netflix and gender
Law post ;)
It's been about 3 years without my own Netflix account. I had enough of their antics, and especially their low quality garbage, disappearing catalogue and frequent cancellations. But I've been getting into the first season of Sex and the City and liked it, so I wanted more, but the services I have don't have the other seasons. Before having to make space for 17 DVDs, I settled for paying for a month of Netflix on the cheapest tier to binge in that time. I had to remake an account though, and that showed me how much the process had changed since last time.
Among the signup process was a step exclusively for birthday and gender. I entered just my birth year, wasn't enough; understandable. I filled in the rest, left gender out. To my surprise, it actually doesn't let you proceed in the signup process unless you select a gender option! For a streaming service?
It reminded me of a case that was mentioned in my study materials and a seminar I visited - C‑394/23 Mousse vs. CNIL and SNCF Connect.
To summarize, the train company SNCF required customers to indicate their title and gender identity by ticking either Sir or Madam when purchasing a train ticket online. The CJEU found that making this a mandatory requirement cannot be justified under the "contractual performance" or "legitimate interests" legal bases set out in Art. 6 GDPR and infringes on the principles of lawfulness, data minimization and transparency. Processing customers’ titles and gender identities was not necessary for personalizing commercial communications, and therefore could not be justified under the GDPR’s contractual performance legal basis.
They concluded that when balancing the pursued legitimate interest with the data subjects’ rights and freedoms, data subjects’ reasonable expectations should be taken into account. CJEU considered that SNCF customers should not have to expect the SNCF to process their title or gender identity as they purchase train tickets. Plus, it says that there may be a risk of discrimination based on gender identity that should also be taken into account.
Thinking back to that ruling, I wondered: Is this applicable to the Netflix situation?
Contractual performance and legitimate interest
The CJEU emphasized that the necessity requirement is not met when the objective pursued (here: serving you their catalogue, being able to contact you and bill you, etc.) could reasonably be achieved as effectively by other, less intrusive means. To rely on the legal basis of Art. 6 I b) GDPR, the controller must be able to demonstrate that it would not be able to perform the contract properly without it. For Art. 6 I f), they need to have a legitimate interest, prove that the data is necessary, and the subject's (user) fundamental rights cannot override the interest.
Generally, gender information is not needed to serve you TV series, movies and games, or to contact you and bill you - just like the Mousse ruling. Your name, email address and other means are enough.
How about wanting to customize or personalize the user experience based on gender information as legitimate interest? In the signup process, they also asked me to select titles in their catalogue that I like so that they can immediately personalize the home page. This is way more effective at serving the tastes of the user and less intrusive than recording gender data and having to guess the tastes based on gender roles. So that seems to fall away as well.
Reasonable expectations
Is it a reasonable expectation to have your gender information processed for watching media? I'd say no. The cinema doesn't do that either.
Selection options
It's possible that the ruling's clarification around gender identity requirements for the signup doesn't apply to Netflix because they also offer a third option: "None of the above/Prefer not to say". In the original case, SNCF required to tick either Sir or Madam, and seemingly did not have a third option or option not to say.
Having to answer the gender selection with something is required, but the actual information you offer there is somewhat voluntary and you can choose a vague option or that you'd not like to give them that information. Selecting "Prefer not to say" (which is included with the "None of the above") can be compared to leaving it empty. Fair.
Conclusion
While I was annoyed at first, I guess this is a valid workaround for wanting to be able to collect the gender information without making it mandatory in a way that would violate the GDPR.
And if you're curious: Of course Netflix didn't actually end up having SatC anymore despite the information online that they would, so I promptly cancelled the subscription and started the account deletion process. Of course it was hard to find and the code to delete wasn't sent for ages. Oh well.
Reply via email
Published 28 Jun, 2025