Netflix's privacy policy and account settings disclose that the company collects viewing and non-viewing data (including device, network, and interaction data) and shares categories of this information with an internal "Netflix family of companies," service providers, and advertising partners, with additional data collected for ad-supported tier subscribers. Netflix's public regulatory record includes a December 2024 Dutch Data Protection Authority fine for GDPR transparency failures and a May 2026 Texas Attorney General lawsuit alleging undisclosed data collection and sharing with data brokers and ad-tech companies; both matters concern how clearly Netflix discloses its data practices rather than the practices being clandestine or unlawful in a final adjudicated sense (the Texas matter remains pending litigation). Corporate ownership is traceable through SEC filings identifying Netflix, Inc.'s wholly owned subsidiaries, including its principal EU entity, Netflix International B.V.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
24 ON FILE
COLLECTION
Netflix's help center discloses that the personal information it holds about account holders includes account information (email and phone number), plan/membership selection, notification preferences, and privacy/data settings including behavioral-advertising eligibility status.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
The Dutch Data Protection Authority's December 2024 enforcement decision found that data Netflix collects about customers includes email addresses, telephone numbers, payment details, and information about what customers watch on the platform.
Netflix's privacy statement discloses that the company collects non-viewing data through user interactions and from third parties, including device information, devices on the local network, IP address, advertising interactions, and approximate location.
A Texas Attorney General lawsuit filed against Netflix alleges that the company's behavioral logging generates approximately 5 petabytes of user behavior data per day.
Netflix, Inc.'s SEC Form 10-K discloses that the company was incorporated in Delaware in August 1997 and completed its initial public offering in May 2002, with principal offices in Los Gatos, California.
Netflix's SEC subsidiary-listing exhibit states that the names of certain other Netflix subsidiaries are omitted from the publicly filed list pursuant to SEC disclosure rules.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
Netflix disclosed via a Form 8-K dated December 5, 2025 the structure of its planned merger transaction with Warner Bros. Discovery, including WBD's internal reorganization and the subsequent merger of a Netflix subsidiary with WBD.
Netflix's privacy policy discloses that "Advertising Companies" — advertisers running ads on Netflix — may provide or allow Netflix to collect unique identifiers such as cookies or resettable device identifiers, plus demographic and interaction data, to support ad delivery.
Netflix's privacy statement discloses that it shares subscriber information among the "Netflix family of companies" for data processing, storage, and support purposes, and separately discloses categories of information to "Experience Providers," entities in business transfers, law enforcement, courts, and regulators.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
The Dutch Data Protection Authority's December 2024 decision found that Netflix 'failed to specify which parties received customer data and the reasons for such sharing' during the 2018-2020 period under review.
A May 2026 Texas Attorney General press release alleges that Netflix disclosed subscriber behavioral data to commercial data brokers and advertising technology companies, where it was combined with data collected from other platforms to build consumer profiles; this is a litigation allegation, not an adjudicated finding.
In 2012, Netflix agreed to pay $9 million to settle a US class-action lawsuit alleging it violated the Video Privacy Protection Act by retaining former customers' viewing histories and rental records after they cancelled their subscriptions.
The Dutch DPA investigation that led to the 2024 fine originated from a 2019 complaint filed by the Austrian privacy organization noyb regarding Netflix's handling of data subject access requests.
On December 18, 2024, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) fined Netflix €4.75 million for GDPR violations related to insufficient transparency about how customer data was used between 2018 and 2020.
Third-party tracker analysis of the netflix.com website by WhoTracks.Me (Ghostery) lists multiple embedded trackers including Google-operated advertising and hosting components, Meta/Facebook advertising, TikTok analytics, and Trade Desk advertising technology.
Netflix's own help center states that the company does not respond to browser "Do Not Track" signals and describes cookie-based online tracking used to support behavioral advertising, which users can partially manage through account privacy settings.