Video Privacy Protection Act: why sites with videos and a pixel get sued

The Video Privacy Protection Act stops a business that delivers videos from sharing which videos you watched, tied to who you are, unless you’ve agreed to it. It’s a 1988 federal law, the VPPA for short, and these days it gets used against websites. The usual claim: a pixel on a page sent the video’s address to an ad platform along with the visitor’s Facebook ID. Courts have split on two questions, who counts as a “consumer” and what counts as identifying information. The Supreme Court heard Salazar v. Paramount Global on 14 October 2026, and its decision will answer the first.

Below: what the Act says, how a pixel ends up in a VPPA lawsuit, what each appeals court decided, and what’s in front of the Supreme Court now. Then the settlements with businesses that aren’t streaming services, and a check you can run on your own video pages. California’s wiretap law, which drives a lot of the same suits, has its own case file on CIPA.

What the Video Privacy Protection Act says

When Robert Bork was nominated to the Supreme Court in 1987, reporters found out what he and his family had rented from a video store. The Seventh Circuit summed up the haul: Hitchcock mysteries, John Hughes comedies, British costume dramas and spy thrillers, nothing embarrassing. Congress was alarmed anyway, and the Act was signed on 5 November 1988.

Three definitions do most of the work.

Term	What the statute says	What it means for a website
Video tape service provider	A business of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials	The Seventh Circuit reads “delivery” and “similar” as covering video streamed online
Consumer	any renter, purchaser, or subscriber of goods or services from a video tape service provider	The fight is over whether a newsletter sign-up counts
Personally identifiable information	Includes information that identifies a person as having requested or obtained specific video materials or services	Who you are, joined to what you watched

The statute makes a provider liable when it knowingly discloses a consumer’s personally identifiable information to anyone. There are exceptions, and the one that matters for websites is consent. It has to be informed, written consent (including through an electronic means using the Internet), kept in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer. It can be given each time or in advance for up to two years, and the person must get a clear and conspicuous way to withdraw it. The “using the Internet” part came with an amendment signed on 10 January 2013, which replaced a rule that consent be given at the time of each disclosure.

Anyone aggrieved can sue in federal court. The court may award actual damages but not less than liquidated damages in an amount of $2,500, plus punitive damages, attorneys’ fees and other relief. A suit has to start within two years of the disclosure or of its discovery. Although it sits in the criminal code, the Act creates only civil liability, as the D.C. Circuit noted.

How a pixel turns into a VPPA lawsuit

Meta’s own documentation describes its pixel as a snippet of JavaScript that relies on Facebook cookies to match website visitors to their Facebook accounts. It also says: By default, the Pixel will track URLs visited, domains visited, and the devices your visitors use. The standard code Meta gives sites includes a PageView event (Meta for Developers).

Put that on a page whose address names a video, something like /videos/fixing-a-leaking-tap/, and the complaints say the pieces line up. The page address or the video title goes to the platform, and the visitor’s Facebook ID rides along in a cookie. In the Paramount case the Sixth Circuit summed up the allegation: the pixel sends Facebook the video’s name, its URL and the user’s Facebook ID (opinion, footnote 1).

That’s why the URL matters. A page called /products/ says nothing about anyone’s viewing. A page whose address is the name of the video is, according to the plaintiffs, a record of what someone watched. Joined to an ID, it’s the 1988 rental slip.

What a platform does with the data after it arrives isn’t something I can see from your page, and this article doesn’t guess. The suits are about what the site sent.

Who is a consumer: the split

In the cases below, nobody paid for video. The plaintiff signed up for a free newsletter, then watched videos on the same site while logged in to Facebook. So the question is whether the newsletter makes them a “subscriber of goods or services” from a video provider.

Court	Case	Decided	Is a newsletter subscriber a consumer?
Second Circuit	Salazar v. National Basketball Association	15 Oct 2024	Yes: any of the provider’s goods or services count
Seventh Circuit	Gardner v. Me-TV	28 Mar 2025	Yes: a newsletter or a sweatshirt would do
Sixth Circuit	Salazar v. Paramount Global	3 Apr 2025	No: the subscription has to be to audiovisual material
D.C. Circuit	Pileggi v. Washington Newspaper Publishing	12 Aug 2025	No: same reading as the Sixth Circuit

Same plaintiff, Michael Salazar, in two of those rows. In the NBA case the Second Circuit held that “consumer” should be understood to encompass a renter, purchaser, or subscriber of any of the provider’s “goods or services”—audiovisual or not. It vacated the dismissal and sent the case back. That only meant the complaint could go forward. The NBA asked the Supreme Court to step in, and the petition was denied on 8 December 2025.

Judge Easterbrook’s opinion for the Seventh Circuit went the same way. MeTV’s free sign-up asks for an email address and a zip code. The court held any purchase or subscription from a video provider qualifies, even if the thing purchased is clothing or the thing subscribed to is a newsletter (Gardner). Again, that’s a ruling on a motion to dismiss. The complaint survived, nothing more.

Six days later the Sixth Circuit disagreed, in Salazar’s case against Paramount’s 247Sports site. He hadn’t subscribed to audiovisual material, so he wasn’t a consumer, and the court said plainly we break with the Second and Seventh Circuits’ approach to this issue. The dismissal stood, over a dissent (opinion). In August the D.C. Circuit took the same side for a Washington Examiner newsletter reader, holding a plaintiff must allege that she purchased, rented, or subscribed to a video cassette tape or similar audio-visual good or service (Pileggi).

So it’s two circuits against two. Whether a newsletter sign-up exposes a site to these claims has depended on where it gets sued.

What counts as identifying information

The second question is whether what the pixel sends identifies anyone at all. The Second Circuit’s Solomon opinion describes two approaches in the courts. The First Circuit asks whether the information is reasonably and foreseeably likely to reveal which videos someone watched. The other approach asks what an ordinary person could work out.

The Third Circuit adopted the ordinary person test in 2016, in a case brought for children under 13 against Viacom, which runs Nickelodeon, and Google. It also held that only the business that discloses can be sued, not the one that receives. It observed that, to an average person, an IP address or a digital code in a cookie file would likely be of little help (In re Nickelodeon). The Ninth Circuit followed in 2017. A Roku serial number and the titles watched, sent to Adobe Analytics, weren’t personally identifiable information (Eichenberger v. ESPN).

On 1 May 2025 the Second Circuit joined them, in a suit against the streaming service FITE. It held the definition covers information that would allow an ordinary person to identify a consumer’s video-watching habits, and not information that only a sophisticated technology company could use. Then it looked at the code in the complaint. The title appeared as title%22%3A%22...The%20Roast%20of%20Ric%20Flair, inside some twenty-nine lines of code. The court found it implausible that an ordinary person would read that as a video title, or read c_user= followed by a number as someone’s Facebook ID. Dismissal affirmed. Solomon’s petition to the Supreme Court was denied on 8 December 2025, the same day as the NBA’s.

For a site owner this is good news with a catch. In the Second, Third and Ninth Circuits, codes and identifiers that only a tech company could decode have been held not to identify anyone, and Solomon applied that to a pixel. A different site, in a different circuit, with plainer data, could come out differently.

The Video Privacy Protection Act at the Supreme Court

The Court granted certiorari in Salazar v. Paramount Global, No. 25-459, on 26 January 2026. The question presented asks whether “goods or services from a video tape service provider” refers to all of a video tape service provider’s goods or services or only to its audiovisual goods or services.

The case was argued on 14 October 2026. In the transcript, Salazar’s lawyer, Joshua Hammack, put it this way about Paramount: All it needed to avoid liability was its consumers’ consent, something it and Facebook agree was easy to get. Paul Clement, for Paramount, said goods or services from a video provider don’t logically mean chicken sandwiches or dog bandanas. Justice Thomas asked how a sports site counts as a video tape service provider at all.

That question isn’t the one the Court agreed to decide. The question presented says Paramount being a video provider, and the data being personally identifiable, were both assumed by the courts below: Both courts below assumed as much. So the ruling will settle who is a consumer. It won’t settle whether a site with some videos is a video business, or whether pixel data identifies anyone. Solomon’s ordinary person rule stays where it is.

No opinion is on the docket yet. The Court’s own procedures page says a term starts on the first Monday in October and Usually Court sessions continue until late June or early July. This case was argued in October, so expect a decision by the end of this term, which usually means late June or early July 2027. We’ll update this post when it’s out.

Not only streaming services

Some of the businesses that have settled these suits aren’t video companies in any everyday sense. They had videos on their sites, and a pixel. That’s what drives the “vppa settlement” searches: people get a notice from a company they think of as a membership group or a shop.

AARP

Plaintiffs sued AARP in September 2022. They alleged the Meta Pixel on AARP.org shared members’ video viewing with Meta. The court denied AARP’s motion to dismiss in December 2023. The parties then settled for a $12,500,000 fund, fees included, and the court granted final approval on 20 February 2026. The order counts 2,940,169 potential class members. The class is members and registered users who watched videos on AARP.org while they had a Facebook account, between 27 September 2020 and 12 September 2025 (settlement website). Payments went out on 13 April 2026.

Limited Run Games

Limited Run Games sells physical copies of video games. The complaint alleged it sent customers’ information to Facebook and others without consent. The class covers people who watched a pre-recorded video, or bought a game with a cut scene, between 1 January 2016 and 20 June 2025. The fund is $2,720,000, and the company denies any wrongdoing. The court granted final approval on 11 March 2026, with 27,864 claims accepted (memorandum and order).

Where the Act stops

The Act does have an edge. Landmark Theatres sent Facebook the film’s name, the cinema and the buyer’s Facebook ID when someone bought a ticket online. The Ninth Circuit held that selling tickets to a movie in a theatre doesn’t make Landmark a video tape service provider (Osheske).

Smaller and larger companies

The Act doesn’t scale with the business. Liquidated damages are $2,500 a person, whether the site belongs to a national membership group or a shop with a few thousand newsletter readers. A few thousand viewers is already millions of dollars on paper, which is why these cases settle.

The coverage question doesn’t scale either. Whether you’re a “video tape service provider” depends on what your business does with video: rent it, sell it, deliver it. It doesn’t depend on revenue or headcount. A small site that hosts its own videos asks the same question a big one does.

Check your own site from your phone

You don’t need a tool for most of this. A phone and, for one step, a laptop will do.

1. Open a page on your site that plays a video, in a private tab. Don’t answer the banner. Look at the address bar: does the URL or the page title name the video?
2. Watch whether the video plays straight away or waits for you. Note any sign-up box or newsletter offer on the same page.
3. On a laptop, open the browser’s developer tools, choose the Network panel and reload the page. Before clicking anything, look for requests to ad platforms, like facebook.com/tr for the Meta Pixel. Click one and see whether the page address is in it.
4. Open your newsletter or account sign-up form. Is there a notice next to it that says what’s collected and who it’s shared with? Is there a separate, plain consent for sharing viewing, or only your general terms?
5. Read your privacy policy’s section on sharing. Does it name advertising pixels and say viewing data goes to them? If the policy says you never share personal data, compare that with what step 3 showed.

Peeky reads your public pages the same way and writes down what he saw. For the notice next to your sign-up forms, the check is US-05. For whether your privacy policy owns up to the advertising tools on your pages, it’s US-04. And for promises like “we never share your data” set against what the page actually sent, it’s US-07. If you’re weighing a change to your embeds, the tracking pixel guide and the youtube-nocookie guide are the next reads.

Questions people ask

What is a VPPA violation?

Under the statute, a business that rents, sells or delivers videos knowingly discloses a consumer's personally identifiable information without their consent. That means information showing a person asked for or got specific videos. In website suits, the claim is that a pixel sent the video page's address together with the viewer's Facebook ID. Whether that's enough depends on the court and on the facts, and several of the suits in this article were dismissed.

What does VPPA consent look like?

The Act asks for informed, written consent, which can be given online. It has to sit in its own form, separate from anything else the person signs up to. It can be given each time or in advance for up to two years, and the person has to get a clear way to withdraw. A line buried in your terms of service doesn't fit that description.

What does VPPA stand for?

VPPA is short for the Video Privacy Protection Act of 1988, found at 18 U.S.C. § 2710. It's a federal US law that stops video businesses from sharing which videos a person watched, tied to who they are, without consent. Search results for VPPA also turn up virtual power purchase agreements, an energy contract with nothing to do with this law.

Why are there so many VPPA settlements?

Because the Act sets liquidated damages of $2,500 per person, and a site with video can have a huge audience. AARP settled for $12.5 million in a case with about 2.9 million potential class members. If you got a notice, the settlement website named in it is where claims are handled.

Does the Video Privacy Protection Act apply to my website if I only embed YouTube videos?

None of the appeals courts in this article has ruled on a site that only embeds YouTube videos. The open questions are whether showing someone else's videos makes you a business that delivers video, and what your own tags send when the page loads. The Ninth Circuit held a cinema selling tickets isn't covered. Ask a lawyer about your own facts.