Plex GmbH, the company that operates the Plex media server and streaming platform used by millions of subscribers to organize and stream their personal media libraries and access licensed streaming content, was charged with selling subscriber viewing history and engagement data to advertising partners without adequately disclosing this data use to subscribers — who believed their viewing histories were private personal records rather than commercial data assets that the platform was monetizing through sale to third parties.DOCUMENTED
Viewing history data — information about what television shows, films, and other content a person watches, when they watch it, how long they spend on specific content, and what they abandon before completing — is a particularly sensitive category of behavioral data because it reveals the user's interests, leisure choices, potential political or social views, and personal circumstances in ways that are not immediately apparent from the fact of data collection. A record of what someone watches contains information about them that they have not explicitly chosen to share and that many users would not knowingly provide to advertising partners.REVIEWED
- Plex sold subscriber viewing data to advertising technology partners who used it for targeted advertising purposes outside the Plex platform
- Plex's privacy communications did not adequately disclose that viewing history would be sold to third-party advertising partners for use in targeting advertising
- The data included granular viewing details sufficient to build detailed individual interest and behavioral profiles
- Subscribers who had paid for Plex's ad-free subscription tiers believed their data was not being used for advertising purposes — an expectation the data sale undermined
- Required remediation included deletion of viewing data previously shared with advertising partners and clear disclosure of any future data uses involving subscriber viewing history
The Privacy Expectation for Streaming Platforms
Subscribers to streaming platforms generally understand that their viewing data may be used internally by the platform — to improve recommendations, to understand which content performs well, and to personalize the user experience. What most subscribers do not understand, unless specifically told, is that their viewing history may be sold to external advertising technology companies who will use it to target advertising on entirely different platforms and services. The distinction between internal data use and external data sale is material to the privacy expectation most users hold when they use a streaming platform.REVIEWED
Plex's privacy communications described how subscriber data was used without making sufficiently clear that viewing history was being sold to third parties for advertising purposes outside the platform. Regulators found that the disclosure of this data use was not presented with the prominence and clarity that consumers relying on the platform's privacy communications would need to understand that their viewing history was being commercialized through third-party sale rather than retained internally for platform improvement purposes.DOCUMENTED
The Paid Subscriber Expectation
Plex offers both free and paid subscription tiers. Subscribers who paid for premium tiers — which offered features including ad-free viewing within the Plex platform — had a reasonable expectation that their experience with the platform was not subsidizing advertising targeting through the sale of their data. The paid subscription model implies a value exchange: the subscriber pays directly rather than through attention and data. When a paid platform sells subscriber data to advertising partners despite the subscriber having paid for the service, it collects value from both the subscriber payment and the data sale without clearly representing that the data sale was part of the bargain.DOCUMENTED
The paid subscriber situation is distinct from the expectations a consumer might have when using a free, ad-supported service. A user of a free service understands implicitly that data monetization may subsidize the service's availability. A subscriber who pays for premium features does not have the same implicit understanding that their behavioral data is being sold, and a platform that does not clearly disclose this practice to paying subscribers is not giving them the information they need to evaluate what they are actually getting for their payment.DOCUMENTED
Subscribers who paid for Plex's ad-free tier to avoid advertising found that their viewing history was being sold to advertising partners anyway — the ad-free experience was on the Plex platform, but the data commercialization reached well beyond it.
Settlement Requirements
The settlement requires Plex to delete viewing history data that was shared with advertising partners without adequate disclosure during the covered period, to implement clear and prominent disclosure of any future data uses involving subscriber viewing history before that data use begins, and to obtain affirmative consent from subscribers before using their viewing history for advertising purposes beyond Plex's own platform. Plex must also implement a data use review process that assesses whether any new data commercialization activity requires enhanced disclosure or consent before implementation.DOCUMENTED
Subscribers who used Plex during the covered period and who are concerned about how their viewing data was used should review Plex's updated privacy policy and the settlement's data deletion confirmation process. Streaming platform subscribers more broadly should review the privacy policies of each service they use — specifically looking for language about data sharing with advertising partners, third-party data sales, and whether data use is restricted to internal purposes versus external commercial data sales. The variation in privacy practices across streaming platforms is substantial, and informed subscription decisions require understanding those variations.REVIEWED
Reviewing Your Streaming Platform Privacy Settings
Streaming platform subscribers who want to reduce the commercial use of their viewing data should review the privacy settings available in each platform they use. Most major streaming services provide some level of control over data use for advertising — typically in the account privacy settings section — that allows subscribers to opt out of interest-based advertising that uses their viewing history. The effectiveness and completeness of these opt-outs varies by platform, and opting out of interest-based advertising within a platform may not prevent the platform from selling viewing data to third-party data brokers for use outside the platform. Consumers who want to understand more specifically how a platform uses their data should request a copy of their data through any applicable data rights mechanism — California residents have specific rights to access and delete personal data held by companies under the California Consumer Privacy Act, and similar rights exist in other states with comprehensive privacy legislation. Filing a complaint with state privacy enforcement agencies when a platform's data practices are inconsistent with its privacy policy is an appropriate response to discovered discrepancies between stated and actual data use practices.
Sources behind this report
Have documents relevant to this story? Reach us through our tips channel.