You’re Still the Product, Even When You Pay
Streaming services spent years positioning themselves as the ethical alternative to broadcast TV. No commercials. No advertiser influence over programming. Just you and the content.
That framing became significantly harder to sustain when Netflix launched its ad-supported tier, when Disney+ followed, and when Texas filed a lawsuit accusing Netflix of tracking and selling subscriber data to advertisers — including on plans that didn’t show ads.
The reality is that streaming platforms know a remarkable amount about their subscribers, and increasingly they are monetizing that knowledge. The content may be what you pay for. The data is what the platform profits from additionally.
This post breaks down exactly what streaming services collect, how they use it, what the recent legal and regulatory actions mean, and what you can actually do to limit your exposure.
What Streaming Platforms Collect
Every interaction on a streaming platform generates data. The obvious category is viewing history — what you watch, when you watch it, for how long, and whether you finish. But the data collection is considerably broader than what you’d expect.
Viewing behavior: Not just what you watch, but how you watch it. Do you skip intros? Rewind? Watch with subtitles? Leave something running in the background and then stop paying attention? Streaming platforms can distinguish genuine engagement from passive background viewing with significant precision.
Search and browse history: Every title you searched for, every category you browsed, every title you hovered over but didn’t click. The content you almost chose is often as revealing as the content you did choose.
Device and technical data: What device you’re watching on, your IP address, device identifiers, network type, and location data derived from your IP.
Payment and account data: Billing address, payment method type, and in some cases demographic data associated with your payment profile.
Cross-platform tracking: If you’ve signed in to a streaming service through a smart TV, the platform may receive additional viewing data from the TV’s own ACR (automatic content recognition) system, layered on top of their own data.
Put this together across years of subscription and streaming platforms have a detailed behavioral profile of you — your sleep schedule, your anxiety levels (inferred from what you binge when you’re stressed), your political sympathies, your relationship status, and dozens of other dimensions that can be inferred from viewing patterns.
The Netflix Texas Lawsuit
In early 2026, the state of Texas sued Netflix, alleging the company tracked detailed viewing behavior and shared it with advertising technology partners — including on plans that did not display advertisements.
The lawsuit claimed Netflix designed engagement features specifically intended to maximize viewing time, collecting and monetizing the resulting behavioral data from subscribers who had paid under an implicit expectation of privacy.
Netflix denied the allegations and stated it complies with applicable privacy laws.
Separately, in late 2024, the Dutch Data Protection Authority fined Netflix €4.75 million after a five-year investigation found the company had failed to clearly disclose to subscribers what data it collects, who receives it, and why.
The fine and the Texas lawsuit reflect a broader pattern: streaming platforms grew rapidly under privacy terms that were technically disclosed but practically unreadable, and regulators and prosecutors are now applying pressure.
Disney+ Scored an F
Independent privacy analysis firms regularly audit consumer apps and services. Disney+ received a privacy score of 28 out of 100 — a grade of F — in a widely cited audit. Netflix scored 38 out of 100, a grade of D.
These scores reflect factors like clarity of privacy disclosures, how much data is collected, how broadly it’s shared, what user controls exist, and how deletion requests are handled.
The general finding across the streaming sector: privacy disclosures are long, complex, and written in legal language that the average subscriber will not read. Data is shared with advertising technology partners, analytics vendors, and in some cases data brokers. User controls to limit this are buried or ineffective.
Ad-Supported Tiers Are Not Just Cheaper
When Netflix and Disney+ launched their ad-supported tiers, many subscribers assumed the ad revenue was the trade-off. You pay less, you watch some ads, the economics balance out.
The actual model is more layered. Ad-supported tiers also enable the platform to build richer advertiser targeting profiles, because the fact that you’re seeing an ad gives the platform a business reason to share your data with the advertiser serving that ad. The ad you see is chosen based on your profile; that choice itself generates more data.
This doesn’t make ad-supported tiers categorically wrong — for many users the price difference is worth it. But it does mean the data implications of the ad-supported tier are larger than the no-ads tier, not just the same.
Sharing Your Watch History With Third Parties
What data leaves the streaming platform? It depends on the platform and the user’s settings, but the general categories include:
Advertising technology partners: Platforms share behavioral data with ad networks to enable targeting, even on platforms where you’re not seeing ads — because these ad tech networks also operate outside the platform.
Analytics vendors: Third-party analytics services receive data about engagement, feature usage, and user behavior. This data may be aggregated or individually identifiable depending on the contract and the vendor’s practices.
Content studios and distributors: Viewership data is shared with content creators and studios to inform licensing decisions and production choices. This is less of a privacy concern and more of an industry data flow, but it is data leaving the platform.
Data brokers: Some platforms have shared data with data brokers, who then combine it with data from other sources to build enriched profiles sold to insurers, employers, financial services firms, and others.
The Texas lawsuit against Netflix specifically alleged the last category — that Netflix data made its way to advertising and data broker ecosystems beyond what a subscriber would reasonably expect.
What the Settings Actually Do
Most major streaming platforms offer some version of a “do not sell my data” control, required by US state privacy laws including California’s CCPA and, for some platforms, similar laws in other states.
The important caveat: “do not sell” in legal terms is narrower than “do not share.” Platforms can continue sharing data with service providers, joint marketing partners, and in some interpretations, advertising technology companies, even after you’ve enabled the do-not-sell setting. The legal distinction between selling and sharing has been contested in several enforcement actions, and the practical effect of these toggles varies by platform.
That said, exercising these controls is still worth doing. At minimum it creates a documented record of your preference and limits the most straightforward forms of data monetization.
Netflix: Account settings → Privacy and data settings → opt out of sharing data for advertising and analytics. Also limit cross-device tracking in the same section.
Disney+: Account settings → Privacy Center → exercise your California and other state privacy rights. Note that non-US residents have different controls.
Amazon Prime Video: Privacy Settings → Advertising Preferences → adjust personalization settings. Also worth reviewing Alexa data settings if you use voice controls.
Hulu (owned by Disney): Privacy Policy settings page → do not sell/share opt-out for California residents.
Smart TVs Make This Worse
If you watch streaming services on a smart TV — which most people do — there’s a second data collection layer happening in parallel: the TV’s own ACR system.
ACR works by taking periodic screenshots of your screen (often 30 frames per second) and matching them against a reference database to identify what you’re watching. This happens regardless of which app or input you’re using — broadcast TV, streaming apps, game consoles, all of it.
This data is collected by the TV manufacturer (Samsung, LG, Vizio, Roku for Roku TVs) and often shared with advertisers and data brokers. It can be combined with your streaming platform data to build a complete picture of your viewing behavior across sources.
To disable ACR on smart TVs: Samsung (Settings → Support → Terms & Policies → Viewing Information Services → Off), LG (Settings → General → LivPlus → Off), Vizio (Menu → Settings → Privacy → Smart Interactivity → Off), Roku (Settings → Privacy → Advertising → Limit Ad Tracking).
These settings are not prominent, and manufacturers reset some of them after firmware updates, so they’re worth checking periodically.
The Household Profile Problem
Streaming platforms use profile systems so multiple household members can have separate viewing histories. The privacy risk is that the platform still sees everything on the account and can link profiles together.
If you’re using a shared household account, the platform knows not just your viewing history but also the patterns across everyone in the household — their ages, their sleep schedules, their content preferences. Combined with a single billing address and payment method, this gives the platform a detailed household-level profile.
The platforms’ household-level data is potentially more valuable to advertisers than individual profiles because it enables targeting at the level of a buying unit (the household) rather than an individual.
Why This Matters Beyond Just Ads
Most people think of data collection as a nuisance that leads to slightly creepy ads. The downstream risks extend further.
Health and life insurance companies have been documented using inferred health data in underwriting decisions. What you watch on streaming platforms — documentaries about specific medical conditions, content associated with depression or anxiety, late-night viewing patterns — can be used to infer health-relevant information. Whether this data makes its way from streaming platforms into insurance ecosystems is difficult to trace, but the data broker industry specifically exists to aggregate and resell data across industries.
Employers, credit issuers, and landlords also participate in data broker ecosystems. Behavioral data collected across streaming platforms, combined with data from other sources, can contribute to decisions about your employment prospects, creditworthiness, or housing eligibility.
This is not science fiction. It is the stated business model of data brokers, and it is the reason regulators across the EU and US states are applying increasing scrutiny to platforms that collect behavioral data at scale.
The Structural Answer
Ad-supported streaming has made sophisticated behavioral data collection the infrastructure underlying an industry. Opting out of individual settings helps at the margin. But the structural answer is to understand that data minimization — using fewer platforms, adjusting settings where they exist, and not treating your behavioral data as a free resource — is the only path to meaningful control.
For personal data you’ve deliberately created and want to keep private — documents, photos, notes, personal files — the lesson from streaming is to choose storage that doesn’t have a secondary data monetization model. The services built on advertising revenue have structural incentives that make genuine privacy difficult to sustain, regardless of what their settings offer at any given moment.
Services that charge straightforwardly for storage and make no money from your data — no ads, no data sales, no AI training on your content — have a different incentive structure. The business model is the privacy policy in practice.