Disney MagicBands
by Stephen P. Cummings, MSW, ACSW, LISW
As I write this, I’m flying back from the 64th Annual Program Meeting of the Council on Social Work Education in Orlando. I’m grateful for the opportunity to attend APM every year. I learn a lot from the presentations I attend, and I continue to network and build relationships each time. This year, I experienced firsthand the methods used by Walt Disney World, where the conference was located. With family in tow, we spent four days at the parks after the APM closed.
Overall, my son was pleased and confirmed with me that he’d had many “magical moments.” From a social work perspective, walking around the Walt Disney parks offered a unique opportunity to look at how guests are processed and treated. It’s a huge place with thousands of people visiting at any given time. Increasingly, the Disney company uses technology in ways that relieve the “friction” that comes with standing shoulder-to-shoulder with so many people. As a social worker, I was left with a feeling of unease about how the technology used to improve the experience of its guests could be applied in other ways, and how often guests aren’t aware their personal data is being collected.
A popular attraction at Walt Disney World is a restaurant called “Be Our Guest,” a dining space in a large, cavernous room that resembles the ballroom from Disney’s Beauty and the Beast. A cast member asks me what I’d like to order. I reply and hold my wrist out, brandishing my MagicBand, holding it up to the receiver by the register. I’m directed to sit anywhere in the enormous dining room.
The MagicBand is a simple, brightly-colored wristband, provided to park guests. I had assumed the MagicBand was a device that acted like a credit card, allowing me into the park gates and events.
At the restaurant, we ordered our food and waited. No cast member escorted us, so how would our food get served? I hailed a cast member strolling by. “It’s just magic,” he said with a wink. Sure enough, within a few minutes, the food arrived. According to Disney, the band operates with radio frequency transmitters that send information to Disney staff members. An antenna in the band is used to communicate short distances. On the Walt Disney FAQ page (see https://disneyworld.disney.go.com/faq/my-disney-experience/frequency-technology/), “MagicBands can also be read by long-range readers located at Walt Disney World Resort used to deliver personalized experiences, as well as provide information that helps us improve the overall experience in our parks.”
This technology was only recently deployed at the Disney parks, but it’s already ubiquitous. Cliff Kuang, writing for Wired in March 2015 (see https://www.wired.com/2015/03/disney-magicband/), describes how these wristbands are meant to be used from the moment a person reaches Orlando, where the bands allow access to travel to the park, engage in just about every transaction on Disney property, and ultimately on return to the airport. “This is just what the experience looks like to you, the visitor. For Disney, the MagicBands, the thousands of sensors they talk with, and the 100 systems linked together to create MyMagicPlus turn the park into a giant computer...it’s designed to anticipate your desires.”
From the perspective of a parent already weary after day one, that “frictionless” approach to managing my experience becomes more welcome. I could opt out of using this technology, but this would require knowledge of the technology and its implications before arriving. As Adam Clark Estes, writing in Gizmodo in March 2017 (https://gizmodo.com/how-i-let-disney-track-my-every-move-1792875386) after a trip to Walt Disney World, notes: “You agreed to this deal. Nevertheless, you probably didn’t comprehend every detail buried in the fine print.”
Biometrics and Social Work Ethics
Walt Disney has a privacy policy (at https://privacy.thewaltdisneycompany.com/en/current-privacy-policy/) that assures customers that every effort is taken to maintain integrity and avoid unauthorized access. It isn’t clear whether wearables like the MagicBand are included in this policy, but the policy does reference “location information...including the use of beacon technologies.” It’s notable that the power of the wearable technology in the parks seems to constitute a portal for a vast sum of information, and to that end should warrant at least a more specific mention about wearable tech like the MagicBand, which most everyone visiting the park will be using.
Using the MagicBand also requires park attendees to provide a fingerprint scan. My son’s finger was scanned on his first day at the park. This is a form of biometric data collection. According to the International Biometric Society, the terms “biometrics” and “biometry” have been “used since early in the 20th century to refer to the field of development of statistical and mathematical methods applicable to data analysis problems in the biological sciences.” (See https://www.biometricsociety.org/about/definition-of-biometrics/) The Society notes that this includes the new technology of identifying individuals using biological traits, “including retinal or iris scanning, fingerprints, or face recognition.”
Biometric technology in commercial use has already been recognized as problematic. For instance, Illinois has a biometric privacy law in its code, called the Illinois Biometric Information Privacy Act. This law is designed to govern the collection and use of biometric data, including requiring that businesses provide notice to and permission from individuals to collect and store biometric data. In a case now before the Illinois Supreme Court, a mother is suing Six Flags Entertainment Corporation after the amusement park required a fingerprint scan from her 14-year-old son. The description of this data collection is essentially the same as how Disney collects data. (See https://news.bloomberglaw.com/privacy-and-data-security/six-flags-scan-of-boys-thumbprint-tests-biometric-privacy-law)
Why should social workers care? After all, the whole intent of this kind of data collection at Disney World is to reduce any friction a park attendee may experience. The collection, storage, and application of biometric data does not seem harmful. Speaking as someone who spent several days at Disney World, stress is inevitable. Bumping into people throughout each day, waiting in long lines, and spending more money than intended can be tempered by the ease provided by the use of biometric information to handle seemingly little things like gate ticketing and photo storage. After all, it’s a theme park, the entrance to and the experience of which is a complete choice.
However, it’s this acclimation and enculturation of biometrically-collected data that’s at issue. It’s not readily apparent how this data is being used, or how my data could be used once I leave the park. It’s possible Disney captures this information for use within its own official apps, particularly those that sell products. This is comparable to how social media companies like Facebook collect data on users. Facebook has been historically secretive about the ways personal data is used. The American Civil Liberties Union (https://www.aclu.org/blog/national-security/facebook-application-privacy-breach-exposed?redirect=blog/technology-and-liberty/facebook-application-privacy-breach-exposed) has been monitoring how personal information on Facebook is sold to third parties, regardless of your privacy settings.
Also, it’s possible that the design of biometric data collection, as a means to collect information on individuals, could be replicated in other industries. Could the MagicBand be used in a tertiary health care setting, or a rehabilitation center? It seems likely.
All of this is to say that, ethically, social workers should be aware of, and critical of, how new technologies evolve and change. The NASW Code of Ethics (available at https://www.socialworkers.org/About/Ethics/Code-of-Ethics/Code-of-Ethics-English) asserts that “we should facilitate informed participation by the public in shaping social policies and institutions.” This is a brief but still relevant passage from the Code. I note this especially as the 2018 CSWE APM enters history, scheduled to return to the Walt Disney campus in a few years. If, as social workers, we are concerned that holding a conference in Las Vegas may be seen as an endorsement of vice, it’s fair to be thoughtful of how personal data is collected and used in Orlando, and the “Happiest Place on Earth.”
As social workers, we are expected to take reasonable steps to ensure that information is encrypted. These are values we should hope to see in practice elsewhere. As noted earlier, it’s not entirely evident that Disney World park guests are aware of their options, or how their data is used, even after reading the privacy statement. The nature of how Disney engages in data collection requires one to opt out, which requires an awareness of what’s at stake when entering a Disney park. These options do not appear to be readily evident to guests, which fails to reach the standard of informed decision-making.
As attendees of the Annual Program Meeting of the Council on Social Work Education, it’s fair to expect that we understand how operations like Walt Disney World work, including the use of our electronically-collected data. While you are entering the Disney world and the magic it purports to provide, you have rights to privacy and should be informed on how to access them.
Stephen P. Cummings, MSW, ACSW, LISW, is a clinical assistant professor at the University of Iowa School of Social Work, where he is the administrator for distance education.