What You Watch Is Protected: The Video Privacy Protection Act in the Streaming Era

In 1987, a newspaper obtained and published the video rental history of Robert Bork, then a nominee to the Supreme Court. Nothing in the list was scandalous, but the episode alarmed Congress enough that it passed a law the following year making it illegal for video stores to disclose what their customers watched. That law is still on the books. Video stores are mostly gone, but the statute has found a second life in the world of streaming services, video-hosting websites, and advertising trackers.

The Statute

The Video Privacy Protection Act, 18 U.S.C. § 2710, prohibits a "video tape service provider" from knowingly disclosing "personally identifiable information" concerning any consumer to a third party without the consumer's informed, written consent. The statute defines the key terms broadly:

• A video tape service provider is any person engaged in the business of rental, sale, or delivery of prerecorded video cassette tapes "or similar audio visual materials." Courts have generally read "similar audio visual materials" to reach digital video delivered by streaming services and websites.
• Personally identifiable information includes information that identifies a person as having requested or obtained specific video materials or services.
• A consumer is any renter, purchaser, or subscriber of goods or services from a video tape service provider.

The disclosure is what the statute targets. A company can collect your viewing history; what it cannot do, absent proper consent, is give a third party information that links you to what you watched.

Consent Under the Act

The VPPA was amended in 2012 to address online services. Under § 2710(b)(2)(B), consent must be in a form distinct and separate from any other legal or financial obligation, may be given in advance for a period of up to two years, and must be accompanied by a clear and conspicuous opportunity to withdraw it. A privacy policy that mentions data sharing in passing is generally not sufficient; the consent has to be a distinct, affirmative act.

The Remedy

Under 18 U.S.C. § 2710(c), a person aggrieved by a violation may bring a civil action and recover actual damages but not less than liquidated damages of $2,500, plus punitive damages, reasonable attorney's fees and costs, and any other appropriate relief. The $2,500 floor does not depend on proving that the disclosure caused you any financial harm.

The action must be brought within two years from the date the violation was discovered. See § 2710(c)(3).

How the Act Applies Today

Modern VPPA litigation has focused on a particular practice: websites and apps that host video content embedding advertising trackers — most prominently pixels provided by large social media and advertising platforms — that transmit information about what a user watched, together with an identifier that the platform can link to the user's account. Plaintiffs allege that the video provider has thereby disclosed to the platform that a specific, identifiable person requested a specific video.

Defendants have contested nearly every element. Courts have addressed, with varying results:

• Whether a website that offers free video content, or that provides video only incidentally to another business, is a "video tape service provider"
• Whether a visitor who has not created an account or paid for anything is a "subscriber" and therefore a "consumer" under the Act
• Whether an identifier like a cookie or account ID, combined with a video title, is "personally identifiable information," or whether the statute requires information an ordinary person could use to identify the viewer
• Whether the disclosure was "knowing"

Several federal courts of appeals have weighed in on these questions, and the definitions have been applied broadly in some circuits and narrowly in others. The scope of the Act in the streaming and pixel context remains contested and continues to develop.

Where You Might Encounter This

The practices that have drawn VPPA claims include news and media websites with embedded video, streaming platforms, sports and entertainment sites, fitness and educational video services, and apps that deliver video content. If you have an account with a platform that hosts video and also have an account with a social media service whose tracking pixel is embedded on that platform, your viewing may have been shared.

What You Can Do

• Review the privacy settings on video services you use, and look for options to disable ad tracking or data sharing.
• Use browser extensions that block third-party trackers, which can prevent the disclosure from occurring in the first place.
• If a service asked you to consent to data sharing, note whether it was a distinct, clearly explained request or buried in general terms.
• If you learn that a service you used has been the subject of a VPPA action, or you have reason to believe your viewing history was shared without consent, keep records of your account and your use of the service.

The Bottom Line

What you watch is legally protected information, and a company that hands it to advertisers without your clear consent may owe you $2,500 per violation. How far that protection extends to today's streaming and tracking technology is still being worked out in the courts, but the statute's floor is firm and its remedy is real.