What Happened
On May 12, 2026, Texas Attorney General Ken Paxton filed a lawsuit against Netflix, Inc. in Collin County state court near Dallas. The lawsuit β described by Texas officials as one of the most significant consumer privacy actions ever brought against a major streaming platform β accuses Netflix of building what the state calls a "surveillance program" that secretly collected and monetized billions of behavioral data points from Texan subscribers, including data generated by children's profiles.
The lawsuit was filed under the Texas Deceptive Trade Practices Act (DTPA) and alleges that Netflix misled consumers for years by publicly presenting itself as privacy-conscious and family-friendly while, behind the scenes, operating an extensive behavioral tracking and data-selling operation. According to the AG's complaint, every interaction a user had on the platform β every play, pause, rewind, skip, and search β was recorded as a monetizable data point.
Texas's complaint states that Netflix is "a logging company that records and monetizes billions of behavioral events β and occasionally streams movies." The state accuses Netflix of disclosing this data to commercial data brokers and advertising technology companies, where it was combined with data from other platforms to build detailed consumer profiles β without users' knowledge or consent.
What Netflix Is Accused Of β The Full Allegations
The lawsuit lays out a detailed set of allegations that go beyond simple data misuse. Here are the core claims Texas is making against Netflix:
Secretly Collecting Vast Behavioral Data
Netflix allegedly used "intentional engineering" to track and log users' viewing habits, preferences, devices, household network activity, and application usage. The complaint states that every interaction on the platform β every play, pause, skip, rewatch, and search β became a data point revealing detailed information about the user and their household.
Selling That Data to Advertisers and Brokers
Netflix allegedly disclosed the collected behavioral data to commercial data brokers and advertising technology companies. These third parties combined Netflix's data with information gathered from other platforms to build comprehensive consumer profiles β profiles then used for targeted advertising and other commercial purposes that users were never informed about.
Collecting Children's Data Without Protection
The complaint places significant emphasis on Netflix's treatment of children. Texas alleges that Netflix collected the same detailed behavioral data from kids' profiles as from adult accounts β despite marketing those kids' profiles as specially protected spaces. The state says Netflix falsely advertised kids' profiles as "specially designed to protect children," causing parents to hand their children the remote in the false belief that they were safe from data harvesting.
Using "Dark Patterns" to Addict Children
The lawsuit specifically targets Netflix's autoplay feature β which automatically streams the next episode without requiring any user action β as a deliberately engineered dark pattern designed to maximize screen time and generate additional behavioral data, particularly from children. The complaint states that autoplay was enabled by default on children's profiles, creating a continuous stream of content designed to keep kids watching.
Misleading Consumers About Data Practices
For years, Netflix allegedly represented to consumers that it did not collect or share extensive user data. Texas claims this was false β that Netflix was simultaneously telling users it was privacy-respecting while operating a comprehensive surveillance and monetization program. When Netflix shifted to an advertising-supported tier in 2022, Texas alleges the company adopted the same data harvesting practices it had once publicly criticized.
"Netflix's years-long bait-and-switch has led the company right to where it promised never to be: addicting children and families to its platform, mining those users for data, and then converting that data into lucrative intelligence for global advertising juggernauts."
β Texas Attorney General's Office, Complaint Filed in Collin County District Court, May 12, 2026What Texas Is Asking the Court to Do
The lawsuit is seeking several forms of relief from the court. If Texas prevails, Netflix could face:
A permanent injunction ordering Netflix to stop its alleged unlawful data collection and disclosure practices. This would be a structural change to how Netflix operates β not just a fine.
Civil penalties of up to $10,000 per violation under the Texas Deceptive Trade Practices Act. Given that the complaint describes data collection affecting potentially millions of Texas subscribers over years, the total exposure could be enormous.
A requirement to disable autoplay by default on children's profiles β a specific design change that would require Netflix to seek affirmative consent from parents before enabling continuous content streaming on kids' accounts.
Other injunctive relief restricting Netflix's future data collection and disclosure practices, as determined by the court.
Texas is also seeking a jury trial, signaling that the AG's office is committed to taking this case all the way through litigation if Netflix does not settle.
The Legal Framework: Texas DTPA vs. Texas TDPSA
It is worth noting what law Texas is using β and what law it is not using. The lawsuit is brought under the Texas Deceptive Trade Practices Act (DTPA), a longstanding consumer protection statute that prohibits deceptive acts and practices in commerce. It is not brought primarily under the newer Texas Data Privacy and Security Act (TDPSA), which took effect July 1, 2024.
This matters for several reasons. The DTPA is a well-established law with decades of case law behind it, and its penalties ($10,000 per violation) can be applied broadly to deceptive representations. By framing the case as consumer deception β Netflix telling users one thing about data privacy while doing another β Texas is able to invoke the DTPA's powerful remedies.
The TDPSA, while newer and more specifically focused on data privacy, would have its own separate set of requirements and remedies. The AG's choice to lead with the DTPA suggests Texas sees the deception angle β the gap between what Netflix told consumers and what it actually did β as its strongest legal argument.
Texas's comprehensive data privacy law, the TDPSA, gives all Texas consumers rights to access, correct, delete, and opt out of the sale of their personal data. Read our full analysis of the Texas Data Privacy and Security Act here. This lawsuit is a separate action under the consumer protection statute, but both laws reinforce the same principle: Texas consumers have rights over their data.
The Children's Privacy Dimension
A significant portion of the lawsuit focuses specifically on Netflix's treatment of children's data β and for good reason. Children's privacy protections are among the strictest in U.S. law, and the allegations here raise concerns that go beyond standard data misuse.
Federal law β specifically the Children's Online Privacy Protection Act (COPPA) β requires companies to obtain verifiable parental consent before collecting personal data from children under 13. If Netflix was tracking behavioral data from children's profiles and sharing it with data brokers without such consent, it may have violated COPPA in addition to Texas state law. The AG's complaint does not specifically invoke COPPA, but the underlying conduct described would be highly relevant to a federal COPPA analysis as well.
The autoplay allegation is particularly concerning from a children's privacy perspective. The complaint argues that autoplay was not just a user convenience feature but was deliberately engineered to generate additional behavioral data β meaning Netflix had an incentive to keep children watching not just for subscription retention but for data generation. This alleged alignment of financial incentives with addictive design targeted at children is at the core of what makes this lawsuit significant beyond the standard data privacy enforcement action.
If your children use Netflix, the data practices alleged in this lawsuit may have applied to their viewing behavior. Regardless of the outcome of this case, you can take steps now: disable autoplay on children's profiles (Settings β Account β Playback Settings), review your Netflix data and privacy settings, and consider submitting a data access or deletion request. Texas residents may use our opt-out guide to submit a formal data request to Netflix citing the TDPSA.
Context: A Pattern of Big-Tech Data Enforcement
This lawsuit does not exist in a vacuum. It is part of a broader, accelerating pattern of state-level enforcement against large technology companies for alleged data privacy violations.
FTC fines Facebook $5 Billion
The largest consumer protection penalty in FTC history β for violating a 2012 consent decree related to user data sharing with Cambridge Analytica and others.
Google/YouTube fined $170 Million (COPPA)
FTC and New York AG settlement over YouTube showing targeted ads to children in violation of COPPA β a direct precedent for the children's data dimension of the Netflix case.
California AG fines Sephora $1.2 Million (CCPA)
First major CCPA enforcement action β established that sharing data with advertising networks constitutes "sale" under California law, a principle directly relevant to Netflix's alleged data-sharing practices.
Epic Games (Fortnite) pays $520 Million
FTC settlement combining COPPA violations ($275M) with dark pattern penalties ($245M) β the largest-ever gaming privacy settlement and a direct precedent for the dark pattern allegations in the Netflix complaint.
Texas TDPSA Takes Effect
Texas's comprehensive data privacy law becomes enforceable β part of the broader legislative and enforcement environment that gave the AG's office new tools and context for this Netflix action.
Texas AG Sues Netflix
This lawsuit β filed in Collin County, Texas β represents the latest major state-level privacy enforcement action and the first significant streaming-platform-specific privacy case of this scale brought by a state AG.
What This Means for Netflix Users Everywhere
Even if you don't live in Texas, this lawsuit has implications for you as a Netflix subscriber β and as a consumer of any streaming service.
For Texas residents specifically: You have legal rights under the Texas Data Privacy and Security Act (TDPSA) that are directly relevant to the conduct alleged in this lawsuit. You have the right to know what personal data Netflix holds about you, the right to request deletion of that data, and the right to opt out of the sale of your personal data. Use our Texas privacy rights guide and opt-out tools to exercise these rights now.
For residents of California, Virginia, Colorado, and other privacy-law states: The same data practices alleged in this Texas lawsuit β behavioral tracking, sharing with data brokers, collecting children's data β are the exact categories of conduct your state's privacy laws are designed to address. You have actionable rights right now, regardless of whether your AG has filed a similar case.
For everyone: This case is a reminder that the streaming services, apps, and platforms you use daily are not passive entertainment providers. They are data businesses. The subscription you pay for may be, in part, subsidizing a data operation that monetizes your viewing habits and your children's behavior in ways you never consented to.
Are you a Texas resident? Exercise your rights now.
Use our free Opt-Out Guide to submit a data access or deletion request to Netflix and hundreds of other companies β with copy-paste templates citing the TDPSA.
What to Watch For
This lawsuit was filed on May 12, 2026. Netflix has not yet filed a formal response. Here are the key developments to watch as this case proceeds:
Netflix's initial response: Netflix is expected to file a response in Collin County court. The company has not yet issued a detailed public statement on the specific allegations. Watch for whether Netflix contests the factual allegations or focuses on legal defenses.
Settlement vs. trial: The AG is seeking a jury trial, but many major tech privacy cases settle before reaching one. A settlement would likely include a financial penalty, injunctive relief, and potentially structural changes to Netflix's data practices. The FTC-Facebook precedent ($5 billion with a consent decree) suggests major settlements remain possible.
COPPA angle: Given the allegations about children's profiles, a federal COPPA investigation by the FTC β which has been increasingly aggressive on children's privacy β is a real possibility in parallel with the state case.
Other states: If Texas's theory of DTPA liability gains traction, other states with strong consumer protection statutes may follow with similar actions. California's CPPA, which actively enforces the CCPA/CPRA, would be a natural next plaintiff if the Texas action establishes useful legal precedent.
We will continue to track this case and update this article as the litigation proceeds. Bookmark this page or subscribe to our newsletter to receive updates.
The Bottom Line
The Texas AG's lawsuit against Netflix is significant not just for what it alleges about one company, but for what it signals about the direction of state-level data privacy enforcement. The combination of consumer deception claims, children's privacy concerns, dark pattern allegations, and data broker disclosure β all in one complaint β reflects the maturation of state AG offices as aggressive enforcers of digital privacy rights.
For consumers, the message is clear: the platforms you trust with your family's data may not be using it the way you think. The best defense is knowledge β knowing your rights, knowing what data is being collected, and knowing how to exercise the opt-out and deletion rights your state's law provides.
Sources & Credits
Editorial note: This article is based on publicly available information from the Texas Attorney General's official press release, court filings reported by multiple news outlets, and RightToOptOut's independent analysis. Netflix has not filed a formal response to the complaint at the time of publication. This article will be updated as the case progresses. RightToOptOut is not a law firm and this article does not constitute legal advice.