On April 18, 2026, Netflix updated its Privacy Statement to explicitly disclose that it collects voice inputs, including transcripts and recordings, whenever users interact with voice features. The same update expanded Netflix's disclosed data collection to include data from advertiser websites and apps, and confirmed that Netflix now makes advertising-related inferences about users and their households. These disclosures were not clearly present in the prior version of the Privacy Statement. If you have a Netflix account, this change affects how your data is collected, shared, and used for ad targeting.
ConductAtlas archived the full text of the update and generated a change record with version-level diff evidence. Here is what changed, why it matters, and what you can do about it.
What the policy now says
The April 18, 2026 Privacy Statement update introduces three material additions.
Voice input collection. Netflix now explicitly states that it collects voice inputs, including transcripts and recordings, when users engage with voice features. This includes voice search, voice navigation, and any other interaction where the user speaks into a Netflix-connected device. Prior versions did not make this collection explicit in the Privacy Statement.
Household-level inferences for advertising. Netflix now discloses that it makes inferences about users and their households for advertising purposes. Household-level inference means Netflix is not just profiling you as an individual subscriber. It is building a model of the people living in your home based on shared viewing patterns, shared devices, and shared accounts. That aggregated profile is then used to target advertising.
Off-platform advertiser data. Netflix now collects data from advertiser websites and apps. This means if a brand that advertises on Netflix also operates its own website or mobile app, Netflix may receive information about your activity on those external properties. This extends Netflix's advertising data collection significantly beyond the Netflix platform itself.
A separate textual change: the section previously titled "Hashed Identifiers and Resettable Device Identifiers" was renamed to the broader "other Identifiers." The rename itself is not a disclosure change, but the broader label may allow Netflix to expand the types of tracking technologies covered under this category in the future without further amending the Privacy Statement.
Why this matters
Three reasons this update is more significant than a routine policy refresh.
Voice data is among the most sensitive categories of consumer data. Voice recordings contain biometric information, speech patterns, background audio, emotional tone, and often accidental disclosures of third parties who have not consented to collection. Platforms collecting voice inputs have historically faced regulatory scrutiny. Disclosing voice collection in a privacy policy is the bare legal minimum. Actually processing, storing, and potentially human-reviewing those recordings carries separate obligations under the GDPR, the CCPA, and state biometric laws such as Illinois's BIPA.
Household-level inference is profiling under GDPR. Under GDPR Article 4(4), profiling means any form of automated processing of personal data to evaluate personal aspects of a natural person. Building a household-level advertising model from shared viewing and device patterns is profiling. Netflix's update triggers disclosure obligations under GDPR Article 13(2)(f), which requires notice about the existence of automated decision-making and the significance of its effects. If profiled targeting produces legally significant or similarly significant effects, GDPR Article 22 adds safeguards, including a right to human review. Whether Netflix's household advertising inference meets that threshold is a question the European Data Protection Board and national data protection authorities may review.
Off-platform tracking is a separate consent question. Collecting data from advertiser websites and apps raises the same concerns that made the ad tech industry a long-running regulatory target. Under the GDPR, this kind of cross-site tracking typically requires explicit consent under Article 5(1)(a). Under the CCPA and CPRA, it likely qualifies as a "sale" or "sharing" of personal information, which California residents have the right to opt out of. Under the FTC Act Section 5, a disclosure that appears in a privacy policy but is not made prominent at the point of tracking could be challenged as a deceptive practice.
The regulatory exposure, in specific terms
Based on the ConductAtlas regulatory exposure analysis, the April 18, 2026 update implicates at least the following obligations.
GDPR Article 13(1)(c) and 13(2)(f): Netflix must provide notice of the purposes for processing and the existence of automated decision-making including profiling. Household-level advertising inference likely constitutes profiling under Article 4(4).
GDPR Article 5(1)(a): Processing must be lawful, fair, and transparent. The addition of voice recording collection and off-platform advertiser tracking requires a valid legal basis, most likely consent under Article 6(1)(a) or legitimate interests under Article 6(1)(f) — though legitimate interests is increasingly disfavored by the European Data Protection Board for advertising-driven processing.
GDPR Article 22: If household-level profiling produces decisions with legal or similarly significant effects on users, they have the right to human intervention, to express their view, and to contest the decision.
CCPA / CPRA: California residents have the right to know what categories of personal information are collected, to delete that information, and to opt out of the sale or sharing of their information for cross-context behavioral advertising. Voice recordings and household inferences both fall within scope.
Illinois BIPA: Voice recordings may contain voiceprint biometric identifiers. Under BIPA, collecting biometric identifiers requires specific written consent, disclosure of purpose, and retention schedules. Netflix processing voice recordings from Illinois residents without meeting these requirements has been grounds for prior class action litigation against other platforms.
FTC Act Section 5: If Netflix markets voice features without prominent disclosure of recording, or if actual data practices diverge from the Privacy Statement, the FTC has authority to challenge the practice as unfair or deceptive.
What you can do
If you are a Netflix subscriber and want to limit the expanded collection, there are several practical steps to take. None of them fully opt you out of the Privacy Statement — continued use of Netflix means the Privacy Statement applies — but they reduce the scope of collection where Netflix offers controls.
Review your Privacy and Data Settings. Sign in to Netflix and go to Account, then Privacy and Data Settings. Netflix provides some user-facing controls over advertising preferences and data sharing. Adjusting these will not prevent voice input collection (which is tied to voice feature usage), but it can limit targeted advertising based on inferences.
Disable voice features where possible. If you do not use voice search or voice navigation, disabling those features on your Netflix-connected devices (smart TVs, remotes with voice, mobile apps) prevents voice inputs from being captured. The Privacy Statement update specifically ties voice recording collection to voice feature use.
If you are a California resident, submit a Do Not Sell or Share My Personal Information request. Netflix provides this option in its Privacy and Data Settings and in its CCPA-specific disclosure page. This requires Netflix to stop selling or sharing your personal information for cross-context behavioral advertising, which is directly relevant to the off-platform advertiser data collection disclosed in the update.
If you are an EU or UK resident, exercise your GDPR rights. You have the right to access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), and data portability (Article 20). Netflix must respond to these requests within one month. If you believe Netflix's profiling or voice processing is unlawful, you can lodge a complaint with your national data protection authority under Article 77.
If you are an Illinois resident and have used voice features, document the date. BIPA class actions have historically turned on proving voice recordings were collected in Illinois without the statute's required written consent. Keeping records of when you used voice features on Netflix, from which Illinois location, is evidentiary.
File a complaint with the FTC. If you believe the disclosure is deceptive or that Netflix's actual practices differ from the Privacy Statement, you can file a complaint at ftc.gov/complaint. The FTC does not respond to individual complaints but uses the volume and pattern of complaints to inform enforcement priorities.
How we know this changed
ConductAtlas monitors the Netflix Privacy Statement daily. On April 18, 2026, our capture detected a substantive change from the prior version. The change was hashed with SHA-256, backed up to the Wayback Machine, and archived with a stable record ID suitable for legal citation. The change was then parsed into individual provisions and classified. The voice input collection addition was rated high severity. The household-level inference and expanded tracking identifiers were rated medium severity.
The full Privacy Statement, version diff against the prior version, and provision-level classification are all accessible in the ConductAtlas archive. Every record in the archive is independently verifiable via its cryptographic hash and Wayback Machine backup.
ConductAtlas tracks every version of Netflix's Privacy Statement and Terms of Use. When Netflix or any of the other 170+ platforms we monitor updates these documents, we flag the changes the same day with clause-level analysis and regulatory exposure mapping.