Here’s What YouTube, Netflix, and Spotify Do With Your Personal Data

Privacy policies set out all the ways in which an organization gathers, stores, and uses its customers’ or clients’ personally identifiable information and data. These are legal statements that people often agree to without fully reading them due to the length and complexity of these documents.

With this in mind, cybersecurity expert Chris Bluvshtein from VPNOverview has compared the most complicated and difficult-to-read privacy policies from the top streaming services, in order to see what data these companies are gathering about you.

Rank Website Readability Score Word Count Time to read (minutes) 1. Disney + 2.8 2,573 19.8 2. Netflix 23.7 4,977 38.3 3. Spotify 25.0 5,799 44.6 4. Sky 29.7 1,710 13.2 5. YouTube 30.6 872 6.7 6. ITV 35.6 2,877 22.1 7. BBC iPlayer 43.2 555 4.3 8. Apple TV + 43.4 2,349 18.1 9. Channel 4 (All 4) 56.2 9,285 71.4

Disney+ Time to read: 20 minutes

Reading level: University Graduate (21 and above)

Disney+ was found to be the hardest policy to read, given it had the lowest readability score by far at just 2.8 out of 100. The policy says that the streaming platform can share your data with third parties, which is a common part of many privacy policies. However, Disney also includes the following in the fine print:

“The information received by the other company is controlled by that company and becomes subject to the other company’s privacy practices.”

This means that you are also agreeing to the policies of those other companies without knowing it.

Netflix Time to read: 38 minutes

Reading level: University Graduate (21 and above)

Netflix was found to be the second most difficult policy to read with a readability score of 23.7 out of 100. Its policy is also one of the longest at 4,977 words, meaning that it would take the average reader nearly 40 minutes to sift through.

The streaming giant collects a wide range of invasive user data such as devices used, location, and browsers. Netflix is very vague on exactly how and why it collects said data but uses it to its advantage with crackdowns on account sharing.

Spotify Time to read: 45 minutes

Reading level: University Graduate (21 and above)

Spotify had the third most difficult policy, with a readability score of 25.0 out of 100, and was the second longest, taking around 45 minutes to read through.

Spotify’s privacy policy states that it can log and store voice data and build up personal profiles of users, despite having no real need to do so. The policy claims to use voice data to “evaluate and develop new features, technologies, and improvements to the Spotify service” and “to comply with a legal obligation we are subject to.”

In fact, 42% of Spotify’s policy relates to the collection and use of your personal data, equating to 2,468 out of the 5,799 words in the document.

Sky Time to read: 13 minutes

Reading level: University Graduate (21 and above)

Sky’s privacy policy is one of the shortest at only 1,710 words but due to its low readability score of 29.7, ranks the fourth most difficult to read.

Sky states that it will keep data including payment card and financial history for up to seven years, even after you cancel your subscription. Other types of data such as recorded calls to customer services are deleted after a more reasonable twelve months.

YouTube Time to read: 7 minutes

Reading level: University Student (18-21 years old)

The video-sharing and streaming platform ranked as the fifth most difficult to read, with a policy readability score of 30.6 out of 100. YouTube’s policy is the second shortest on this list at just 872 words. As it would take the average user only 7 minutes to read, the policy is shorter than the average video on the platform.

YouTube shares some of its privacy policies with Google as it belongs to this parent company. The policy states that data such as search terms, videos watched, and location data are all stored and used to serve personalized adverts to its viewers.

ITV Time to read: 22 minutes

Reading level: University Student (18-21 years old)

ITV’s privacy policy is only 300 words longer than that of Disney+ however it is much easier to read with a score of 35.6/100.

The policy states that the user can object to the Company processing their personal information and that they will “consider if your rights outweigh our interests and if they do, then we will either restrict our use of your information or delete it.”

BBC iPlayer Time to read: 4 minutes

Reading level: University Student (18-21 years old)

This is the shortest policy on the list at 555 words and takes just 4 minutes to read. It is the third easiest-to-read policy on our list with a score of 43.2.

Within this policy, the BBC does include a small note about updating the document. Users should be made aware of any changes by email in the event they want to cancel the service.