Texas sues Netflix over alleged data practices that create ‘surveillance machinery’ without user consent

Texas Attorney General Ken Paxton said Monday that the state is suing Netflix for allegedly not obtaining user consent before collecting and sharing subscriber data with advertisers and data brokers.

The lawsuit cites several examples of Netflix leadership asserting that the company does not collect and share user data with advertisers even as the company has long used “intentional engineering to track and log users’ viewing habits, preferences, devices, household networks, application usage, and other sensitive behavioral data,” according to a press release.

This tracking is also used to analyze kids’ profiles, the lawsuit said, and to pinpoint users’ locations.

“Netflix users’ data is essentially shopped across Big Ad Tech’s shadowy network,” according to the press release. “The company earns billions of dollars every year from secretly selling consumer data.” 

A spokesperson for Netflix did not immediately respond to a request for comment.

In addition to fines, Texas is asking a judge to prevent Netflix from illegally collecting and sharing user data and to mandate that the company no longer use autoplay by default on kids’ profiles.

During a 2020 earnings call, CEO Reed Hastings told investors “we don’t collect anything,” according to the lawsuit. “We’re really focused on just making our members happy, and we’re not tied up with all that controversy around advertising.”

Meanwhile, the lawsuit alleges, in 2016 a Netflix engineer appeared at a conference, saying that Netflix is a “logging company that occasionally streams movies.”

Netflix collects and shares data showing how users and their children behave by tracking what they click and how long they stay, what they replay or skip, where they are located, what apps they use and what other devices they own, according to the lawsuit.

The streaming company merges location data pulled from IP addresses with user demographics and viewing habits to “engineer highly granular audience segments and deliver hyper-targeted advertising,” the complaint said.

Netflix shares user data with third-party advertisers, the data brokers Experian and Acxiom and ad tech platforms like Google Display & Video 360, allowing its data to be integrated with other information third parties have collected about its users, the lawsuit said.

The streaming company also pushes parents to create profiles for their kids, marketing them as a “safe area” for children 12 and under.  While Netflix doesn’t show children targeted ads, it “aggressively” collects behavioral data from kids’ accounts, the lawsuit said.

Netflix now collects about 5 petabytes of user behavior logs each day, according to the complaint.

Paxton alleges that Netflix’s privacy policy is “feeble” and does not tell users about the full scope of its data collection practices. 

The privacy policy was updated in 2024 after Dutch regulators found that the company did not properly alert consumers about its data collection practices, but it remains “vague, deceptive and incomplete,” the lawsuit said.