States’ Privacy Concerns Multiply as Streaming Platforms Boom

Video streaming platforms are booming, harvesting an abundance of user data that can be used for targeting ads. That’s creating a hot-button topic for state privacy regulators.

California, Michigan, and Florida this year have pushed the fast-growing streaming industry to comply with an array of laws—from kids’ privacy laws to more common consumer protection statutes.

Most recently, California Attorney General Rob Bonta fined streaming service Sling TV LLC and its affiliate Dish Media Sales LLC $530,000 on Oct. 30, marking the first enforcement action from the investigative sweep into streaming platforms the state announced in 2024. Earlier this year, Roku Inc. was the target of Florida and Michigan lawsuits over its collection of personal data.

As the industry expands, the scrutiny of its handling of personal information is likely to spread across the country, privacy attorneys said. That’s partly because states are collaborating more, and partly because streaming checks two enforcement priorities for state regulators: protecting children’s privacy and defending consumer rights.

“This is an alert to companies. They need to be on top of having clear opt-out measures, having clear notices as to how you’re using data, especially when we’re talking about children, and also making sure they’re implementing age-verification measures to make sure that they’re identifying child users,” said Gene Fishel, member of Troutman Pepper Locke’s regulatory investigations, strategy and enforcement practice.

“This is not going to be the last time we’re going to see these types of actions,” Fishel, former senior assistant attorney general in Virginia, added.

Make It ‘One Click’

State regulators have been scrutinizing how companies enable users to exercise their privacy rights.

California this year has penalized companies like Todd Snyder Inc. and American Honda Motor Co. Inc. for their handling of consumers’ rights requests. In September, regulators from California, Connecticut, and Colorado announced they were jointly investigating businesses’ compliance with browser settings allowing users to opt-out of the sharing of their personal information.

In the Sling TV case, Bonta said the platform violated California’s comprehensive privacy law by making it too difficult for users to stop the sale of their personal information and by failing to adequately protect kids’ data.

Sling TV said in an emailed statement that it has implemented privacy enhancements to address concerns of the California Department of Justice. “While we disagree with certain characterizations, Sling remains committed to respecting the privacy rights of its customers,” the company said.

Before they began focusing on opt-out rights, state and federal regulators repeatedly went after companies that rely on dark patterns—deceptive designs that can trick users into doing something they wouldn’t otherwise have done. The Sling TV enforcement feels like the next iteration, said Duane Pozza, co-chair of Wiley Rein LLP’s privacy, cyber, and data governance practice and a former Federal Trade Commission official.

“It’s notable that these kinds of cases about the difficulty of opt-out are proceeding without necessarily using the phrase dark patterns,” he said. “But the concept is largely similar: How much difficulty are consumers facing to exercise their opt out rights?”

The targeting of a streaming service signaled that companies across industries need to design their platforms so users can control the fate of their data whether they’re on a website, mobile application, or watching television, attorneys said.

“It’s not supposed to be that labor intensive,” Fishel said. “It needs to be more of a one-click thing.”

Tip of the Iceberg

Streaming platforms face enforcement risks beyond the states with the strictest privacy laws.

Michigan and Florida’s suits against Roku, for instance, show states can use multiple enforcement tools—including common consumer protection laws and the federal Children’s Online Privacy Protection Act.

The platforms’ alleged misuse of user data has also fueled lawsuits in the last five years, with streaming services like Paramount, HBO Max, and Peacock all having faced class actions under statutes like the federal Video Privacy Protection Act.

Scrutiny on the industry will grow as its share of the US media market keeps growing, attorneys said.

“There’s a lot of data that’s collected in streaming services,” Fishel said, pointing to viewing habits and personal details that are gathered as users create profiles. That information can be sold or used to narrowly target advertising.

“That’s how they’re making more revenue: by targeting,” he added.

In 2024, Forbes estimated that 99% of US households subscribed to one or more streaming services, with the industry’s revenue reaching about $44 billion and on track to reach $54 billion by 2027.

As regulators collaborate and quietly advance investigations, attorneys are bracing for more actions against streaming platforms.

“You are profiling and targeting advertisements based on that activity in a way that is not apparent to the consumer,” said Shea Leitch, member of GTC Law Group’s data privacy group. “Then you layer on top of that that they’re doing that with respect to children’s data.”

“That’s why they’re really zeroing in on these streaming services at this point,” she added. “It’s because of the thoroughness of the profiles and the richness of the data that they’re getting.”