Comcast Corporation (Nasdaq: CMCSA), the largest US cable ISP, provides broadband, TV, mobile, and voice services under the Xfinity brand. Its privacy policy (effective April 23, 2026) describes collection of household video viewing activity, voice-remote recordings, geolocation, DNS searches, and network traffic activity, permits disclosure to advertising partners, and allows aggregated or deidentified data to be used, licensed, or sold for any purpose. Comcast Advertising builds ad products on first-party viewership data layered with third-party demographic and psychographic insights. Comcast states it does not track broadband browsing to build profiles, says it does not sell directly identifying information, offers CPNI opt-outs, and publishes semiannual transparency reports. Its record includes a 2023 breach affecting 35.9M customers and a 2015 $33M California privacy settlement.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2023-12-18]
Comcast Cable Communications' December 18, 2023 breach notification filed with the Maine Attorney General reports that the October 2023 external system breach (hacking) affected 35,879,455 people in total, including 50,782 Maine residents, and lists a prior breach notification dated December 5, 2022.
On September 17, 2015, the California Attorney General announced that the California Department of Justice and the California Public Utilities Commission reached a $33 million settlement with Comcast over allegations that it posted online the names, phone numbers, and addresses of tens of thousands of customers who had paid for unlisted VOIP phone service, including $8 million in restitution to affected customers.
Receipted federal filings: FEC campaign-finance records and LDA lobbying disclosures. A tie is a disclosed transaction or filing, not a claim of influence or wrongdoing.
COMCAST CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Commerce, Science, and Transportation, per LDA Form LD-2.
COMCAST CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Environment and Public Works, per LDA Form LD-2.
COMCAST CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Banking, Housing, and Urban Affairs, per LDA Form LD-2.
COMCAST CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Appropriations, per LDA Form LD-2.
COMCAST CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Energy and Natural Resources, per LDA Form LD-2.
COMCAST CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Agriculture, Nutrition, and Forestry, per LDA Form LD-2.
COMCAST CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on the Judiciary, per LDA Form LD-2.
COMCAST CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Commerce, Science, and Transportation, per LDA Form LD-2.
COMCAST CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on the Judiciary, per LDA Form LD-2.
The Xfinity Privacy Center states that as an Internet Service Provider Comcast does not track the websites customers visit or apps they use through their broadband connection to build a profile, and says it does not sell information that directly identifies customers.
The FTC's October 2021 staff report "A Look at What ISPs Know About You," based on compulsory 6(b) orders to the six largest US ISPs including Comcast Cable Communications d/b/a Xfinity, found that ISPs collect and combine data beyond what service provision requires, including browsing data, television viewing history, location information, and race and ethnicity data.
The Xfinity Privacy Policy (effective April 23, 2026) states that Comcast collects household and device video selection and viewing activity, voice commands and audio recordings made through voice-activated devices such as the Voice Remote, geolocation information, DNS searches, and network traffic activity when customers use services such as Xfinity Internet, Mobile, or WiFi.
Comcast publishes a semiannual transparency report quantifying government demands for customer information; the report covering July 1 to December 31, 2025 discloses 18,618 criminal legal demands (including 12,938 subpoenas, 449 content warrants, and 29 pen register/trap-and-trace orders), 3,400 emergency requests, and banded national security demand counts.
Comcast Corporation's Form 10-K for fiscal year 2025, filed with the SEC on February 3, 2026, identifies it as a Pennsylvania-incorporated public company headquartered in Philadelphia whose Class A common stock trades on Nasdaq under CMCSA, describing itself as a global media and technology company operating brands including Xfinity, Comcast Business, Sky, and NOW.
Announcing its October 2021 ISP privacy report covering the six largest US ISPs including Comcast's Xfinity, the FTC said that even though several of the ISPs promise not to sell consumers' personal data, they allow it to be used, transferred, and monetized by others, with disclosures hidden in the fine print of privacy policies.
The Xfinity Privacy Policy (effective April 23, 2026) permits disclosure of information to advertising partners to tailor marketing on Comcast services and third-party platforms, and reserves the right to use, share, license, or sell aggregated or deidentified information for any purpose, stating that such data is no longer subject to the policy.
On September 17, 2015, the California Attorney General announced that the California Department of Justice and the California Public Utilities Commission reached a $33 million settlement with Comcast over allegations that it posted online the names, phone numbers, and addresses of tens of thousands of customers who had paid for unlisted VOIP phone service, including $8 million in restitution to affected customers.
Comcast Cable Communications' December 18, 2023 breach notification filed with the Maine Attorney General reports that the October 2023 external system breach (hacking) affected 35,879,455 people in total, including 50,782 Maine residents, and lists a prior breach notification dated December 5, 2022.
Xfinity's Notice to Customers of Data Security Incident states that between October 16 and 19, 2023, an unauthorized party accessed internal systems through a vulnerability in Citrix software, and that on December 6, 2023 Comcast concluded the acquired information included usernames, hashed passwords, and for some customers names, contact information, last four digits of Social Security numbers, dates of birth, and secret questions and answers.
Comcast Advertising's audience targeting page states that it builds advertising audience segments by layering Comcast's anonymized first-party viewership data — which shows what and when people are watching — with third-party geographic, demographic, and psychographic data, and that it can reach an estimated 100+ million adults.
The Xfinity Privacy Policy (effective April 23, 2026) states that Comcast may use cookies and other technology, including tracking technologies offered by third parties, to deliver personalized advertising, and that it allows partners including advertisers to use cookies and similar tracking technologies on its services.