On 11 May 2026, the Texas Office of the Attorney General (AG) brought the evolving debate over children’s privacy and platform design into sharper focus when it filed a lawsuit against Netflix under the Texas Deceptive Trade Practices Act. The lawsuit seeks primarily to stop Netflix’s alleged unlawful collection and disclosure of user data, requires Netflix to disable autoplay by default on children’s profiles, and to award injunctive relief and civil penalties. The complaint reflects a broader shift in the children’s privacy landscape, as regulators and lawmakers look beyond traditional notice-and-consent frameworks, focusing instead on how digital products are designed and how children’s behavior is potentially influenced through those products.
The Big Shift
Through the US Children’s Online Privacy Protection Act and state comprehensive privacy laws, privacy compliance for children’s data focuses primarily on accurately describing data practices, obtaining consent (from parents or minors in some cases) where just months after a California jury found Meta and YouTube liable for deliberately designing addictive products that harmed a young user. The Texas complaint alleges that Netflix designed its platform to encourage prolonged use and to collect detailed behavioral information from users, including children. The criticism is not simply that Netflix failed to communicate its practices in its privacy notice. Rather, the complaint scrutinizes the relationship between product design, data collection, and user behavior and engagement.
According to the complaint, Netflix allegedly uses design features that make the service more engaging and more difficult for minors to disengage from. The complaint characterizes these features as dark patterns, meaning design choices that influence users to take actions the company prefers, often in ways that may not be obvious to the user. The complaint also alleges that Netflix collects and analyzes information about how minors and other users interact with the platform, including what they watch, skip, pause, replay, or engage with, as well as information required, and providing users with the ability to exercise certain privacy rights. These obligations remain important. But both federal and state regulators are increasingly signaling that for children, a notice and consent framework is, on its own, insufficient to protect children’s privacy.
The Texas AG’s lawsuit against Netflix illustrates that point, coming about devices and other usage patterns. The Texas AG frames this alleged collection as more than a recommendation tool, suggesting that the data allows Netflix to develop detailed insights about minors and other users, which in turn may support broader business and advertising objectives. These allegations are particularly notable, as it treats the structure of the platform itself as a potential privacy and consumer protection issue.
Reliance on Deceptive Trade Practices Law
Whether those allegations are ultimately proven remains to be seen. But the theory of the case is important. The Texas AG is not relying on a new, standalone children’s privacy design statute. Instead, Texas is using an existing deceptive trade practices law to challenge alleged conduct involving children’s data, platform design, and user engagement. This strategy reflects a growing trend of state attorneys general, including those in Florida and Utah, using consumer protection laws to address privacy and design practices affecting children. This approach affirms that regulators do not necessarily need to wait for new children’s privacy laws to take effect before scrutinizing design practices, which is an approach more state AGs may continue to take as children’s privacy laws come under judicial scrutiny.
In recent years, state legislatures have increasingly sought to pass laws aimed at regulating the design practices of websites, platforms, and other online products that children use. These laws, referred to as age-appropriate design codes, share similar objectives: building privacy and safety protections into the design of the product itself.
Like the claims alleged in the Texas lawsuit, these requirements represent a meaningful departure from traditional privacy law compliance, as the focus is on whether the product is configured in a way that minimizes risk from the outset. California’s Age Appropriate Design Code, for example, prohibits using dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected, give up privacy protections, or take actions the business knows or has reason to know may be materially detrimental to the child’s health or well-being. Nebraska’s law goes one step further and prohibits dark patterns to subvert or impair a minor’s choice.
Minimum Duty of Care
Vermont’s Age Appropriate Design Code reflects another important development: the idea that companies may owe a minimum duty of care when processing minors’ data or designing services used by minors. That concept moves privacy law closer to a design and risk-management framework. Rather than asking only whether the company disclosed its practices, the law asks whether the company considered reasonably foreseeable harms, including emotional distress, compulsive use, and discriminatory impacts.
Defaults Are Not Neutral
In addition to restricting the use of dark patterns and designing services that effectuate a minimum duty of care, some age-appropriate design laws require businesses to configure children’s privacy settings at a high level (or at the highest level) of privacy. This requirement reflects a growing recognition that defaults are not neutral. In practice, users do not often change default settings, and children may not understand the consequences of those settings. By regulating default settings, states are attempting to ensure that privacy-protective choices are built into the user experience for minors.
The Bottom Line
Taken as a whole, these developments show that notice and consent are no longer the primary focus of children’s privacy regulation. They remain relevant, but states are increasingly concerned with what happens after the notice is provided. Is the service designed to collect only what is necessary? Are the default settings protective? Can minors control unnecessary features? Are recommendation systems configured in a way that reduces risk?
While some age appropriate design code laws (such as the Maryland Age Appropriate Design Code Act) remain subject to legal challenges and the regulatory landscape remains unsettled, the Netflix lawsuit suggests that Texas is one of the US states pursuing an alternative approach. Rather than relying on a specific age-appropriate design code, Texas is using the company’s own statements, representations, and practices as the basis for a consumer protection claim. In other words, where newer design-based privacy laws are delayed, narrowed, or challenged, regulators may still use existing deceptive or unfair practices authority to examine whether a company’s product design is consistent with its public commitments and users’ reasonable expectations.
The Texas AG’s Netflix lawsuit should therefore be viewed as part of a broader, multi-pronged enforcement strategy. The result is an enforcement environment in which companies cannot treat children’s privacy compliance just as a notice and consent exercise.
For businesses, the takeaway is clear: children’s privacy compliance should be built into the product from the beginning, companies should evaluate not only what their privacy notices say, but also how their services actually operate. That includes reviewing default settings, autoplay features, recommendation systems, geolocation practices, parental tools, data minimization controls, and user interface choices that may influence behavior.
This article was originally published in Privacy Laws & Business UK/International Report, issue number 202, August 2026, www.privacylaws.com.
