Paramount+ is the subscription streaming service of Paramount Skydance Corporation, the company formed when Skydance Media's acquisition of Paramount Global closed on August 7, 2025 (Nasdaq: PSKY). The app is governed by the umbrella Paramount Skydance privacy policy (last modified May 12, 2026), which describes collection of registration, billing, and demographic data plus device and advertising identifiers (IDFA, AAID, ICCID, IMSI, MAC address), and states that some brands disclose device and advertising identifiers to advertising partners for targeted advertising, with data also shared across the Paramount Skydance Family of Companies and with social media companies such as Meta, Snap, and X for custom audiences. The policy discloses session-replay-style tools, cookies, pixels, and SDKs; the App Store label (developer CBS Interactive) declares purchases, location, contact info, and identifiers used to track users across other companies' apps. Paramount publishes a controller list and annual CCPA metrics and honors Global Privacy Control where required. Track record includes a 2023 Paramount Global breach exposing Social Security numbers, an 82,128-person breach at then-parent National Amusements, and VPPA litigation now before the U.S. Supreme Court.
TRACK RECORD
1 ENFORCEMENT ACTION
[2026-01-26]
In Salazar v. Paramount Global (dba 247Sports), a Video Privacy Protection Act suit over Meta-pixel transmission of video-viewing data, the district court's dismissal was affirmed by the Sixth Circuit on April 3, 2025, and the U.S. Supreme Court granted certiorari on January 26, 2026 (No. 25-459) to resolve who qualifies as a "consumer" under the VPPA. The claims remain allegations; no liability has been found.
The Paramount+ App Store privacy label, self-reported by developer CBS Interactive, declares that purchases, coarse location, email address, identifiers, and usage data may be collected and linked to the user's identity, including for third-party advertising purposes.
Paramount's Minors' Privacy Policy commits to showing minors only contextual advertisements, stating that it does not serve ads to minors based on personal information about who they are, what they like, or their viewing and browsing history.
The Paramount Skydance privacy policy, which governs Paramount+, states that Paramount automatically collects a broad set of device identifiers — including IP address, advertising IDs (IDFA, AAID, RIDA), mobile identifiers (ICCID, IMSI), cookie IDs, and MAC address — alongside online activity and preference data.
Paramount publishes annual CCPA metrics reporting the volume and handling of consumer privacy requests; for January–December 2025 it reported 70 right-to-know requests, 479 deletion requests, and 9,456 opt-out requests, all of the opt-outs recorded as complied with.
Per its Form 8-K filed with the SEC, Paramount Skydance Corporation (formerly New Pluto Global, Inc.) completed the business combination of Skydance Media and Paramount Global on August 7, 2025; the company's Class B common stock trades on Nasdaq under the symbol PSKY. Paramount+ is operated within this publicly traded, SEC-reporting structure.
Paramount publishes a per-country controller list identifying the specific legal entity acting as data controller for each brand and market — for example, naming Paramount Global Streaming International LLC as the Paramount+ controller for Argentina — which makes accountability for the service traceable by jurisdiction.
A 2022 class action (Parcell v. Paramount Global, N.D. Ill.) alleges that Paramount used the Facebook tracking pixel on CBS.com to transmit subscribers' video-viewing data and account details to Facebook without consent, in alleged violation of the Video Privacy Protection Act. These are allegations in pending litigation, not judicial findings.
The governing privacy policy states that some Paramount brands disclose device identifiers and advertising identifiers to advertising partners, who use and share those identifiers for targeted advertising on third-party sites — activity the policy acknowledges can constitute a "sale" or "sharing" of personal information under US state privacy laws, with an opt-out offered via a "Your Privacy Choices" link and, where required, the Global Privacy Control signal.
In August 2023, Paramount Global disclosed a data breach in which attackers had access to its systems between May and June 2023; breach notification letters stated the exposed personal information may have included names, dates of birth, Social Security numbers or other government-issued identification numbers.
National Amusements, at the time the controlling shareholder of Paramount (and CBS), reported in a filing with Maine's attorney general that a December 2022 breach exposed personal information of 82,128 people, including financial account or card numbers with associated security codes; the breach was discovered in August 2023 and notifications began in December 2023.
In Salazar v. Paramount Global (dba 247Sports), a Video Privacy Protection Act suit over Meta-pixel transmission of video-viewing data, the district court's dismissal was affirmed by the Sixth Circuit on April 3, 2025, and the U.S. Supreme Court granted certiorari on January 26, 2026 (No. 25-459) to resolve who qualifies as a "consumer" under the VPPA. The claims remain allegations; no liability has been found.
The Paramount+ App Store privacy label declares that purchases, location, contact info, and identifiers may be used to track users across apps and websites owned by other companies — Apple's definition of cross-app/cross-site tracking.
Beyond cookies, pixels, tags, beacons, and partner SDKs, the governing privacy policy discloses use of third-party session-replay-style tools on certain pages that observe mouse movements, clicks, keystrokes, and text entered. The same policy states Paramount's websites and apps are not designed to respond to browser "do not track" requests.