Netflix transfers personal information across international borders, and the policy references the use of Standard Contractual Clauses and other legal mechanisms to authorize those transfers for users in regions such as the EU and UK.
This analysis describes what Netflix's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
International data transfers from the EU/EEA and UK to countries without an adequacy decision require specific legal mechanisms under GDPR and UK GDPR; the policy's reference to transfer mechanisms indicates reliance on Standard Contractual Clauses or equivalent arrangements that are subject to ongoing regulatory scrutiny.
Interpretive note: The document references transfer mechanisms and a data controller information page but does not reproduce the specific SCCs or transfer impact assessment details; the full scope of transfer safeguards depends on linked external documentation.
The updated privacy statement now explicitly discloses that Netflix collects voice inputs including transcripts and recordings when users interact with voice-related features, and that it makes inferences about user and household preferences for ad targeting purposes. The statement adds a new section titled 'Supplemental Privacy Disclosures for US Residents' that references a separate US State Privacy Notice containing 'Notice at Collection' details, alongside new subsections covering personal information collection, uses, disclosure for business purposes, data sales or sharing, retention, use of de-identified information, appeals rights, and financial incentive notices. The change brings the privacy statement into alignment with state privacy laws like CCPA and similar frameworks. You can access the US State Privacy Notice by clicking the provided link, visiting netflix.com/privacy#states, or scrolling to the new US residents section.
View change record →The updated privacy statement reorganizes and consolidates disclosures rather than expanding data collection practices. However, the statement removes explicit reference to the US State Privacy Notice from the main body, requiring users to navigate to supplemental sections to access state-specific privacy rights and disclosures. The revised language also removes the prior statement that Netflix makes inferences about household ad preferences, and removes mention of voice inputs and transcripts from the usage information description, narrowing the scope of explicitly disclosed data collection practices. You can access US state privacy notices by navigating to the 'Supplemental Privacy Disclosures for Certain Services' section or visiting netflix.com/privacy#states.
View change record →The policy states that personal information is transferred internationally, including from the EU/EEA and UK, under Standard Contractual Clauses or other transfer mechanisms. The adequacy and implementation of these mechanisms determines whether EU and UK data protection rights travel with the data.
How other platforms handle this
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
You can contact us in order to (1) update or correct your personally identifiable information, (2) change your preferences with respect to communications and other information you receive from us, or (3) delete the personally identifiable information maintained about you...
Access information about you consistent with legal requirements. In addition, you may have the right in some cases to receive or have your electronic information transferred to another party.
"Information about the specific Netflix entity (or entities) that are responsible for your personal information (known as the "data controller" in certain countries) is available at netflix.com/legal/corpinfo.Excerpt from Netflix's Privacy Statement
1) REGULATORY LANDSCAPE: GDPR Chapter V governs international transfers from the EU/EEA, requiring adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, or derogations.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
International data transfers from the EU/EEA and UK to countries without an adequacy decision require specific legal mechanisms under GDPR and UK GDPR; the policy's reference to transfer mechanisms indicates reliance on Standard Contractual Clauses or equivalent arrangements that are subject to ongoing regulatory scrutiny.
The policy states that personal information is transferred internationally, including from the EU/EEA and UK, under Standard Contractual Clauses or other transfer mechanisms. The adequacy and implementation of these mechanisms determines whether EU and UK data protection rights travel with the data.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Netflix.