ‘mountain,’” Staggs wrote in his blog post. “Now, rather than dashing as a group, or even splitting up to gather FastPasses, imagine booking guaranteed ride times for your favorite shows and attractions even before setting foot in the park.”

The program will also transform Disney World into a more personalized, interactive experience, the company says. For instance, employees playing Disney characters will be able to greet children by name, using sensors that read information from their bracelets. The same holds true for the robotic characters, meaning a talking parrot or pirate could address your child by name. Although parents will have to opt in to such services to use them, Albrecht believes that air of complicity is simply one of the insidious methods companies use to convince us to give up an increasing amount of our privacy.

“Most of us have a line we think we’ll never cross,” she said. “We don’t want people tracking us in our homes or in the bathroom, right? But if you go after kids, and you make it fun, you can introduce a technology that most of us would object to in our everyday lives. And people will thank you for the privilege.”

For Disney, as with all large companies, the bottom-line implications of collecting data on its customers’ habits are enormous. Disney’s parks and resorts unit, which makes up an estimated 13.5 percent of its total stock price, has been booming over the last year, thanks in part to a major revamp of Disney’s California Adventure, which includes the new Cars Land ride. If nothing else, the MyMagic+ program, which comes with estimated costs of $800 million to $1 billion, is a smart way for Disney to make sure it is further cashing in on the 30 million people who visit Disney World each year.

Albrecht, who said she has been following Disney’s history with RFID, is not convinced that a deeper and perhaps more insidious motive is not behind the MyMagic+ program. “Disney is very invested in this technology,” she said, adding that she has pored over thousands of public documents regarding RFID, including Disney’s applications to the FCC. “You don’t spend a billion dollars just for ROI [return on investment] on your theme parks.”   

Albrecht has been warning about the dangers of invasive technology since the late 1990s, when she founded the consumer group Caspian, which warned about the then-novel use of supermarket loyalty cards. She notes that, in that time, the very idea of what we consider private has been radically altered. Today, most of us don’t think twice about handing over our private information social networks, but Albrecht said that privacy is still an ideal worth protecting, even if that means forfeiting your child’s ability to have a personal conversation with Goofy.  

“Privacy is not a means to an end,” she said. “It’s your ability to call your own shots. If we’re not careful, it’s going to start with Disney, and soon you won’t be able to get into the mall or start your car without your RFID wristband. And at that point, that wristband becomes a very valuable commodity.”