Everything you play is read as a signal and built into inferred tastes, and the profile is traded both ways: interests flow out to advertisers, demographics are bought back in. No number is the number; it lives as long as a purpose is judged to need it.
A revealing taste profile. Worth listing.
Viewing and subscription history is kept for years; profiles linger until you object.
A sign-up needs payment; ID is rare outside age checks.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
What you watch is treated as sensitive enough that US law puts a price on disclosing it. A leak turns a viewing history into something a stranger can read back to you.
Behaviour becomes a profile
Every show you open, song you play, or event you attend is logged and read as a signal. From that history, many policies build what they call inferences: your age, your interests, and preferences you never entered. The profile that gets targeted is derived from what you do, not from a form you filled in.
The profile is traded both ways
The taste profile does not sit still. Interest data and identifiers flow out to advertising partners, and demographic data is bought back in to sharpen who the service thinks you are. Ad-supported plans state the exchange outright. Where the service belongs to a larger group, that profile also travels across the corporate family, sometimes for the other companies' own purposes.
No number is the number
Most policies attach no figure to how long your profile lives. The common posture: kept as long as they judge a purpose needs it, then held longer wherever a law merely permits it, not only where one requires it. Where concrete numbers do surface, they run long: ticketing accounts can keep your full purchase and attendance history for seven years after your last use.
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Viewing choices can imply leanings.
What you watch can reveal orientation.
Two kinds of hold. LAW SETS IT: a statute makes them keep it. THEY SET IT: a ground the company grants itself.
Tax and company law makes them keep billing and payment records.
A legal duty to preserve child-safety reports, which overrides an erasure request for that data.
They can keep records to defend a live or possible legal claim.
In the US, the law covering video records prices one wrongly disclosed viewing record at 2,500 dollars. The data is actively traded: streaming and ticketing services buy demographic and interest data from ad partners to sharpen the profiles they hold. One ticketing platform was fined by a regulator after a security failure exposed payment data for millions.
Viewing habits are strong targeting and recommendation data.
What you watch trains recommendation models.
Anonymised is their word. In 2008 researchers re-identified people in a streaming service's released "anonymous" ratings dataset by matching viewing patterns to public reviews (Narayanan and Shmatikov, 2008).
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
THE STUDIES Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation, and increasingly AI training can all ride under it. When they want to do something new with your data, this sentence usually already covers it.
THE MOVE An objection draws the line: use your data to run the service, not to improve, target, or train on it.
“we do not sell your personal information”
Often technically true, and still misleading. It usually means no cash changes hands. Data can still flow to ad networks, analytics firms, and partners: on their definition, sharing is not selling.
THE MOVE Flip the do-not-sell switch where one exists. The written objection on top of it goes on your record.
“service providers, partners, and affiliates”
How data leaves the building with no name attached. Recipients are listed by what they do, never who they are. You cannot send a request to a company you cannot name, which is the point.
THE MOVE An access request can ask for the recipients by name, not just the categories. UK and EU law put that choice with you. The reply, or the silence, goes on your record.
“aggregated or de-identified information”
Stripping the name does not strip the pattern, and the pattern often still points at you. Policies grant themselves free, indefinite use of this data because in their telling it is no longer about you.
THE MOVE If a deletion comes back as 'anonymised', keep the reply. It is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for: legal duties, tax rules, fraud prevention, possible lawsuits, their own business reasons. None of them carries a firm end date. Deletion becomes a negotiation, not an event.
THE MOVE Which reasons apply to you, and how long each runs, is a request of its own. Their reply goes on your record.
“you grant us a licence to use your content”
A contract term, not a data setting, so a privacy request cannot undo it. The careful version ends with your account. The broad version can be passed on, never expires, and survives deletion.
THE MOVE Whether the licence ends with the account is written in their terms, not yours. Closing the account goes on your record.
“inferences of your age, interests and preferences based on your usage”
Deriving new facts about you that you never provided, your age, your interests, your preferences, from what you watch and play, then using that derived profile to target advertising. The result is data about you that did not exist until they built it.
THE MOVE A See request reaches the profile they built, not only the data you handed in. Their reply, or their silence, goes on your record.
“we share your information with Event Partners so they can run the event, for reasons described in their privacy policies”
In ticketing and events, buying one ticket hands your identity to the event's whole supply chain: the promoter, the venue, the artist and label, the organizer. Each holds it under its own separate policy, and the platform commonly disclaims responsibility for what those parties do next.
THE MOVE A See request reaches who your ticket was handed to down that chain. Their reply, naming those parties or not, goes on your record.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply. Start your record →