By Sally Vazquez-Castellanos, Esq. | Perspectives: Innovation, Technology and the Law.
Published on June 9, 2025. Revised on June 9, 2025 at approximately 7:00 p.m. Revised on August 13, 2025 at 9:00 P.M. Revised on August 14, 2025 at 4:56 a.m. Revised 8:04 a.m.
Imagine stepping into a privacy or compliance role at a theme park, where roller coasters embody extraordinary achievements in modern engineering, design, creativity, and innovation.
While some rides are designed for the thrill, others evoke a sense of wonder and excitement like Peter Pan’s stunning flights of fancy in a place called Neverland.
I am not an employee of Disneyland, DisneyWorld, or Universal Studios Hollywood, but my father worked for the Walt Disney Company for more than forty years. So in many ways, I grew up appreciating Disney and the beauty, wonder and imagination these parks have come to represent.
I am also a student of global privacy and data protection laws and regulations, and the promise of the Metaverse.
Perspectives offers some of my thoughts and insight with a focus on legal issues surrounding technology and innovation. This includes examining the challenges that come with innovation like preserving civil liberties and human rights laws while maintaining national security. We are living through challenging times.
REGULATORY AND THEME PARK COMPLIANCE: A COLLABORATIVE WITH CHATGPT
With the help of generative artificial intelligence and ChatGPT—and a willingness to learn—I explored how legal and privacy teams, information technology specialists, engineers, designers, artists, and other professionals work to safeguard guests in these magical spaces.
In doing so, I was not only testing the research capabilities of ChatGPT, but delving into a topic I might otherwise never have had time to pursue. If something seems amiss, kindly drop me a note (one that avoids leaving litter along the freeway).
PRIVACY AND COMPLIANCE
Privacy and compliance are two distinct functions. Each individual function is intended to meet specific international, federal, state and industry guidelines. These laws, regulations, and guidelines are intended to protect guest safety, privacy, and consumer/guest data.
Organizations also tend to differ markedly from each other partly based on their own unique brand of magic, but also through their individual (and not so individual) approach towards park operations and safety. After all, this includes wading through a multitude of regulatory obligations. Something we all should want (within reason), and in many respects — something that we all need (within reason). What is reasonable, is a part of the national dilemma.
As I delved deeper into the guidelines in this chat, I explored the dynamics that underpin theme park safety and design. These principles are characterized by an unforgiving world, with increased threats that a visionary like Walt Disney could never have conceived.
CYCLONE
According to New York City’s Parks & Recreation website, the Coney Island Cyclone, launched in 1927, designed by Vernon Keenan and built by Harry C. Baker, roared at 60 mph.
The designer of the Cyclone, much like Mr. Disney, could not have foreseen the horrific events that would unfold years later in New York City. 9/11 remains a poignant reminder of the state of the world today, a tragic reminder that we cannot ignore the challenges we face.
Coney Island’s most famous attraction is known for thrilling generations, all without collecting digital data from an individual rider.
The Cyclone’s enduring legacy contrasts with today’s use of Radio Frequency (RF) Identity Bands, and the use of biometrics in roller coaster design. All intended to inure to the benefit of passenger safety, and to contribute to imagination in theme park design and innovation.
Something a bit like the stuff dreams are made of only with a whole lot of technological ingenuity that is intended to provide for the safety of park guests.
PROTECTING CRITICAL INFRASTRUCTURE
Both President Joe Biden and President Donald Trump have made protecting U.S. critical infrastructure a priority. President Biden issued executive orders to strengthen cybersecurity by improving software security, holding vendors accountable, and securing federal systems. President Trump has continued some of these measures while shifting focus toward emerging risks like artificial intelligence.
At the industry level, similar principles apply in theme parks, where securing ride control systems, protecting guest data, and ensuring operational reliability are central to maintaining safety, compliance, and visitor confidence.
This focus on resilience directly informs how roller coasters are designed and operated to meet the highest safety standards.
THE U.S. DATA PRIVACY FRAMEWORK
The EU–U.S. Privacy Shield, launched in 2016, was designed to let companies in the United States and European Union legally transfer personal data across the Atlantic while meeting EU privacy standards. It replaced the earlier Safe Harbor agreement, which the Court of Justice of the European Union (CJEU) struck down in 2015 in the Schrems I case. Under Privacy Shield, U.S. companies could self-certify to the Department of Commerce that they complied with a set of privacy principles aligned with EU law.
While intended to reassure European regulators, the framework drew criticism because U.S. surveillance laws still allowed broad government access to personal data. In July 2020, Austrian privacy advocate Max Schrems challenged the system in what became the Schrems II case. The CJEU ruled that Privacy Shield failed to provide adequate protection or legal remedies for EU citizens, invalidating the framework.
In response, the U.S. Department of Commerce and the European Commission created the EU–U.S. Data Privacy Framework (DPF), formally recognized on July 10, 2023, as a lawful basis for transatlantic data transfers.
Under the DPF, U.S. companies self-certify compliance with privacy principles aligned to the EU’s General Data Protection Regulation (GDPR), providing an alternative to other transfer schemes such as Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs).
While the DPF facilitates inbound EU-to-U.S. data flows, Executive Order 14117, implemented through the Department of Justice’s Data Security Program beginning April 8, 2025, focuses on outbound data. It restricts transfers of U.S. bulk sensitive information—such as biometric, health, financial, and geolocation data—to foreign adversaries.
Together, these measures form a dual-track approach: enabling trusted, compliant data imports while restricting high-risk exports—a principle that parallels the balance between openness and stringent safeguards required in theme park operations and roller coaster safety.
SOCIAL MEDIA APPLICATIONS (TikTok)
In April 2024, Congress enacted the Protecting Americans from Foreign Adversary Controlled Applications Act (PAFACA), empowering regulators to ban or require divestiture of apps—such as TikTok—operated by entities deemed controlled by foreign adversaries.
The law set a January 19, 2025 deadline for compliance, with the U.S. Supreme Court unanimously affirming its constitutionality, citing overriding national security risks.
Subsequent executive orders have delayed enforcement, drawing bipartisan criticism for undermining established law. This legal tug-of-war over digital infrastructure underscores the broader principle that robust, enforceable safeguards—whether for cyber systems or physical ride control networks—are vital to maintaining public safety and confidence.
Much of what goes into protecting critical infrastructure and the nation’s communications networks and systems is mind boggling. So are all of the EO’s combined with the myriad of sectoral regulations. That doesn’t even get us to all of the international laws, rules, regulations and treaties.
Unfortunately, many of us forget that leadership at these parks is akin to managing a city, with its own infrastructure and security concerns to be taken into account.
THE EXECUTIVE ORDERS
The Executive Orders described here are not exhaustive and you should take the time (if you can find the time) to review some of the many Executive Orders from both administrations.
President Biden’s Executive Order 14034
President Biden’s Executive Order 14034, “Protecting Americans’ Sensitive Data from Foreign Adversaries,” which was issued on June 9, 2021, builds on concerns raised during the Trump Administration, especially as related to connected software applications.
President Biden’s Executive Order specifically addresses the sensitive personal data of Americans, particularly with respect to data brokers, apps, and digital platforms.
President Biden’s Executive Order revoked several Presidential Directives that deal with controversies surrounding the use of apps like TikTok and WeChat in the United States.
Executive Order 14114 and the Department of Justice (DOJ)
These actions broaden guidelines for the protection of bulk sensitive data for the collection of biometric data.
This EO amends EO 14024 to strengthen sanctions against Russia. It authorizes the U.S. Treasury to impose sanctions on foreign financial institutions involved in transactions related to Russia.
In the aftermath of the Schrems II decision, the U.S. Department of Commerce introduced the EU–U.S. Data Privacy Framework (DPF)—formally recognized for cross-border transfers on July 10, 2023—to provide a streamlined, compliant mechanism for inbound transfers of EU personal data, reducing reliance on burdensome Standard Contractual Clauses.
Conversely, Executive Order 14117, implemented via the Department of Justice’s Data Security Program beginning April 8, 2025, restricts the export of U.S. bulk sensitive data—like biometric, health, financial, and geolocation information—to foreign adversaries. It specifically mentions countries of concern.
Together, the EO’s and the EU-US Data Privacy Framework (DPF) reflects a layered regulatory architecture: open yet safeguarded digital flows in, paired with restrained, controlled data flows out—principles central to maintaining trust in both cybersecurity systems and the physical engineering underlying roller coaster safety and theme park compliance.
WHAT DOES ANY OF THIS HAVE TO DO WITH THEME PARKS?
Everything. The roller coaster is but a metaphor, but an extremely powerful one to consider. Especially when you must think about consumer and guest safety post 9/11. The Executive Orders provide important protections for a nation dealing with cyber threats to critical infrastructure and communications.
This includes protecting the sensitive personal data of U.S. persons, including health, financial, and biometric data, from being accessed or exploited by foreign adversaries.
Since theme parks and concert venues are already collecting biometrics, perhaps we all need to pay closer attention to these issues.
PRESIDENT TRUMP’S EO 13873
President Trumps Executive Order 13873, “Securing the Information and Communications Technology and Services Supply Chain,” specifically declares a “national emergency”due to what is described in the Order as risks posed by foreign adversaries exploiting vulnerabilities in information and communications technology and services utilized in U.S. infrastructure.
That should spark concern across the nation, and most Americans should want to know more because we all have to contribute towards protecting the nation.
This is essential among many professions and companies across the nation, and particularly important for those organizations that must operate globally.
AN UNACCEPTABLE RISK TO NATIONAL SECURITY
According to the EO, the Secretary of Commerce (in consultation with other federal agencies) is under certain conditions, empowered to prohibit certain U.S. “transactions” that may pose an undue risk of sabotage or subversion, or unacceptable risk to national security, critical infrastructure, or the digital economy.
The EO goes on further to describe forbidden activities that include the acquisition, importation, transfer, installation, dealing in, or use of such technology once the Secretary of Commerce makes a formal determination.
EXECUTIVE ORDER APPLICATION TO THEME PARKS & ROLLER COASTERS
President Trump’s Executive Order 13873, “Securing the Information and Communications Technology and Services Supply Chain,” issued on May 15, 2019.
The purpose of President Trumps’s Executive Order was to declare a national emergency that would address risks posed by foreign adversaries exploring vulnerabilities in our nation’s information and communications technology infrastructure.
Theme parks today operate as complex digital ecosystems — combining connected infrastructure, biometric data collection, AI-powered surveillance, and Internet of Things (IoT) technologies.
Here’s how EO 13873 becomes relevant:
1. Biometric Systems and Surveillance Networks
Parks like Universal Studios use facial recognition, fingerprint scans, and gait analysis for: Ticketing and fast-lane access; Fraud prevention; Guest tracking and behavioral profiling.
If these systems are sourced from foreign companies under adversarial control, they could be prohibited under EO 13873.
2. Connected Rides and Infrastructure
Modern roller coasters and attractions often include: AI-integrated safety systems; Remote diagnostics; Real-time ride telemetry; Smart queue and crowd flow tracking.
EO 13873 allows the U.S. government to block or review the installation of foreign ICTS components — such as software or sensors — if those systems create vulnerabilities (e.g., sabotage or data exfiltration).
3. Theme Park Mobile Apps and Guest Data
Many parks deploy apps that: Track location and movement; Collect biometric inputs (e.g., health status, face ID); Allow payment and reservations via phone.
EO 13873 may apply if any backend technology or app service providers were foreign-controlled (TikTok) and handling sensitive user data — especially children’s data, raising further COPPA and CCPA/CPRA.
4. Cross-Border Data Transfers
If Universal or other parks transfer ride telemetry, biometric data, or video footage to servers abroad — and those servers are controlled by foreign adversaries — EO 13873 empowers Commerce to prohibit those transfers.
WHY CARE?
As theme parks evolve into high-tech entertainment hubs powered by facial recognition, mobile apps, and real-time ride analytics, they also inherit serious responsibilities when it comes to data security and national risk.
Executive Order 13873, a sweeping federal directive aimed at protecting the United States from threats in the information and communications technology supply chain, is now more relevant than ever.
Whether it’s biometric turnstiles at the park entrance, IoT-enabled roller coasters, or mobile apps tracking guests throughout the day, these technologies can pose a national security concern — especially if they’re built with software or hardware from foreign-controlled companies. If those vendors are deemed a risk by U.S. authorities, parks may be required to remove or replace those systems altogether.
This isn’t just a government issue. It’s a public trust issue. Parents expect their children’s data to be protected. Guests assume that when they tap into a park’s app or scan their face to enter a ride, their privacy isn’t being quietly compromised.
EO 13873 signals a major shift: theme parks, just like defense contractors and telecom firms, are now being asked to take a hard look at who builds the systems they rely on.
As federal enforcement ramps up in 2025, theme parks and their partners will need to stay ahead — auditing their tech vendors, understanding where their data flows, and updating privacy practices in line with evolving U.S. law.
The message is clear: when thrill rides meet real-time data, safety and national security must ride side by side.
CHAT RESOURCES
Federal Register – Executive Order 13873 (May 15, 2019). Full presidential text and legal language from the May 17, 2019, Federal Register.
Continuation of National Emergency (May 14, 2025) Confirms that the national emergency under EO 13873 remains in effect past May 15, 2025.
Rulemaking & Regulatory Implementation
Federal Register – Final Rule (Dec 6, 2024; Effective Feb 4, 2025) Details the completed final regulations implementing EO 13873.
Federal Register – Interim Final Rule (Jan 19, 2021) Initial procedures for Commerce to review relevant ICTS transactions.
Regulatory Analysis & Announcements
Morgan Lewis LawFlash (Dec 2024) Comprehensive legal analysis of the final rule’s business implications.
Future Extensions & Sector-Specific Rules
Federal Register – Connected Vehicles Rule (Jan 16, 2025; Effective Mar 17, 2025) New rule extending EO 13873 to vehicle connectivity systems.
Federal Register – UAS Rulemaking (Jan 3, 2025) Advance Notice for including drones/UAS under the ICTS framework.
Industry & Legal Commentary
Reuters – “The ‘ICTS’ rules: Technology supply chain regulation has arrived” (Oct 30, 2024) A top legal-industry summary covering major developments, including IaaS proposals and the Kaspersky ban.
© 2025 Sally Vazquez-Castellanos. All rights reserved.
Disclaimer
This blog post is for informational purposes only and does not constitute legal advice. Reading this article does not create an attorney-client relationship. For advice about your specific legal matter, please consult a qualified attorney.
This website and all original content herein, including blog articles, legal commentary, and educational resources, are the intellectual property of Sally Vazquez-Castellanos and are protected under U.S. and international copyright laws. Unauthorized reproduction or distribution of any material without prior written consent is strictly prohibited.
Select content on this site was developed or refined using generative AI tools, including OpenAI’s ChatGPT, for research assistance, drafting support, and content enhancement. All AI-assisted content has been reviewed, edited, and curated by Sally Vazquez-Castellanos to ensure accuracy, originality, and alignment with the site’s professional standards.
Use of this site does not grant any license or right to reproduce or reuse any materials for commercial purposes.
For permissions or inquiries, please contact me at the following address:
Sally Vazquez-Castellanos, Esq, located at Industrious Pasarroyo, 251 S Lake Avenue, Suite 800, Pasadena, California 91101.
Main Office location: Castellanos & Associates, APLC, 800 S. Figueroa Boulevard, Suite 1060, Los Angeles, California 90017. Telephone: (323) 655-2105.
Additional Source and Illustration Provided by ChatGPT.
