Plex

Is Plex safe?

Mostly, if you set it up carefully. Plex started as software for streaming your own films and music from a home server, and it now also offers free ad-supported films, live TV channels and a social feed of what friends watch. We score it 57/100, a little above Pluto TV (55) and below Tubi (59).

Two things weigh on the score. Plex's account database has been breached twice, in 2022 and 2025. And its free side is paid for by ads, with data sharing that its own policy says can be a "sale" under US state law.

Two breaches in three years

On 22 August 2022 Plex found suspicious activity on one of its databases. A third party had reached emails, usernames and passwords, which Plex said were hashed with bcrypt, salted and peppered. Plex made every account reset its password and said card data is not stored on its servers.

In September 2025 it happened again. In a notice dated 8 September, Plex said an unauthorised third party had accessed "a limited subset of customer data" from one of its databases, including emails, usernames, securely hashed passwords and authentication data. Users were asked to reset their password and sign out of all devices, including their own servers. At the same time, Help Net Security reported, Plex pushed server owners to update to version 1.42.1, which fixed a flaw (CVE-2025-34158) that let authenticated users take over a server. It temporarily blocked friends from connecting to servers that had not been updated.

On the positive side, Plex offers two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login with any standard authenticator app. It also runs its own bug bounty that can pay researchers in money or a lifetime Plex Pass. Two-factor login is optional, though, so many accounts still rely on a password alone.

What Plex collects

Apple's label for the main Plex app lists location, identifiers and usage data as used to track you across other companies' apps. Purchases, contact info and diagnostics are also collected and linked to you. Google Play lists approximate location as shared with other companies for advertising and marketing.

The privacy policy, revised on 6 May 2026, is fairly open about both sides. Plex collects an advertising ID, a city-level location from your IP address, truncated latitude and longitude, and device details. It says some disclosures to ad companies may count as a "sale" or "sharing" of data, to show you ads on Plex and on other sites. If you make your account public, your watch history and reviews may be shared with third parties for marketing.

For your own media, Plex draws a clear line. It says it does not collect the titles, filenames or metadata of your personal content, with narrow exceptions such as optional crash reports. Traffic through the Plex Relay service is encrypted end to end. Server and library counts are collected, and optional playback data can be switched off.

The watch-history email

In November 2023 many users were surprised by a weekly email listing what their friends had watched on Plex. Plex told The Register that "this email was enabled by default and caught some of our users by surprise", and promised to put the setting on its privacy page. It said titles flagged as adult were never included.

Today your profile has separate privacy settings for watch history, ratings, watchlist and friends list. Profile fields such as name, location and bio are visible to any Plex user. If you choose a public account, your profile gets its own web address. Check these settings once, since the defaults have changed before.

Plexamp, Plex's music app

Plexamp is Plex's separate music player, and it has been free since 18 July 2023. A Plex Pass adds extras such as offline downloads and mix builders. It needs a Plex Media Server and signs in with the same Plex account, so the same password, optional two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login and privacy policy apply, and it is the same account that was in the 2022 and 2025 breaches. Its App Store label is lighter than the main app's. Contact info, identifiers, usage data and diagnostics are linked to you, but nothing is listed as used to track you. Plexamp has about 10,200 US ratings and is rated 4+.

Children and the age gap

Plex's terms say users must be at least 18, yet the App Store rates the app 4+ while listing messaging and user-generated content. For families, the answer is a managed account under a parent's Plex account. Managed accounts can use Younger Kid, Older Kid or Teen restriction profiles, and Plex says they receive no behavioural tracking or targeted ads. The profiles do not apply to Live TV, so switch that source off for managed users in the web app if your children use Plex.

How to use Plex safely

1. Turn on two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login with an authenticator app, and change your password if you have not done so since September 2025.
2. Keep Plex Media Server updated, and remove friends you no longer share with.
3. Set watch history, ratings and watchlist to private or friends only in your profile's privacy settings.
4. Opt out of personalised ads with your device's advertising settings and Plex's privacy choices.
5. Give children managed accounts with a restriction profile, and disable Live TV for them.

How we scored it

The regulatory record (86) is Plex's highest factor, since no regulator has fined or ordered it. Privacy (46) is the lowest, because ad data is sold or shared and the label tracks location, held up only by Plex's refusal to collect your own media's titles. Security (52) reflects two database breaches, partly offset by two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login and a paid bug bounty.