Plex is a personal media server platform (Plex Media Server) paired with an ad-supported free streaming ("Watch Free") service, operated by Plex GmbH and its affiliates including Plex, Inc. (a private company). Plex's own privacy policy states that server-side Personal Content (titles, filenames, metadata) is generally NOT collected from a user's Plex Media Server, but Plex separately collects an extensive set of account-linked activity data — including an advertising ID, approximate location, device identifiers, and detailed playback telemetry — and self-declares that some of its advertising-related disclosures "could be considered 'sale' or 'sharing'" under state privacy laws. Apple's App Store privacy label confirms Plex uses Identifiers, Usage Data, and Location to track users across apps and websites owned by other companies. Plex disclosed two separate security incidents to users, in August 2022 and September 2025, each involving unauthorized third-party access to a database containing emails, usernames, and hashed/encrypted passwords.
TRACK RECORD
1 BREACH
[2015-07-02] · BREACH
Have I Been Pwned lists a breach record for Plex: "Plex".
Approximately 327,314 accounts affected, per HIBP.
Exposed: Email addresses, IP addresses, Passwords, Usernames.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
Plex's privacy policy states that data collected directly from the Plex Media Server is limited to email, IP address, and username, and that Personal Content (titles, filenames, metadata) is not collected by default; the same policy separately lists an extensive set of account-linked activity data collected across the service — including an advertising ID, device identifiers, approximate (truncated) latitude/longitude, and detailed playback telemetry — that is "linked to you."
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
Plex's privacy policy states it applies to data collected through products and services provided by Plex GmbH and its affiliates including Plex, Inc. (together, "Plex") — Plex's own self-disclosure of its operating corporate entities, with no further public filing or investor disclosure found on Plex's own website.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
Plex's privacy policy states that certain disclosures of Personal Data to third parties for advertising purposes may constitute a "sale" or "sharing" of personal information (including for cross-context behavioral advertising) under applicable state privacy laws, and separately reserves the right to transfer Personal Data as part of a merger, acquisition, bankruptcy, or similar transaction involving Plex.
Have I Been Pwned's breach catalog lists the "Plex" incident (plex.tv), breach date 2015-07-02, affecting approximately 327,314 accounts. Data classes exposed per HIBP: Email addresses, IP addresses, Passwords, Usernames. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
Plex's official forum notice states that on August 22, 2022, Plex discovered suspicious activity on one of its databases and determined that a third party was able to access a limited subset of data including emails, usernames, and encrypted passwords, prompting a mandatory password reset for all Plex accounts.
Plex's official forum notice, posted September 8, 2025, states that an unauthorized third party accessed a limited subset of customer data from one of Plex's databases, including emails, usernames, securely hashed passwords, and authentication data, prompting Plex to again require a password reset and device sign-out.
The Plex iOS app's Apple App Store privacy label (fetched from Plex's App Store product page) discloses that Location, Identifiers, and Usage Data may be used to track the user across apps and websites owned by other companies, and separately lists data linked to identity collected for Third-Party Advertising and the developer's own Advertising/Marketing purposes.
Plex's Tracking Technologies page (linked from its privacy policy) states Plex uses Google Analytics and, from time to time, contracts with third-party marketing partners and advertising networks that use cookies to collect information about visits and actions on the site in order to serve retargeted ads, with an opt-out offered via the Network Advertising Initiative opt-out page.