Netflix built its reputation as the alternative to television advertising.
You paid the subscription. You watched the shows. There were no commercials interrupting the movie and, according to statements cited by Florida regulators, none of the advertising surveillance commonly associated with the rest of the internet.
Florida Attorney General James Uthmeier now says the reality was very different.
In a sweeping lawsuit filed September 9, 2026, the State of Florida accuses Netflix of spending years collecting detailed information about how subscribers and their children used the service while publicly portraying itself as a refuge from the data-driven advertising businesses operated by other technology companies.
The allegations go well beyond ordinary analytics.
Florida says Netflix recorded what subscribers watched, searched for, paused, rewound, skipped and abandoned, along with information about devices and locations. The complaint places particular emphasis on Kids Profiles, which Netflix designed for children age 12 and younger.
The state alleges that Netflix collected children’s viewing behavior through much of the same underlying data infrastructure used for adults, even while telling parents that behavioral advertising was not used on Kids Profiles.
Netflix denies the allegations.
“Netflix takes our members’ privacy seriously,” the company said in a statement reported by multiple news organizations. Netflix said it complies with privacy and data-protection laws, maintains dedicated protections for children and intends to vigorously defend the lawsuit.
The case is now poised to test something privacy professionals have been discussing for years: at what point does product analytics become behavioral surveillance, particularly when the person being analyzed is a child?
Florida Calls It a Years-Long Bait-and-Switch
The complaint is built partly around Netflix’s own historical statements.
For years, Netflix positioned its subscription model against advertising-supported internet platforms.
The Florida lawsuit cites statements from Netflix leadership saying the company did not want to build the type of advertising business associated with companies such as Google and Facebook.
Former Netflix CEO Reed Hastings was particularly direct about the distinction.
According to the complaint, Hastings said in 2020 that Netflix was not integrating everyone’s data and said, “We don’t collect anything.”
He described Netflix as a place where consumers could relax without the controversy surrounding advertising and exploitation of user information.
That history is important because Florida’s case is not simply arguing that Netflix collects data.
The state is arguing that Netflix collected data after creating a particular expectation about what paying customers were buying.
Florida’s theory is essentially that Netflix told customers they were paying to avoid the surveillance-advertising model while simultaneously building the behavioral-data infrastructure that could later support such a model.
Netflix launched its ad-supported subscription tier in November 2022.
Florida contends that the years of behavioral information accumulated before and after that transition became commercially useful once Netflix entered advertising.
What Does Netflix Allegedly Know About a Viewer?
A streaming service obviously needs some information to operate.
If Netflix did not know what episode a subscriber was watching, it could not resume playback tomorrow. If it did not understand which device was connected, it could not reliably deliver the video.
The dispute is about scale, purpose and disclosure.
According to Florida’s complaint, Netflix records billions of behavioral events involving its users.
The state alleges that the information can include what content someone watches, what they search for, when they stop watching, what they rewind, what they skip, what they abandon, what devices they use and information about where those devices are being used.
Those individual events may look mundane.
Together they can create an unusually detailed behavioral history.
Consider what someone’s streaming history might reveal.
A person repeatedly watching programs about pregnancy, addiction, cancer treatment, religion, sexuality, divorce, immigration or financial problems may be sending signals about interests or circumstances they never explicitly disclosed to the streaming company.
For adults, that creates familiar questions about profiling.
For children, Florida argues the concern is considerably greater.
Kids Profiles Are at the Center of the Case
Netflix encourages parents to create dedicated profiles for children.
The platform has described these as a child’s “own space” and markets Kids Profiles as appropriate for children 12 and under.
Netflix also says that it does not engage in behavioral advertising on Kids Profiles.
Florida calls that assurance incomplete.
The state’s complaint alleges that Netflix still gathers and analyzes children’s viewing behavior through telemetry systems that also operate elsewhere on the platform.
That distinction is likely to become a major issue in the litigation.
Not serving a personalized advertisement directly to a child is not necessarily the same thing as not collecting behavioral information about the child.
A company could theoretically collect extensive behavioral data for recommendation systems, product optimization, audience analysis or other purposes without displaying a targeted advertisement inside the child’s account.
Whether Netflix’s practices violated Florida law will ultimately depend on the actual data flows, the purposes for which the information was processed, what was disclosed to parents, whether information legally considered sensitive data was sold, and what authorization was obtained.
Those facts remain allegations at this stage of the case.
The Florida Digital Bill of Rights Makes Children’s Data Particularly Important
Florida is not relying only on general consumer-protection law.
The lawsuit also invokes the Florida Digital Bill of Rights, the state’s comprehensive privacy statute.
Under Florida law, personal data collected from a known child is treated as sensitive data.
The law restricts the sale of sensitive personal information without the required consent or authorization.
For a known child under 13, the statute points to the parental authorization framework established by the federal Children’s Online Privacy Protection Act, commonly known as COPPA. Florida separately addresses authorization involving known children between ages 13 and 18.
This gives Florida’s case a more direct privacy-law theory than simply alleging that consumers misunderstood a marketing statement.
The state alleges Netflix sold sensitive personal information involving known children without obtaining the authorization Florida law requires.
Netflix disputes that it violated privacy law.
The Penalties Could Become Enormous
The numbers attached to the Florida Digital Bill of Rights explain why the lawsuit deserves attention from companies far beyond Netflix.
The Florida Attorney General can seek civil penalties of up to $50,000 per violation for violations of the state’s privacy law.
Florida law also allows those penalties to be tripled for certain violations, including violations involving a Florida consumer who is a known child.
That does not mean Netflix automatically owes $150,000 for every child or every data event. Courts still have to determine whether violations occurred and how any applicable penalty should be calculated.
But it explains how a privacy dispute involving a platform operating at Netflix’s scale can quickly move from millions of dollars into potentially extraordinary numbers.
Uthmeier has said Florida is seeking billions of dollars in the case.
The much larger issue for privacy teams is the concept of a violation occurring at scale.
A faulty data practice affecting one customer may create a manageable compliance problem.
The same code running automatically across millions of accounts can produce an entirely different risk calculation.
Autoplay Is Now Part of a Privacy Lawsuit
One of the most unusual parts of Florida’s complaint involves a feature almost every Netflix subscriber recognizes: autoplay.
When an episode ends, Netflix can automatically begin the next one rather than requiring the viewer to make another conscious selection.
Florida characterizes autoplay as a “dark pattern” designed to eliminate stopping cues, extend viewing sessions and keep users engaged.
The state is particularly critical of its use with children.
The complaint links product design directly to data collection. More viewing creates more interactions. More interactions generate more behavioral information. More behavioral information improves the company’s ability to understand what keeps a particular viewer engaged.
That creates a feedback loop:
- A user watches.
- The system measures the behavior.
- The algorithm learns what the user prefers.
- The platform recommends additional content.
- The user watches longer.
- More behavioral information is generated.
Florida alleges that autoplay helps drive that cycle, including for children.
Netflix says parents have controls available to disable autoplay and manage children’s viewing.
The legal question is not simply whether autoplay exists. Courts may have to consider whether the design and disclosures surrounding the feature were deceptive or unfair under Florida law.
The Case Blurs the Line Between Product Personalization and Advertising
This is where the Netflix lawsuit becomes useful even for companies that do not sell advertising.
Modern digital products learn from users constantly.
Streaming companies recommend movies. Ecommerce sites recommend products. Music apps build playlists. News sites decide which articles to surface. SaaS products measure how customers interact with features.
Much of this is commonly described as personalization or product analytics.
But a behavioral dataset created for one reason can become useful for another.
A recommendation engine needs to understand what someone likes.
An advertising system also wants to understand what someone likes.
The underlying behavioral intelligence can therefore have value outside the original user experience.
Florida’s allegations against Netflix raise the question of whether companies adequately explain that transition when data collected to operate or personalize a service later becomes connected to an advertising ecosystem.
Netflix’s Advertising Business Changed the Equation
After Netflix launched advertising in November 2022, the company began building a much more conventional advertising technology operation.
Florida alleges that Netflix connected its first-party subscriber information with advertising and data companies that allow audiences to be matched, segmented and measured.
The complaint identifies relationships involving advertising technology providers and data companies that can help advertisers target or measure audiences based on characteristics such as household composition, income or life stage.
This does not necessarily mean an advertiser receives a spreadsheet containing an identifiable Netflix subscriber’s complete viewing history.
Digital advertising data flows are considerably more complicated than that.
But privacy law does not look only at whether a company hands another business someone’s name and viewing log.
Identifiers, audience matching, pseudonymous records and other forms of data exchange can still fall within statutory definitions of selling or processing personal data.
That is one reason companies need to understand exactly how their advertising integrations work instead of relying on the assumption that hashing an identifier or using an intermediary automatically makes the information anonymous.
Privacy Statements Are Becoming Evidence
There is another lesson buried in Florida’s lawsuit.
Statements companies make about privacy can follow them for years.
Marketing copy, investor statements, help-center articles, privacy notices, interviews and product pages can eventually become evidence in a regulatory investigation.
A statement made when a business has one revenue model can become problematic after the business changes direction.
Netflix may ultimately convince the court that its statements were accurate in context, that its data practices were properly disclosed or that Florida is characterizing technical systems incorrectly.
But the lawsuit shows why privacy claims deserve the same internal review as other substantive product claims.
“We don’t sell your data.”
“We don’t track children.”
“Your information stays private.”
“We don’t use behavioral advertising.”
Those sentences may look simple on a webpage.
They can become much more complicated when engineers, advertising teams and lawyers are asked years later to explain exactly what they meant.
A Privacy Program Has to Follow the Product When the Business Model Changes
Netflix also presents a problem common to fast-growing technology companies.
Products evolve.
Revenue models evolve.
Data collected for one purpose becomes useful for another.
A company might launch without advertisements and add them five years later. A SaaS platform might introduce an AI assistant. An ecommerce company might launch a retail media network. A mobile application might begin licensing audience insights.
Each business change can alter the privacy consequences of data that already exists.
A consent architecture designed for yesterday’s product may no longer fit today’s processing.
That is why privacy reviews should not happen only when a privacy policy is first written.
They should happen when the business model changes.
Children’s Privacy Is Becoming an Enforcement Priority
The Netflix action also fits a much broader enforcement trend.
Regulators are increasingly scrutinizing how online services identify children, collect their information, design interfaces for younger users and use behavioral information generated by minors.
Florida has been particularly aggressive.
Uthmeier’s office has pursued or investigated other major technology platforms over child safety, privacy and product-design issues.
For companies offering a product that children can realistically use, simply stating in terms of service that the product is “not intended for children” may not resolve the issue if the company actually knows children are present.
Netflix’s Kids Profiles make the knowledge question especially straightforward: the product itself is expressly designed to identify a profile as belonging to a child.
That makes what happens to data generated inside that profile much more consequential.
What Privacy Teams Should Take From the Netflix Case
The case has not been decided, and Florida’s allegations should not be confused with judicial findings.
But organizations do not have to wait for a verdict to examine the underlying compliance questions.
Companies should be able to answer:
- What behavioral events do our products collect?
- Do we know when a user is a child?
- Does data collected from children enter the same analytics systems used for adults?
- Which information is considered sensitive under applicable state privacy laws?
- Are we obtaining the required consent before processing or selling sensitive information?
- What information leaves our systems and reaches advertising partners, data brokers or other third parties?
- Do our privacy statements accurately describe those flows?
- Have our data practices changed since those statements were written?
- Are engagement features creating additional privacy risk for children?
- Can we prove what consent or authorization existed when the data was collected?
Those questions require more than a privacy policy.
They require an inventory of the technology actually operating inside a product and an understanding of where personal information travels after it is collected.
The Netflix Case Is Really About the Gap Between What Users See and What Systems Do
To a parent, a Netflix Kids Profile looks simple.
There are cartoons, colorful icons and controls intended to make the experience more appropriate for children.
Behind that interface can sit recommendation engines, logging infrastructure, device identifiers, analytics systems, experimentation tools and advertising technology.
That difference between the visible product and the invisible data architecture is where many modern privacy disputes begin.
Users make decisions based on what they can see and what companies tell them.
Regulators increasingly want to know what happened behind the screen.
Florida’s Netflix lawsuit will now test whether there was a meaningful gap between those two worlds.
The state says Netflix promised families an escape from surveillance while quietly building one of the largest behavioral datasets in entertainment.
Netflix says that characterization is wrong, that it complies with privacy law and that it has appropriate safeguards for children.
The court will decide the legal dispute.
For every other company collecting behavioral information, however, the warning is already fairly clear: what your interface says, what your privacy notice promises and what your code actually does need to tell the same story.