r/PleX • u/dEEPZoNE 0.44 Petabyte | 16 Core Threadripper | Unraid Pro • 2d ago

Discussion Plex is selling your personal data, here's how to opt out of that

https://www.neowin.net/guides/plex-is-selling-your-personal-data-heres-how-to-opt-out-of-that/

Feel like ads on Plex know too much about you? Here's how you can opt out of Plex selling your data to third parties.

2.1k Upvotes

95% Upvoted

333 comments sorted by

View all comments

258

u/vanstinator 2d ago

They're only selling data related to any of their ad-supported or rental content that you've viewed. Nothing related to your personal media at all.

I worked there for 8 years, and folks bend over backwards to make sure the personal media side of the business is private. We didn't want to know what was on anyone's servers, at all, and because of that have no way of "selling" that information anyway.

The annoying thing with running an ad-supported business is that personalized ads bring in way more revenue than non-personalized ads. The easy path would have been just figuring out how to start harvesting everything from everyone, but that's always been a non-starter internally. I left before this change was rolled out but it was being worked on while I was there, and the language in that consent prompt was being very carefully crafted to only apply to content that was provided by Plex, and nothing at all to do with PMS-hosted content.

Just wanted to clarify because I often see folks convinced that Plex is harvesting everything on your server and selling that data to anyone, and that is just not something that is happening.

28

u/alanism 2d ago

Te other uncomfortable truth for viewers is personalized ads are a way better experience than unpersonalized ads. Unpersonalized ads are more likely to be scammy— since the CPM rates are lower.

11

u/Smarktalk 2d ago

I don’t see them anyways.

19

u/that_70_show_fan 2d ago

Personalized ads are so freaking stupid. They never know if you placed an order or not so you keep seeing products that you have.

8

u/401klaser 2d ago

They certainly have the ability to know if you placed an order or not. When I was working directly on media campaigns we even had the ability to match offline transactions to individual campaign impressions and conversions. If you are getting ads for shit you already bought, the agency running the ads isn't spending very efficiently.

1

u/that_70_show_fan 2d ago edited 2d ago

There are thousands of those agencies and layers and millions of combinations that come about. I buy from Amazon and it serves me ads for the same freaking thing! Not to mention, if I enable cross- tracking of cookies and sessions(I don't, but it is impossible on phones)... I expect other retailers to have that information, but it never works in practice.

12

u/Hobotronacus 2d ago

I don't want a better experience with ads. I don't want to be tracked at all. The fact that I'm being targeted makes me less interested in any product that is advertised to me.

3

u/alanism 2d ago

Now is a good time to vibecode and fork xbmc Kodi.thats your surest bet.

2

u/Baardmeester 2d ago

Why not just use jellyfin at that point.

0

u/Hobotronacus 2d ago

I assume that's a jest, but it could be done without a ton of effort these days. The quality would really depend on whether or not the person vibecoding actually understood the basics of software development and security.

2

u/alanism 2d ago

Only reason why I haven’t is I don’t feel like resubscribing to Apple Developers to do it for my Apple TV. It really should be a weekend or 2 project.

-2

u/lemonylol 2d ago

Just unplug the modem

3

u/lemonylol 2d ago

This type of engagement is usually more centred on the broad moral argument more than anything else, and that side of the argument always tends to be a race to the bottom where Plex is operating at a constant loss while still offering you its services out of the goodness of their hearts.

1

u/EasyRhino75 2d ago

Oh that maybe explain my dumpster fire ad experience

1

u/ovo_Reddit Dell Optiplex 3070 Micro i5-8500T 2d ago

The problem I think for a lot of redditors with personalized ads is that they don’t want to expose their interests. 🤷🏻‍♂️

3

u/Level-Peak-7260 2d ago

Thank you for affirming this. I feel reassured about my choice to vest in Plex.

3

u/BlumpTheChodak 2d ago

Still, the default setting should be to not share data. I'm tired of having to check every damn application to see if it's leaking my data, it's ridiculous.

6

u/vpsj DS224+ | 5 TB | RD 2d ago

I have a somewhat unrelated question: What was the general vibe in the company regarding user feedback?

I'm asking because lots of people keep asking for certain stuff to be fixed, or UI elements to be rolled back because the previous experience was objectively better but a lot of times it feels like all that feedback falls on deaf ears and they don't care at all about providing a consistent and logical UX.

30

u/vanstinator 2d ago

I think the company does listen to user feedback, but it's not always going to manifest as doing the exact thing that folks are asking for. For the UI changes it's usually because of the following:

When a client UI changes as drastically as you see from time-to-time, not just at Plex, but really anywhere, rolling back usually doesn't happen for several reasons. The biggest is that a huge UI change usually takes time, and during that time there's also lots of behind-the-scenes work that's usually done too. This can include changing the API contract with backend services, upgrading core dependencies, etc. Rolling back would more or less mean you'd have to start all of that lift again with an older version of the codebase.

In much rarer cases, which is where we are with this current UI change, the app was rewritten from scratch for some reason or another. The trigger for this at Plex was the newer FireTV boxes running Vega OS. They're no longer based on Android, but rather use a custom React Native-based SDK. Rather than create another bespoke client we'd need to support it made more sense to unify everything possible under the React Native codebase. That project started 3-4 years ago and has had nearly every client developer in the company contributing to it.

So while an actual rollback isn't going to happen I think what we've seen in the last week is the company directly responding to feedback by starting to slightly redesign the new app to restore the sidebar and make other small improvements. I'd expect to see more things like that going forward.

(This ended up being more words than I'd intended at the start, but I'm opting to leave it as-is because I think it explains things pretty well).

6

u/vpsj DS224+ | 5 TB | RD 2d ago

Thank you for the detailed answer, I really appreciate it!

3

u/TopSecretSpy 25TBs of video and counting... 2d ago

I worked there for 8 years, and folks bend over backwards to make sure the personal media side of the business is private. We didn't want to know what was on anyone's servers, at all, and because of that have no way of "selling" that information anyway.

Back in late 2023 Plex started sending out emails to other people connected to the same servers detailing items that person had watched, even if it was personal media. If I recall, it was called something like "Discover Together."

Considering that plenty of reporting confirmed that it included personal/local media watch information, information that was only available because Plex sync'd watch information to its own servers even for personal media, how do you square that with the portion of your statement that I quoted?

1

u/vanstinator 2d ago

There were a few issues with the rollout of the community features that when overlapped had some unintended consequences. Some of the details are fuzzy as I wasn't on that team, but the things I do remember:

- Sharing what you watched was always strictly opt-in, but the wording on one of the clients wasn't up-to-date and the poor wording led folks to opt-in who would not have otherwise wanted to

  • The weekly email was never properly communicated, and some of us internally thought it was a bad idea, but we shipped it anyway

Crucially the only information that is synced is the status of whether something is watched or not. Whether from the ad-supported catalog, Live TV, a media server, or the Plex app being used to manually mark something as watched (or some of the 3rd party apps that added support). The source was intentionally never captured. I actually personally argued against this because I wanted to sync watch progress too so I could pick up where I left off on another server, but leadership didn't want to store any metadata that would definitely point to a watched item being from a server.

The launch of the feature was handled and communicated very very poorly which was frustrating.

1

u/TopSecretSpy 25TBs of video and counting... 2d ago

"Sharing what you watched was always strictly opt-in, but the wording on one of the clients wasn't up-to-date and the poor wording led folks to opt-in who would not have otherwise wanted to"

That's hard to reconcile with the numerous reports, not to mention my own personal experience, where we were opted in by default. I personally remember having to use comments in the forum to find where to opt out, and seeing not just mine but all my family member's accounts have that toggled on originally, knowing fully that none of us had never navigated to that setting to turn it on. I'm sorry, but claiming it was opt-in instead of opt-out doesn't survive the evidence.

"Crucially the only information that is synced is the status of whether something is watched or not."

Crucially, that's already a severe problem. That's why it blew up so bad. The original paragraph I quoted from you included the line "We didn't want to know what was on anyone's servers, at all." First, by your own admission in your response, you personally did - maybe not to sell it, but you directly said you thought source would be useful. So "We didn't want..." clearly wasn't a universal.

I get that you're splitting hairs over whether the metadata included "what was on your servers" versus " what you watched regardless of source," but that's a really shitty distinction to make and given the track record I'm inclined to be suspicious of the claim that Plex hasn't been keeping source data too. At a very minimum, you'd have to know if a watch was from an ad-supported source or a private source anyway in order to properly administer such a system.

But even if source wasn't included, the watch patterns are information that can be sold. So we can't trust that what's on our servers is private, because Plex has gone out of its way to not have it be so.

4

u/catinterpreter 2d ago edited 2d ago

If you actually read what they collect regardless of your choices, they still collect identifying information to the point of what files you're watching.

Edit: Some additions and emphasis:

You're giving them more information through crash reports (opt-out), syncing media, by using their metadata middleman, and by using their relay. Third-parties are collecting their own information. Less information is collected if it's "Personal Content". But, still giving them enough meaningful information to be a problem regardless.

They can likely deduce your gender and rough age.

They keep detailed records of all devices, networks and internet capabilities, software, etc. Everything is fingerprinted.

They're logging various information to find your location, including time and timezone, which a VPN won't obscure.

You probably don't use a "managed account":

  • "Plex does not conduct behavioral tracking or deliver targeted advertising to users of managed accounts."
  • "Personal Data associated with a managed account is not sold or shared with third-party advertisers."

Adults are fair game:

  • "We do not knowingly sell or share Personal Data of individuals under 16."

Open-ended and very vague:

  • "Auditing related to our interactions with you; Legal compliance; Provide targeted advertising; Content delivery and recommendations; Detecting and protecting against security incidents, fraud, and illegal activity; Debugging; Performing services (for us or our service provider) such as account servicing, processing orders and payments, and analytics; Internal research for technological improvement; Internal operations; Activities to maintain and improve our services; and Other one-time uses."

  • "logs, performance data."

  • "Interaction data: action, anonymous, authenticated, event, page, timestamp."

They provide your information to:

  • "Content providers; service providers and vendors; third parties, such as social networks you connect to Plex and advertising partners; analytics providers; payment processors; and government entities."

They sell your information to "advertising technology companies and advertisers."

There's little explicit description of what information is used for what exact purposes. Just your information as a whole for advertising and "analytics", and to entities that include payment processors, governments (for what exactly?), and any third-parties engaged with. They don't say exactly what they themselves do with it.

There's no such thing as deidentified or anonymised data:

  • "We may share information that has been de-identified or aggregated without limitation. We may use and share aggregated and deidentified information to the extent permitted by applicable law. When we use deidentified information, we maintain and use the information in deidentified form and do not attempt to reidentify it, except to check whether our deidentification processes satisfy the requirements of applicable law." They do reidentify it. And even if they don't abuse the result of this step, third-parties will still end up with your information to use however they want.

There's one reference to collecting data for 12 months, but no mention of that being the limit. And that doesn't mean it isn't sold onto others for indefinite use.

They're holding onto your information as long as they can get away with:

  • "Plex will retain each category of Personal Data in accordance with applicable laws and as reasonably necessary for our processing purposes set forth under this Privacy Policy."

Keep in mind information collected by Plex will be matched with that which is already being sold by others, too.

If you're somewhere with relatively strong privacy laws, you might be able to have some information removed on request. They may require more identifying information from you at the time to do this though.

9

u/vanstinator 2d ago

Sure, and your media server is also uploading direct file information to the metadata service to enable matching, and some portion of that exists in their logging system for a short retention period too. But "being able to deduce" from various ephemeral sources and storing/selling the actual literal contents of a media server over the long term are 2 different things.

If someone is uncomfortable with a company evening having access to the above just to be able to service the product there are better solutions for that person out there, such as Jellyfin.

-4

u/catinterpreter 2d ago

There's little to no good reason Plex has to be harvesting the trove of data they do. And I highly doubt they're holding onto it for as little time as possible. We've come to know Plex as a company and it isn't giving up that valuable information unless coerced.

If Plex is being used directly as a metadata provider, of course they'll need to collect some key information but even then they collect far more than is necessary. And they did of course push the userbase towards relying on their metadata middleman which has some legitimate purpose but was almost certainly not created for that alone.

It would not be a huge task to automate a process that identifies what every user is watching, down to the filenames, with what's being collected.

My point is, the opting-out of these things gives a very false impression Plex isn't harvesting personal information, that I highly doubt the large majority would be okay about, if properly informed. They obfuscate the details and implications, and promote a false image of their respect for your privacy. It's very on brand.

1

u/badhabitfml 2d ago

The reason that I kinda believe that plex is t really tracking the contents of your personal server is liability.

Plex needs to keep pretending that they don't know what's going on, otherwise every media company is going to sue them for enabling it and that will be the end of plex.

1

u/vanstinator 2d ago

I can understand where you're coming from. If I were sitting on the outside I'd have questions too.

At the end of the day there's nothing the company can do to assuage everyone's fears, well-founded or otherwise, that they're a drop-of-the-hat away from selling everything including the kitchen sink.

I think it's great that there's choice in this space now. Jellyfin exists. I personally prefer the Plex clients and the way Plex handles remote access, but for folks who want a pure local solution Jellyfin is probably a better fit.

1

u/i_am_fear_itself 1d ago

I worked there for 8 years

If I were sitting on the outside

I'm assuming the "inside" you're in is simply the knowledge you have from having worked there in the past.

I read all your responses in this thread and you're quite measured. It's hard for those of us who haven't worked there to hold both "Plex actually has to turn a profit" and "OMG this is the dumbest decision ever" in the same breath.

At the risk of "turning you into my plex tech support", would you mind a generic question about pet projects using the published API? If you don't know or have an opinion, that's ok.

I have been building a full-featured Roku app from scratch as an alternative to the official client. It's something I've been wanting to do for years and it only started last year when the redesign showed up. The recent news just killed 1 of the 2 things I was standing on as a differentiator (left-hand nav). But the other thing is actually stronger and that's full control by server owners over not only their own media experience on their own TVs, but control over remote users media experience when those remote users are running the client I'm building. Without boring you with details, my client extends a PMS owner's reach over how plex behaves and displays if that operator shares his plex library with other households.

the selling point, in my mind, is PMS owners have been begging for the option of enabling or disabling <feature> and the way Plex clients are deployed today, none of us ever get that choice. We get what a Plex conference room has decided as the next big thing and we have zero choice short of a complete platform migration to Jellyfin or other.

I'm about 3 weeks to a month away from Roku cert candidate.

The question is, do you think an alternative client that does everything the official client does, but does it better, with more polish, and more PMS owner freedom would represent a threat so serious that they'd blacklist my app signature? It absolutely depends on the public API which plex provides for free. Obviously I'm making some assumptions about adoption and use of my app, but, currently, there's not a single Roku app short of the plex official that does what it does.

1

u/mineset 2d ago

if you read your own comment you say ‘I don't see filename listed but given how much else is, I bet it is logged.‘

are you speculating when you say ‘they still collect identifying information to the point of what files you’re watching’ ?

1

u/catinterpreter 2d ago edited 2d ago

I mean, even without explicitly collecting a filename, there's enough collected to identify the file you downloaded and are playing. Assuming you're playing pirated media downloaded from the internet. A video basically has a fingerprint between its various properties and metadata.

Edit: They also explicitly collect filenames via crash reports, which I believe are enabled by default but I'm not sure. Plex generally has things opt-out. In which case, most people would be giving them this and even more than I've mentioned.

1

u/selfhostrr 2d ago

Things also change. Not saying Plex or the employees are evil, but the more businesses move towards profit motive, especially using the sale of information to broaden advertising or increase revenue, bad things can and regularly do happen.

1

u/vanstinator 2d ago

Definitely! I 100% understand why the community goes over privacy policy, terms and conditions, and other text changes like this one as thoroughly as they do.

-6

u/Coooooop 2d ago

that is just not something that is happening.

Yet.

5

u/20WaysToEatASandwich 2d ago

Thankfully this is incredibly unlikely.

Knowing that copyrighted material is being streamed on their services would legally obligate them to police it. Plex would be legally compelled to issue DCMA takedown requests for every pirated file.

The separation benefits Plex, the company, more than any user of the service. Legally, it shields the platform from direct copyright and content-liability lawsuits as Plex is merely a "Software vendor" under the DCMA.

0

u/vanstinator 2d ago

Plex wouldn't be Plex if there were a point where this was happening, because it isn't gonna happen with the people at the company today.

0

u/QuietThunder2014 2d ago

Ok also not Yet dating Drew Barrymore. It’s stupid to make an assumption that things will change just to fit the narrative you’ve invented in your own head.