Depending on where you live, you may have rights to access, correct, delete, or port your data, opt out of targeted advertising and data sale, and file a complaint with a regulator. These rights vary by jurisdiction.
This analysis describes what Netflix's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision operationalizes Netflix's compliance with regional privacy regulations by establishing a framework through which users can exercise legally recognized data rights. The provision conditions the availability of these rights on jurisdiction, reflecting Netflix's obligation to align its privacy practices with applicable regulatory requirements in different markets.
The updated privacy statement now explicitly discloses that Netflix collects voice inputs including transcripts and recordings when users interact with voice-related features, and that it makes inferences about user and household preferences for ad targeting purposes. The statement adds a new section titled 'Supplemental Privacy Disclosures for US Residents' that references a separate US State Privacy Notice containing 'Notice at Collection' details, alongside new subsections covering personal information collection, uses, disclosure for business purposes, data sales or sharing, retention, use of de-identified information, appeals rights, and financial incentive notices. The change brings the privacy statement into alignment with state privacy laws like CCPA and similar frameworks. You can access the US State Privacy Notice by clicking the provided link, visiting netflix.com/privacy#states, or scrolling to the new US residents section.
View change record →The updated Privacy Statement explicitly discloses that Netflix collects voice inputs, including transcripts and recordings, when you use voice-related features on the service. The policy also expands the types of advertising-related data collected to include inferences about ad preferences at the household level and information gathered from advertiser websites and apps. These additions represent more detailed disclosure of existing or expanded data collection practices rather than entirely new service functionality. You can manage advertising preferences through Netflix's advertising choices settings, though the updated policy does not specify opt-out mechanisms for voice data collection or advertiser-website data gathering.
View change record →The updated privacy statement reorganizes and consolidates disclosures rather than expanding data collection practices. However, the statement removes explicit reference to the US State Privacy Notice from the main body, requiring users to navigate to supplemental sections to access state-specific privacy rights and disclosures. The revised language also removes the prior statement that Netflix makes inferences about household ad preferences, and removes mention of voice inputs and transcripts from the usage information description, narrowing the scope of explicitly disclosed data collection practices. You can access US state privacy notices by navigating to the 'Supplemental Privacy Disclosures for Certain Services' section or visiting netflix.com/privacy#states.
View change record →Your privacy rights under this policy depend heavily on where you live. EU residents have comprehensive GDPR rights, California residents have CPRA rights including opt-out of data sale, while users in many other countries may have more limited practical rights. You can exercise your rights by visiting your account settings or contacting privacy@netflix.com.
How other platforms handle this
Depending on where you are located, you may have certain rights regarding your personal information, including the right to access, correct, delete, or restrict processing of your personal information, the right to data portability, and the right to object to or withdraw consent for certain processi...
For individuals in the United States, please also refer to our Notice For Individuals Residing In Certain US States below and the Consumer Health Data Policy.
If you are a California resident, you may have the right to: Know what personal information we collect, use, disclose, sell, or share. Correct inaccurate personal information. Delete your personal information. Opt out of the sale or sharing of your personal information. Limit the use and disclosure ...
Monitoring
Netflix has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Depending on where you live, you may have the right to: access the personal information we hold about you; correct or delete your personal information; restrict or object to our processing of your personal information; in some cases, port or transfer your personal information to another company; opt out of the processing of your personal information for purposes of targeted advertising, the sale of personal information, and profiling in furtherance of decisions that produce legal or similarly significant effects; not be discriminated against for exercising your privacy rights; and in certain countries, lodge a complaint with a supervisory authority if you have concerns about how we handle your personal information.— Excerpt from Netflix's Netflix Privacy Statement
REGULATORY LANDSCAPE: The rights enumerated in this provision map to GDPR Articles 15 to 22 for EU/EEA users, CPRA rights for California residents, and comparable provisions in Colorado, Connecticut, Virginia, Texas, Oregon, and Montana state privacy laws. The right to opt out of profiling for consequential decisions is specifically referenced, which engages GDPR Article 22 and CPRA's automated decision-making provisions. The non-discrimination right reflects the CCPA/CPRA statutory requirement. Enforcement is distributed across EU supervisory authorities, the California Privacy Protection Agency, and state attorneys general. GOVERNANCE EXPOSURE: Medium. The policy's statement that rights depend on 'where you live' creates a tiered rights structure that may be operationally complex to implement, particularly for a global platform. Compliance with varied and evolving state privacy law rights request procedures requires robust identity verification, response tracking, and documented appeals processes. JURISDICTION FLAGS: EU and EEA users have the most comprehensive rights with the most rigorous enforcement framework. California residents have CPRA rights with CPPA enforcement. US states enacting new privacy laws in 2024 and 2025 continue to expand the covered population. Users in jurisdictions outside these areas may have contractually stated but unenforced rights. CONTRACT AND VENDOR IMPLICATIONS: Netflix's data processors must be contractually required to cooperate with data subject rights requests, including deletion and portability. Vendor agreements should specify response timelines consistent with Netflix's stated obligations under applicable law. COMPLIANCE CONSIDERATIONS: Compliance teams should audit the technical implementation of data subject rights request workflows to confirm they meet statutory timelines (45 days under CPRA, one month under GDPR). The appeals process for US state law rights requests should be documented and tested. Identity verification procedures for rights requests should be reviewed to ensure they do not create excessive barriers that would effectively deny rights.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision operationalizes Netflix's compliance with regional privacy regulations by establishing a framework through which users can exercise legally recognized data rights. The provision conditions the availability of these rights on jurisdiction, reflecting Netflix's obligation to align its privacy practices with applicable regulatory requirements in different markets.
Your privacy rights under this policy depend heavily on where you live. EU residents have comprehensive GDPR rights, California residents have CPRA rights including opt-out of data sale, while users in many other countries may have more limited practical rights. You can exercise your rights by visiting your account settings or contacting privacy@netflix.com.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Netflix.