The Video Privacy Protection Act and Online Video Tracking

In 1987, during Robert Bork's Supreme Court confirmation fight, a Washington newspaper published a list of videos he had rented. The list itself was unremarkable. The fact that it could be obtained and printed at all bothered Congress enough that it passed the Video Privacy Protection Act the next year.

Video rental stores have mostly disappeared. The statute hasn't, and in the last decade it has been applied to streaming services, video-hosting websites, and the advertising code embedded on them.

What the statute prohibits

The VPPA, 18 U.S.C. § 2710, bars a "video tape service provider" from knowingly disclosing a consumer's "personally identifiable information" to a third party without the consumer's informed, written consent, subject to some exceptions.

A video tape service provider is anyone engaged in the business of renting, selling, or delivering prerecorded video cassette tapes "or similar audio visual materials." Courts have generally read that phrase to include digital video delivered online. Personally identifiable information includes information identifying a person as having requested or obtained specific video materials or services. A consumer is any renter, purchaser, or subscriber of the provider's goods or services.

The statute targets disclosure. A company may keep a record of what you watch. What it can't do, without proper consent, is hand a third party information that connects you to specific videos.

Consent

Congress amended the VPPA in 2012 to address online services. Under § 2710(b)(2)(B), consent may be given electronically, but it must be in a form distinct and separate from any other legal or financial obligations. It can be given at the time of the disclosure or in advance for up to two years or until withdrawn, and the consumer must be given a clear and conspicuous opportunity to withdraw it. A passing reference to data sharing in a privacy policy generally won't satisfy those requirements.

The remedy

Under § 2710(c), a person aggrieved by a violation can recover actual damages but not less than liquidated damages of $2,500, plus punitive damages, reasonable attorney's fees and costs, and other appropriate relief. The $2,500 doesn't require proof of financial harm. Under § 2710(c)(3), an action must be brought within two years from the date of the act complained of or the date of discovery.

Pixels and modern VPPA cases

Most VPPA litigation today involves websites and apps that host video and also embed tracking pixels from large advertising or social media platforms. According to these complaints, when a logged-in user watches a video, the pixel sends the platform the video's title or address together with an identifier the platform can link to the user's account. The claim is that the video provider has thereby disclosed to a third party that a specific, identifiable person requested a specific video.

Defendants contest almost every element, and courts have divided. Some have questioned whether a business that offers video only incidentally is a video tape service provider. Others have asked whether someone who hasn't paid or created an account is a "subscriber." A particularly important split concerns what counts as personally identifiable information: whether an account identifier paired with a video title is enough, or whether the statute requires information an ordinary person could use to identify the viewer. Several federal courts of appeals have weighed in, and they haven't all agreed.

The Supreme Court has agreed to resolve one of these questions. In January 2026 it granted review in Salazar v. Paramount Global, which asks whether someone who subscribes only to a non-video product from a company that also offers video, such as a free newsletter, qualifies as a "consumer" under the Act. The case is expected to be heard in the Court's 2026–27 term, and its outcome could significantly expand or narrow who can bring these claims.

Practical steps

Check the privacy settings on video services you use for options that limit ad tracking or data sharing. Browser tools that block third-party trackers can stop these disclosures before they happen. If a service asked for your consent to share viewing data, notice whether the request was separate and clearly explained or buried in general terms. And if you learn that a service you've used is the subject of a VPPA case, keep records of your account and how you used it.