When Netflix’s Bandersnatch first dropped, many people were excited to try out the platform’s first adult attempt at an interactive “choose your own adventure” film. However, some people had concerns about data.
Recently, a GDPR request has revealed Netflix is recording every Bandersnatch choice you make.
A technology policy researcher, Michael Veale, got a copy of his viewing data after requesting it from Netflix under the General Data Protection Regulation (GDPR). The GDPR is a set of regulations in the European Union regarding data protection and privacy. Through the GDPR’s right to access rule, anyone is allowed to contact companies requesting information on data they’ve collected.
“People had been speculating a lot on Twitter about Netflix’s motivations,” Veale told Motherboard. “I thought it would be a fun test to show people how you can use data protection law to ask real questions you have.”
In a thread of tweets, Veale showed you can receive a copy of all the choices you’ve made on Bandersnatch provided through encrypted email. Netflix said it stores this data to “inform the personalised recommendations you see in future visits” and “determine how to improve [Bandersnatch’s] model of storytelling.”
Although, Netflix never asks for permission to store your choices. In addition, Veale reported Netflix didn’t say how long it stores data for and mentioned no plans related to deletion.
In response to Netflix’s claim that the process is necessary, Veale told Motherboard, “Is storing that data against my account really ‘necessary’? They clearly haven’t delinked it or anonymised it, as I’ve got access to it long after I watched the show. If you asked me, they should really be using consent (which you should be able to refuse) or legitimate interests (meaning you can object to it) instead.”
Netflix gathering data from viewings–with no disclosed plans for it or mentions as to how long they’re keeping it–is a real “Black Mirror-esque” twist.
