Netflix confirms it sells or shares your identifiers, viewing activity, behavioral data, and inferences about you with advertisers, ad networks, and analytics companies, primarily for targeted advertising purposes.
This analysis describes what Netflix's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This clause establishes the operational scope and recipient categories for Netflix's sale and sharing of personal information under state privacy law definitions. It specifies which data categories are subject to these transfers and identifies the functional classes of third parties receiving such information.
The updated privacy statement now explicitly discloses that Netflix collects voice inputs including transcripts and recordings when users interact with voice-related features, and that it makes inferences about user and household preferences for ad targeting purposes. The statement adds a new section titled 'Supplemental Privacy Disclosures for US Residents' that references a separate US State Privacy Notice containing 'Notice at Collection' details, alongside new subsections covering personal information collection, uses, disclosure for business purposes, data sales or sharing, retention, use of de-identified information, appeals rights, and financial incentive notices. The change brings the privacy statement into alignment with state privacy laws like CCPA and similar frameworks. You can access the US State Privacy Notice by clicking the provided link, visiting netflix.com/privacy#states, or scrolling to the new US residents section.
View change record →The updated privacy statement reorganizes and consolidates disclosures rather than expanding data collection practices. However, the statement removes explicit reference to the US State Privacy Notice from the main body, requiring users to navigate to supplemental sections to access state-specific privacy rights and disclosures. The revised language also removes the prior statement that Netflix makes inferences about household ad preferences, and removes mention of voice inputs and transcripts from the usage information description, narrowing the scope of explicitly disclosed data collection practices. You can access US state privacy notices by navigating to the 'Supplemental Privacy Disclosures for Certain Services' section or visiting netflix.com/privacy#states.
View change record →Your viewing history, identifiers, and inferred interests may be shared with advertising technology companies and social media platforms for targeted advertising, even if you do not use an ad-supported Netflix plan. US residents in states with applicable privacy laws can opt out of this sharing.
How other platforms handle this
We target (and measure the performance of) ads to Members, Visitors and others both on and off our Services directly or through a variety of partners, using the following data, whether separately or combined: Data from advertising technologies on and off our Services, like web beacons, pixels, ad ta...
We work with advertising partners to display advertisements on our services and on third-party websites and apps. These partners may use cookies, pixel tags, and similar technologies to collect information about your activities on our services and other websites to provide you with targeted advertis...
Microsoft uses data we collect to provide you with rich, interactive experiences. In particular, we may use data to show you advertising or serve Microsoft-selected content within Microsoft products and services. Microsoft does not use what you say in email, chat, video calls, or voice mail to targe...
Monitoring
Netflix has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We sell or share (as those terms are defined under applicable US state privacy laws) the following categories of personal information to/with advertising technology companies, advertising networks, social media companies and other advertising-related companies, as well as analytics companies: identifiers, commercial information, internet or other electronic network activity information, and inferences drawn from these categories of personal information to create a profile about you.— Excerpt from Netflix's Netflix Privacy Statement
REGULATORY LANDSCAPE: This provision directly engages the California Consumer Privacy Act as amended by CPRA, which requires businesses to disclose the sale and sharing of personal information and provide consumers with a right to opt out. It also implicates Colorado, Connecticut, Virginia, Texas, Oregon, and Montana state privacy laws, which similarly require opt-out rights for targeted advertising. The FTC has jurisdiction over deceptive data practices, and the CPRA is enforced by the California Privacy Protection Agency. GDPR is also relevant for EU users if behavioral advertising relies on consent as a lawful basis, given guidance from EU supervisory authorities on consent requirements for third-party advertising. GOVERNANCE EXPOSURE: High. The explicit acknowledgment of selling and sharing multiple categories of personal information with advertising technology companies creates material CPRA compliance obligations, including maintaining a functional 'Do Not Sell or Share My Personal Information' mechanism and honoring Global Privacy Control signals. Failure to maintain compliant opt-out mechanisms could attract regulatory scrutiny from the California Privacy Protection Agency, which has actively investigated major platforms on similar issues. JURISDICTION FLAGS: California creates the highest exposure given CPRA's private right of action for data breaches and the CPPA's active enforcement posture. Colorado, Connecticut, and Virginia also require opt-out rights for cross-context behavioral advertising. EU and EEA users are likely subject to different treatment given GDPR's stricter consent requirements; the policy should be evaluated to confirm whether behavioral advertising to EU users relies on valid consent rather than legitimate interests. Illinois BIPA is not directly implicated unless voice or facial data is incorporated into ad profiles. CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should confirm that data processing agreements or joint controller agreements are in place with all advertising technology vendors receiving personal information under this provision. The transfer of inferences drawn from personal data to advertising networks may create liability if downstream partners process data in ways inconsistent with Netflix's stated purposes. Standard commercial practice requires data processing agreements that bind recipients to use limitations consistent with Netflix's privacy disclosures. COMPLIANCE CONSIDERATIONS: Compliance teams should audit the technical implementation of the opt-out mechanism to confirm it functions correctly across all platforms (web, mobile, TV apps) and honors Global Privacy Control signals as required by CPRA. A data mapping exercise should identify all advertising and analytics partners receiving data under this provision, confirm contractual protections are in place, and assess whether the categories disclosed align with actual data flows. Policy updates may be required as new state privacy laws take effect.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This clause establishes the operational scope and recipient categories for Netflix's sale and sharing of personal information under state privacy law definitions. It specifies which data categories are subject to these transfers and identifies the functional classes of third parties receiving such information.
Your viewing history, identifiers, and inferred interests may be shared with advertising technology companies and social media platforms for targeted advertising, even if you do not use an ad-supported Netflix plan. US residents in states with applicable privacy laws can opt out of this sharing.
ConductAtlas has identified this type of provision across 1 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Netflix.