Florida Sues Netflix Over Children's Data Under State Privacy Law

Florida Sues Netflix Over Children's Data Under State Privacy Law

Florida's attorney general filed a five-count complaint against Netflix on September 9, 2026, alleging the company sold Floridians' sensitive data, including data collected from known children, without the consent the Florida Digital Bill of Rights requires. Netflix says the suit lacks merit.

Information last verified on September 11, 2026. This is a developing story; we update it as the record changes.

Status: Complaint filed in the Seventh Judicial Circuit, St. Johns County, Florida, on September 9, 2026. No court has ruled on any allegation, and Netflix has not yet answered as of September 11, 2026.

Jurisdiction scope: Florida. Section 501.715 and the rest of part V of chapter 501 bind businesses that collect personal data from Florida residents regardless of where the business sits. Other states police the same conduct under different definitions, different thresholds and different enforcers, so nothing here transfers automatically to another state.

What Happened

On September 9, 2026, the Office of the Attorney General, State of Florida, Department of Legal Affairs filed a 66-page complaint against Netflix, Inc. in the Circuit Court of the Seventh Judicial Circuit in and for St. Johns County. The document carries filing number 256635678 and an e-filing stamp of 9:11 a.m. that day. Attorney General James Uthmeier's Consumer Protection Division signed it alongside outside counsel from Norton Rose Fulbright US LLP, an arrangement section 501.72(9), Florida Statutes, expressly authorizes.

The State's framing, set out in paragraphs 1 through 21, is that Netflix ran a bait and switch. The complaint alleges Netflix spent years telling subscribers and investors that paying a monthly fee bought escape from advertising surveillance, built the surveillance infrastructure anyway, and switched it on for advertising in November 2022. At paragraph 3 the State quotes a July 17, 2019 shareholder letter telling investors they could "be confident" that any suggestion Netflix was "moving into selling advertising ... is false." At paragraph 4 it quotes the company's chief executive on a January 2020 earnings call: "We don't collect anything."

Against those statements the complaint sets what it alleges Netflix told engineers. Paragraph 74 alleges that as early as 2015 the company described logging 550 billion events per day, more than one petabyte daily. Paragraph 76 alleges that figure has grown to roughly five petabytes of behavioral logs per day and more than 10 million events per second.

The children's allegations sit at the center of the case. Paragraphs 59 through 68 allege Netflix marketed kids profiles as a separate protected space "intended for ages 12 and under" and prompted parents during signup by asking whether there will "be any kids watching." Paragraph 61 alleges the company's Help Center tells parents it does "not engage in behavioral advertising on Kids profiles." Paragraphs 89 through 97 characterize that as a half-truth, alleging at paragraph 92 that the "no behavioral advertising" framing is used to withhold any meaningful opt-out while, the State alleges, the same telemetry logs children's playback events, searches, scrolling and device signals anyway.

One allegation is Florida-specific. Paragraph 115 alleges Netflix gives California account holders a single account-level switch to disable behavioral data collection but requires Floridians to turn the setting off profile by profile.

Every statement above is an allegation drawn from a pleading. Netflix has not answered it, and no court has evaluated any of it.

What Netflix says

A Netflix spokesperson told NBC News the company "takes our members' privacy seriously," complies "with privacy and data-protection laws everywhere we operate," and has "dedicated safeguards in place for kids who watch content on Netflix," adding that the "lawsuit lacks merit and we intend to vigorously defend the matter in court." Gizmodo reported the same statement. That is the company's public position, not a court filing; Netflix's formal response will come in its answer or a motion.

What the Complaint Asks For

Counts I through IV arise under the Florida Deceptive and Unfair Trade Practices Act, sections 501.201 through 501.213, Florida Statutes:

• Count I, deceptive commercialization of user data for advertising.
• Count II, misrepresentations regarding kids profiles.
• Count III, misrepresentations about surveillance advertising and tracking.
• Count IV, dark patterns and addictive platform design.

Count V is the Digital Bill of Rights claim. Paragraph 208 alleges that Netflix's "sharing, disclosure, transfer, or making available of Florida consumers' personal data to third-party businesses for advertising, targeting, measurement, enrichment, and monetization constitutes a sale of personal data under the Florida Digital Bill of Rights." Paragraph 209 alleges Netflix made that sale of sensitive personal data, "including personal data collected from known children," without the prior consent section 501.715 requires. Paragraph 210 alleges Netflix failed to post the notice the same section requires. Paragraph 203 names the partners the State says carry the data: LiveRamp, direct advertiser integrations, Experian, Acxiom, Google Display & Video 360, The Trade Desk, Yahoo DSP and Amazon DSP.

The prayer for relief asks the court to enter judgment for the State and to permanently enjoin the alleged practices under section 501.207(1)(b), to order Netflix to purge data it allegedly collected deceptively from Floridians, to order it to stop collecting sensitive behavioral data through kids profiles absent fuller disclosure, to purge behavioral data previously collected through kids profiles, and to stop using dark-pattern interface designs. On money, it asks for penalties of up to $10,000 per willful FDUTPA violation under section 501.2075, up to $15,000 per willful violation victimizing a senior citizen under section 501.2077, up to $50,000 per FDBR violation under section 501.72, and trebled FDBR penalties for violations involving known children. A final catch-all item asks for all equitable relief section 501.207(3) allows, naming disgorgement and other equitable monetary relief; that subsection is the one that lets a court make orders to reimburse consumers found to have been damaged. Paragraph 218 demands a jury trial.

The complaint does not state how many violations the State will claim. Per-violation penalty math therefore has no fixed ceiling on the current record, and any figure circulating as a total exposure number is an extrapolation, not something the pleading asserts.

What the Law Actually Says

Section 501.715 is one short section of part V of chapter 501, the Florida Digital Bill of Rights. Section 18 of chapter 2023-201, Laws of Florida, created it. The governor approved that act on June 6, 2023, and section 27 of the act set the effective date at July 1, 2024. The section has three subsections, and reading them against the complaint is worthwhile, because the statutory text is in some respects broader than the lawsuit and in other respects narrower.

Who the section reaches

Subsection (1) applies to a person "who meets the requirements of s. 501.702(9)(a)1.-3. for the definition of a controller." That cross-reference is the most consequential sentence fragment in the statute.

The full controller definition in section 501.702(9)(a) has six subparagraphs. Subparagraphs 1 through 3 are the undemanding ones: the entity is organized or operated for the profit or financial benefit of its shareholders or owners, conducts business in Florida, and collects personal data about consumers or is the entity on whose behalf such data is collected. Subparagraph 4 adds that the entity determines the purposes and means of processing consumer personal data. Subparagraph 5 adds a floor of more than $1 billion in global gross annual revenues. Subparagraph 6 then requires one of three further tests, including deriving 50 percent or more of global gross annual revenue from online advertising sales, operating a smart-speaker voice-assistant service, or running an app store carrying at least 250,000 applications.

Section 501.715 incorporates subparagraphs 1 through 3 only. On the face of the text, the sensitive-data rule reaches any for-profit business that operates in Florida and collects consumer personal data, without the billion-dollar gate that keeps most of the FDBR pointed at a handful of very large platforms. The complaint pleads precisely those three elements, at paragraphs 200 through 202, and does not plead the revenue tests. Companies that concluded the FDBR did not apply to them because they fall under $1 billion should read what the FDBR actually covers again with that cross-reference in front of them.

What counts as a "sale"

Section 501.702(29) defines the "sale of personal data" as "the sharing, disclosing, or transferring of personal data for monetary or other valuable consideration by the controller to a third party." Valuable consideration, not cash, is the operative concept. A "third party" under section 501.702(34) is anyone other than the consumer, the controller, the controller's processor, or an affiliate of either.

The definition then excludes four things: disclosure to a processor that processes the data on the controller's behalf; disclosure to a third party for the purpose of providing a product or service the consumer requested; disclosure of information the consumer intentionally made public through a mass media channel and did not restrict to a specific audience; and transfer of personal data as an asset in a merger or acquisition.

Those exclusions, above all the processor exclusion, are where a contested case of this shape is usually decided. The State alleges the named ad-tech and data partners received Floridians' data as third parties for valuable consideration. Whether each of those relationships is a third-party sale or a processor arrangement is a question of fact and contract that the pleading asserts and the record has not yet addressed.

"Sensitive data" and "known child"

Section 501.702(31) defines sensitive data as four categories: data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; genetic or biometric data processed to uniquely identify an individual; personal data collected from a known child; and precise geolocation data. The complaint leans on the last two.

A "child" under section 501.702(6) is anyone younger than 18. A "known child" under section 501.702(17) is a child "under circumstances of which a controller has actual knowledge of, or willfully disregards, the child's age." Willful disregard suffices. The statute does not require a verified date of birth, and section 501.72(1)(a) adds that a controller that willfully disregards a consumer's age "is deemed to have actual knowledge" of it.

That is why the onboarding flow described at paragraphs 63 through 65 matters to the State's theory. A product that asks whether a child will be watching, and then builds a profile around the answer, is a product whose operator has been told the answer.

What consent has to look like

Subsection (1) bars the covered sale "without receiving prior consent from the consumer." For sensitive data of a known child it requires either "affirmative authorization for such processing by a known child who is between 13 and 18 years of age" or processing "in accordance with the Children's Online Privacy Protection Act, 15 U.S.C. ss. 6501 et seq." for a known child under 13. Because the complaint alleges Netflix markets kids profiles for ages 12 and under, the federal COPPA route is the one this dispute runs through.

Section 501.702(7) then narrows what can qualify. Consent must be "a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal data." It expressly is not acceptance of a general or broad terms-of-use document that bundles data-processing descriptions with unrelated material. It is not hovering over, muting, pausing or closing a piece of content. And it is not any "[a]greement obtained through the use of dark patterns," a term section 501.702(11) defines as a user interface designed or manipulated with the effect of substantially subverting or impairing user autonomy, decision-making or choice.

That last exclusion is the hinge between Count IV and Count V. If the interface allegations were proven, they would not sit in a separate silo from the consent claim. They would go to whether any consent Netflix obtained through those interfaces was consent at all under Florida's definition.

Notice, penalties and who can sue

Subsection (2) requires a covered seller to provide a specific sentence: "NOTICE: This website may sell your sensitive personal data." The statute prescribes the words. Subsection (3) sends penalties to section 501.72.

Section 501.72(1) makes a violation of part V an unfair and deceptive trade practice actionable under part II of chapter 501 "solely by the Department of Legal Affairs," and authorizes a civil penalty of up to $50,000 per violation. Penalties may be tripled for three categories: a violation involving a Florida consumer who is a known child, a failure to delete or correct personal data after an authenticated consumer request, and continuing to sell or share a consumer's personal data after the consumer opts out.

Two more features of section 501.72 shape how these cases run and rarely make the headlines. Subsection (2) lets the department grant a 45-day cure period and issue a letter of guidance instead of suing, but states that the cure period "does not apply to an alleged violation of paragraph (1)(a)," the known-child category. A company that mishandles children's data does not get the statutory grace window. Subsection (8) states that part V "does not establish a private cause of action," so the Attorney General is the only party who can bring an FDBR claim, a point worth understanding alongside the rights the FDBR does give consumers.

Where the money goes is also settled by statute. Section 16.53(8), amended by the same 2023 act, directs that all moneys the Attorney General recovers for attorney fees, costs and penalties in an action for a violation of part V of chapter 501 "must be deposited in" the Legal Affairs Revolving Trust Fund.

Florida's Earlier FDBR Action Against Roku Ended Without a Finding

Netflix is not the first target. On October 14, 2025, the Attorney General's office announced an enforcement action against Roku, Inc. and its Florida subsidiary under the FDBR and FDUTPA, alleging Roku collected, sold and enabled reidentification of sensitive personal data from children without authorization or meaningful notice.

That case did not produce a ruling on what section 501.715 means. On June 26, 2026, the Attorney General and Roku announced a negotiated resolution under which Roku agreed to expand parental controls at an estimated $25 million in engineering investment, with nationwide deployment anticipated within twelve months. The office's own release states that the resolution "does not include any finding of wrongdoing or civil fine."

Roku is the only other FDBR enforcement action the Attorney General's office has publicly announced, and that one ended in an agreement. We cannot say it is the only one that exists: the annual FDBR enforcement report section 501.72(4) requires the department to publish is not locatable on its website, a letter of guidance under section 501.72(2) or an assurance of voluntary compliance under section 501.207(6) needs no announcement, and Florida has no free unified docket search across its twenty circuits. What the public record does show is that no Florida decision construing section 501.715 has been reported, so the definitional questions the Netflix complaint raises, particularly what counts as a sale, remain open.

What Happens Next

The immediate steps are procedural and unglamorous. Netflix must be served. Under Florida Rule of Civil Procedure 1.140(a)(1), a defendant must serve an answer within 20 days after service of original process and the initial pleading, unless a Florida statute prescribes a different time. Rule 1.140(b) lets a defendant raise certain defenses by motion instead, including lack of personal jurisdiction, improper venue and failure to state a cause of action, and rule 1.140(a)(3) suspends the answer clock while such a motion is pending.

The complaint reads as though it anticipates the first of those. Paragraphs 26 through 44 spend nineteen paragraphs on jurisdiction, pleading Florida-based Open Connect server hardware, Florida Communications Services Tax collection at 5.07 percent beginning in 2024, Florida employment, and Florida-set programming. That is an unusual share of a complaint to spend on the question, though what Netflix will actually raise is not yet on the record. Venue then gets a single paragraph, 45, resting on section 47.051, Florida Statutes, and the allegation that the cause of action arose in substantial part in St. Johns County and throughout Florida.

What would convert any of this into a ruling on Florida privacy law is a contested motion the court actually decides: an order on a motion to dismiss construing what "sale of personal data" means on these allegations, or a summary judgment ruling, or a verdict. A settlement, which is how the Roku matter ended, would produce none of those. Nothing in the current record indicates which path this case takes, and we are not predicting one.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The headline will be about Netflix. The part that will still matter in three years is the cross-reference in section 501.715(1).

Most compliance writing treats the Florida Digital Bill of Rights as a statute aimed at a small club of very large technology companies, and for most of part V that reading is right, because the controller definition carries a $1 billion revenue floor plus a targeted-advertising, smart-speaker or app-store test. The sensitive-data section does not import those subparagraphs. It imports only the three that almost any commercial operator satisfies. If that reading holds up in a contested ruling, a mid-sized Florida business that sells or shares precise geolocation data, or any data collected from a user it knows to be under 18, is inside a provision it may believe it is outside. A company in that position should be reviewing its own FDBR posture rather than waiting for this case to resolve.

The second durable point is that the statute makes child-friendly design cut against the designer. The "known child" test is satisfied by actual knowledge or willful disregard, and section 501.72(1)(a) deems willful disregard to be actual knowledge. A service that builds a kids mode, asks parents whether a child will be watching, and labels content for ages 12 and under has done the opposite of avoiding knowledge. The uncomfortable implication is that the firms building the clearest child-safety affordances are the firms most clearly on notice, while a service that asks nothing has an argument it never knew. Florida's willful-disregard language is aimed at that gap, and this case will test how far it reaches.

The third point is about consent architecture. Section 501.702(7) is unusually explicit that a bundled terms-of-use acceptance is not consent, and that consent extracted through dark patterns is not consent. That is a direct rejection of the consent posture most consumer internet services run on. Pair it with the no-cure carve-out for known-child violations and Florida has built a statute that is harder to paper over after the fact than most state privacy laws.

Finally, the structural point. With no comprehensive federal consumer privacy statute, US privacy enforcement happens at the state level, brought by attorneys general, often with outside counsel, and usually paired with a deception count so the case does not rise or fall on an untested privacy provision alone. That pairing is visible here: four FDUTPA counts carry the familiar theory and the FDBR count carries the novel one. It is sound litigation structure, and it also means a case like this can settle without the privacy question ever being answered, exactly as the Roku matter did.

How This Affects You

If you are a Florida Netflix subscriber or a parent. Nothing changes for you today, and there is no claims process to join. Section 16.53(8) directs the penalties, fees and costs the Attorney General recovers to a state trust fund rather than to subscribers, and section 501.72(8) forecloses a private FDBR claim. The prayer for relief does also ask for the equitable relief section 501.207(3) allows, including disgorgement, and that subsection lets a court order money used to reimburse consumers found to have been damaged. Whether a court orders any of that, and whether any of it would reach individual subscribers, is entirely undecided. Practically, the useful step is unrelated to the litigation: open your Netflix account settings and review the privacy and advertising controls on each profile individually, because paragraph 115 of the complaint alleges those controls are set per profile for Floridians rather than account-wide. Netflix, for its part, has told reporters that members can turn behavioral ads off at any time and that kids profiles do not need separate advertising controls because they are not served behavioral advertising.

If you run a business that touches Florida residents' data. The exposure question is not whether you resemble Netflix. It is whether you are for-profit, conduct business in Florida, collect consumer personal data, and then share, disclose or transfer any sensitive data category for valuable consideration to anyone who is not your processor or affiliate. If that describes you, section 501.715's consent and notice requirements are the text to read, and the same statutory scheme also governs Florida's wider privacy and breach obligations. The 45-day cure period in section 501.72(2) is discretionary and is unavailable for known-child violations.

This is general legal information, not legal advice. It covers Florida law and the federal statutes Florida's provisions cross-reference, and reflects sources verified on September 11, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• What Is the FDBR?
• FDBR Consumer Rights
• FDBR Compliance Checklist
• Florida Data Privacy Laws
• COPPA Compliance Guide

---

Last updated: 2026-09-11. This is a developing story; details verified as of 2026-09-11.