DoNotPay launches a free Chrome extension that uses cookies to let users share accounts for services like Netflix without revealing passwords
DoNotPay is a startup that seems to delight in corporate trolling. Among its patchwork of services are a virtual credit card …
Context & Ripple Effects
DoNotPay has spent two years building a consumer-automation portfolio that pokes at corporate terms of service: the Free Trial Card that signs users up anonymously and declines payment when trials end, the Digital Health tool automating CCPA data-deletion requests, and Robo Revenge turning robocallers into lawsuit targets. The cookie-sharing extension extends the same playbook from billing and privacy into authentication itself.
The target is the password as the unit of account access. By moving credentials out of the handshake entirely — cookies carry the session, never the password — the extension sidesteps both the security argument platforms use against sharing and the detection heuristics built around shared logins, a very different attack surface from Okta's PassProtect, which used the same Chrome-extension form factor to harden passwords rather than route around them.
First-order effects
- Netflix and similar subscription services lose their main lever against account sharing — password secrecy — because sessions can now be handed off without the credential ever changing hands.
Second-order effects
- Streaming platforms are pushed toward session-level enforcement (device fingerprinting, IP heuristics, cookie invalidation) instead of login-level rules, raising friction for legitimate multi-device users too.
Third-order effects
- If cookie-mediated sharing spreads, subscription businesses priced on per-account assumptions face pressure toward per-person or per-device verification — an identity arms race between consumer automation tools and the platforms they arbitrage.
The trend: Consumer-automation startups are using the browser as an arbitration layer between users and platform terms of service, forcing subscription businesses to move enforcement from passwords to identity.