Florida Attorney General James Uthmeier filed a 66-page complaint against Netflix on September 9, 2026, alleging the streaming company spent years telling subscribers it would never build an advertising business while assembling the behavioural logging infrastructure that now underpins one, and then routed the resulting data to identity vendors, data brokers and programmatic buying platforms without the consent Florida law requires.

In Short

Florida's top law enforcement officer is taking Netflix to court, saying the company promised for years that paying a subscription meant no ads and no data harvesting, then reversed both. The state says Netflix kept logging what adults and children watched, paused and searched the whole time, and later opened that record to advertisers, data brokers and ad tech platforms without telling anyone clearly. If the state wins, Netflix could be ordered to delete the data, stop using anything built from it, and pay penalties that multiply for every child involved.

A second state action on the same evidentiary spine

The filing, stamped at 09:11:37 on September 9, 2026 and lodged in the Circuit Court of the Seventh Judicial Circuit in and for St. Johns County, brings five counts. Four arise under the Florida Deceptive and Unfair Trade Practices Act, Sections 501.201 to 501.213 of the Florida Statutes. The fifth, and the one with no equivalent in the earlier Texas action, arises under Section 501.715 of the Florida Digital Bill of Rights, which bars the sale of sensitive personal data without prior consent.

That structural difference matters. Texas Attorney General Ken Paxton sued Netflix on May 11, 2026 in Collin County on a near-identical factual record, but pleaded the case entirely under a deceptive trade practices statute. Florida pleads deception and then adds a standalone privacy count with its own penalty schedule. The Attorney General is represented by the Consumer Protection Division under director Victoria Ann Butler, with Norton Rose Fulbright US LLP appearing as outside counsel from offices in San Antonio, Houston and Austin.

The complaint opens on a proposition rather than a statute. Netflix, it argues, sold the idea that a monthly fee bought escape from behavioural surveillance, and Floridians generated years of data inside that understanding.

The statement record from 2015 to 2020

The state reconstructs Netflix's public positioning from shareholder letters, earnings call transcripts and recorded conference appearances. In 2015, then-chief executive Reed Hastings said there was no advertising coming to Netflix, and added the word "Period." A January 19, 2016 shareholder letter stated that the business model was not dependent on advertising or affiliate fees. On a January 2018 earnings call, Hastings described the absence of advertising as "a core differentiator."

The most pointed material comes from the fourth-quarter 2019 earnings call held on January 21, 2020. Asked directly by a Guggenheim Securities analyst whether Netflix avoided collecting significant personal data for ad targeting, Hastings replied: "We don't collect anything." He went on to describe Netflix as a refuge from what he called the controversy around exploiting users with advertising. A July 17, 2019 shareholder letter told investors that any suggestion the company was moving into selling advertising was false, and called that position part of the brand proposition.

Todd Yellin, then vice president of product development, supplied the framing the complaint returns to repeatedly. In an April 1, 2016 appearance, Yellin described Google and Facebook staff as "serving two masters," the consumer and the advertiser, and characterised the split as a conflict.

What the logging figures show

Against that record the state sets what Netflix engineers described at industry events. At AWS re:Invent in October 2015, the company put its logging volume at 550 billion events per day, peaking at 8.5 million events and 21 gigabytes per second, exceeding one petabyte daily and spanning hundreds of event types. A separate 2016 presentation by engineer Peter Bakas contains the line the complaint uses as a section heading: Netflix as "a logging company that occasionally streams movies."

The scale has grown. Citing a ClickHouse engineering post dated October 23, 2025, the complaint states that Netflix now collects roughly five petabytes of user-behaviour logs per day, processes more than 10 million events per second, and feeds more than 40,000 internal microservices. The event taxonomy set out in the filing covers watch time and title, location, device, search terms and search frequency, pause and rewind behaviour, screenshots of paused moments, abandonment timestamps and rates, scroll and browse patterns, completion behaviour and content ratings.

A 2013 Netflix engineering blog post, cited in the complaint, describes that granular data as aggregated to provide base data for the company's algorithms. The state reads that as model training.

Kids profiles and the distinction the state calls a half-truth

The children's allegations turn on a narrow semantic point with wide consequences. Netflix states in its Help Center that it does not engage in behavioural advertising on kids profiles, and, according to the complaint, uses that statement to withhold the behavioural-ads opt-out from those profiles entirely.

The state does not dispute the literal claim. It argues the claim answers a question parents were not asking. Whether an advertisement is served is separate from whether the behavioural data needed to profile a child is collected in the first place, and on the second question the filing alleges Netflix says nothing. Children on kids profiles, it contends, pass through the same telemetry and logging systems as adults, systems a Netflix vice president, Max Schmeiser, described in a June 19, 2024 conference address as designed for "generating rich insights." The complaint notes in a footnote that videos on Netflix's data engineering YouTube channel appear to have been made private.

Onboarding design carries part of the claim. Step two of a six-step account setup describes the service as "Great for kids." Step three asks whether there will be any kids watching and describes a separate space with parental controls. A March 23, 2022 post stated that kids profiles are intended for ages 12 and under. A July 14, 2025 page for Netflix Playground, a games library for children aged eight and younger, emphasises that the environment carries no ads while, according to the complaint, saying nothing about what is collected there.

Autoplay as the mechanism, not the symptom

Count IV pleads addictive design. Autoplay is the centrepiece, and the complaint treats it as a dark pattern in the technical sense rather than as a convenience feature that went too far: a design choice that removes the natural stopping cue and transfers the decision to continue away from the viewer.

The setting is on by default across every profile type, including profiles built for children under 12. The ability to disable preview autoplay was not added until 2020. Research cited in the filing, including a paper by Brennan Schaffner and colleagues published in the Proceedings of the ACM on Human-Computer Interaction in May 2025, is used to support two propositions: that autoplay reduces user autonomy and increases mindless viewing as sessions lengthen, and that viewers who disable it report making more deliberate choices. An expert report by Anna Lembke, filed in the social media addiction multidistrict litigation in May 2025, supplies the developmental argument about impulse control in minors.

The state links the design directly to the commercial outcome. Every additional minute of viewing is an additional minute of event generation. The complaint reproduces a Netflix Ads marketing asset stating that members are more attentive three hours into watching than when they start, and treats it as evidence that extended sessions are sold as an advertising benefit.

Two further design allegations sit alongside autoplay. Netflix offers Californians an account-level control to disable data sharing but, according to the complaint, requires Floridians to disable it profile by profile. Cancellation flows are alleged to use obstruction.

The advertising stack, named partner by partner

The technical core of the complaint is its account of where Netflix data goes after November 2022. The filing describes Enhanced Data Capabilities inside the Netflix Ads Suite, under which advertisers bring first-party records through LiveRamp or directly to Netflix for matching against the Netflix ads audience. Third-party data access has been opened to Experian and Acxiom, both of which the complaint characterises as commercial data broker businesses with no connection to streaming.

A clean room layer sits above that, supporting collaboration from planning through activation to measurement. Targeting is sold against more than 100 interests in over 17 categories, life stages included. Advertiser-facing materials quoted in the filing describe segments for education level, marital status, household income bands running from under $75,000 to $250,000 or more, and household composition categories separating single residents, couples without children, families with children and empty nesters.

Programmatic distribution is traced year by year. Netflix opened buying through Google Display & Video 360 and The Trade Desk in May 2024, added Yahoo DSP as its fourth global programmatic partner on June 16, 2025, and opened inventory to Amazon DSP buyers in an announcement dated September 10, 2025. The complaint describes a demand-side platform not as a delivery pipe but as a profiling hub, and cites Netflix's own description of Amazon Audiences as built from trillions of proprietary shopping, streaming and browsing signals, and of Yahoo DSP audiences as drawing on hundreds of millions of interest, behavioural, purchase and life stage signals.

The Netflix Conversion API receives its own treatment. Netflix set out the product in a March 4, 2026 post alongside the expanded Amazon and Yahoo audience integrations, describing it as a route for advertisers to prove outcomes and optimise campaigns in real time. The state translates that as a system for processing events generated on non-Netflix properties, which is to say tracking that extends past the boundary of the service.

Measurement forms the last layer. Netflix has partnered with more than 50 global ad measurement vendors, according to a November 5, 2025 company post cited in the filing. The complaint also takes issue with Monthly Active Viewers, the metric Netflix adopted for audience counting, which multiplies members who watched at least one minute of ads in a month by an estimated average household size derived from Netflix first-party research. Household-level modelling, the state argues, is explained plainly to advertisers and never to subscribers.

The privacy policy timeline

Four dates carry the disclosure argument. The November 1, 2022 privacy statement acknowledged advertising and introduced high-level terms but, according to the complaint, omitted the scope of first-party behavioural logging and the identity of recipients. The April 17, 2024 statement added named event types including playback events, app clicks, text input, and time and duration, a change the state ties to the Dutch Data Protection Authority investigation; that regulator imposed a 4.75 million euro fine on Netflix on December 18, 2024 over transparency failures between 2018 and 2020. By April 2025, the statement separated advertising-related processing from the ad-supported tier, which the complaint reads as an unstated admission that data from subscribers paying for ad-free plans also feeds the advertising operation.

A footnote records a further gap: choices made inside interactive titles were not disclosed until 2024, though the complaint places collection as early as the 2018 release of Bandersnatch.

Jurisdiction built on physical infrastructure

The filing spends considerable space establishing Florida contacts, and the reasoning is worth noting for any platform operating content delivery hardware across state lines. Netflix places Open Connect Appliances inside Florida internet service provider networks and at internet exchange points, with the complaint citing Netflix peering documentation listing Tampa and Miami. Those appliances store content in Florida and deliver it to Floridians. Netflix monitors them, configures them remotely, controls what they store and retains the ability to erase them.

A tax detail does additional work. In 2024, Netflix began charging Florida subscribers an additional 5.07% attributable to the state Communications Services Tax. The state uses that as proof Netflix identifies Florida residents individually, calculates a state-specific charge, and remits it, rather than operating a passive national website.

Relief sought and the penalty arithmetic

The prayer for relief asks the court to order Netflix to purge all data deceptively collected from Floridians, to stop using any data gathered during the period when it promised not to collect and integrate data, and to cease use of any advertising stack, algorithm or process trained on, designed using, tested on or built from that data. It asks for an end to sensitive behavioural data collection through kids profiles absent full disclosure, permanent deletion of behavioural data already collected through them, and an end to dark-pattern interfaces.

The monetary exposure has four tiers. Civil penalties of up to $10,000 per willful FDUTPA violation under Section 501.2075. Up to $15,000 per violation where a senior citizen was victimised, under Section 501.2077. Up to $50,000 per violation of the Florida Digital Bill of Rights under Section 501.72. Treble penalties for Digital Bill of Rights violations involving known children. The complaint also alleges Netflix failed to post the statutory notice that a website may sell sensitive personal data.

Netflix had not responded publicly to the complaint at the time of writing. The allegations are untested.

Why this matters for the marketing community

The mechanisms described in the complaint are not Netflix inventions. Identity onboarding through LiveRamp, enrichment via Experian and Acxiom, clean-room collaboration, programmatic distribution through four or five DSPs, and household-level reach modelling are the standard construction of a modern connected TV advertising business. A ruling that any of them constitutes a sale of sensitive personal data when the consumer-facing disclosure is generic would land on a much wider set of sellers than one streaming service.

The commercial stakes are visible in the numbers Netflix reports. Second-quarter 2026 revenue reached $12.56 billion, with the advertising business held to a roughly $3 billion target for the year, close to double the approximately $1.5 billion recorded in 2025. The 2026 upfront on May 13 put ad-plan reach at 250 million global monthly active viewers, the figure that The Trade Desk cited when it folded Netflix into its open marketplace on July 20, 2026 with no minimum spend. Buyers reaching that inventory through an always-on marketplace are transacting against the same identity infrastructure now under examination in two states.

State enforcement against television-adjacent data collection has been accumulating. Texas sued Hisense in December 2025 over automatic content recognition consent design affecting 1.27 million residents. California reached a $2.75 million settlement with Disney in February 2026 over streaming privacy controls. The Florida complaint adds a fourth jurisdiction to a pattern in which the contested conduct is not the advertisement but the plumbing beneath it.

For media buyers, the practical question is documentary rather than legal. If a court accepts that advertiser-facing capability decks and consumer-facing privacy statements must describe the same system in compatible terms, the gap between those two documents becomes a compliance artefact rather than a marketing convention. Netflix's materials are quoted at length in the complaint precisely because they are detailed. Detail offered to buyers and withheld from subscribers is the asymmetry the case is built on.

Timeline

Summary

Who: The Office of the Attorney General, State of Florida, Department of Legal Affairs, under Attorney General James Uthmeier, with the Consumer Protection Division and outside counsel Norton Rose Fulbright US LLP, against Netflix, Inc., a Delaware corporation headquartered in Los Gatos, California.

What: A five-count complaint alleging deceptive commercialisation of user data for advertising, misrepresentation of kids profiles, misrepresentation about surveillance advertising and tracking, dark patterns and addictive platform design, and the sale of sensitive personal data to advertising partners without consent. Counts I through IV arise under the Florida Deceptive and Unfair Trade Practices Act; Count V arises under Section 501.715 of the Florida Digital Bill of Rights.

When: Filed September 9, 2026. The conduct alleged runs from 2015, when Netflix executives began making explicit anti-advertising statements, through the advertising business that began in November 2022 and the product capabilities described in company posts dated March 4, 2026.

Where: The Circuit Court of the Seventh Judicial Circuit in and for St. Johns County, Florida. Jurisdiction rests in part on Open Connect content delivery hardware installed in Florida internet service provider facilities and internet exchange points in Tampa and Miami, and on a Florida-specific 5.07% Communications Services Tax charge applied to subscriptions from 2024.

Why: The state argues that Netflix accumulated behavioural data under representations that it would never collect or monetise it, then deployed that data through identity matching, third-party enrichment, clean-room collaboration and programmatic distribution while consumer-facing disclosures described none of it. Relief sought includes data deletion, a ban on advertising systems trained on the disputed data, and civil penalties reaching $50,000 per violation under the Digital Bill of Rights, trebled where known children are involved.