VPPA
Video Privacy Protection Act
Limits disclosure of what video a person watched; now a frequent basis for lawsuits over tracking pixels on video pages.
The law in brief
The Video Privacy Protection Act was passed in 1988 after a newspaper published a Supreme Court nominee's video rental history. It prohibits video tape service providers from disclosing information that identifies a person as having requested or obtained specific video materials, without their informed written consent.
Its modern importance comes from the web. Courts have applied it to online video, and it has become a common basis for class actions over tracking pixels that send page URLs, including video titles, together with identifiers to advertising platforms.
Who it applies to
- Video tape service providers: anyone engaged in the business of renting, selling or delivering prerecorded video cassette tapes or similar audio visual materials. Courts have applied this to streaming services and to websites that offer video content.
- Consumers: renters, purchasers or subscribers of goods or services from the provider. Courts are divided on who counts as a subscriber, for example whether a newsletter sign-up is enough.
- Personally identifiable information: information that identifies a person as having requested or obtained specific video materials or services.
What it requires
No disclosure without separate written consent
Do not knowingly disclose personally identifiable information about a consumer to anyone without informed, written consent given in a form distinct and separate from other legal obligations, either at the time or in advance for up to two years, and revocable.
Limited exceptions
Disclosure is allowed without that consent only in listed cases, such as to the consumer, to law enforcement under a warrant or order, and incident to the ordinary course of business as the statute defines it.
Destroy old records
Destroy personally identifiable information as soon as practicable, and no later than one year from the date it is no longer necessary for the purpose for which it was collected.
People's rights
Consumers must give informed, written consent, in a form distinct and separate from other legal obligations, before their viewing information is disclosed, and they can withdraw consent. They can sue for violations.
Enforcement and penalties
A private right of action for actual damages, but not less than liquidated damages of $2,500 per person, plus punitive damages and attorneys' fees. Class actions multiply the liquidated amount by the number of viewers.
What's changing
Courts are split. Federal circuits disagree on who is a consumer or subscriber and on whether pixel data identifies a person to an ordinary recipient. The outcome of a case depends heavily on the circuit; Regulatory Watch reports significant rulings.
What to do first
- Find every page with video and every tracking pixel, SDK or tag on those pages.
- Check what the pixels send: page URLs or event names containing video titles, combined with identifiers such as advertising platform IDs.
- Remove or configure tags so viewing information is not disclosed with identifiers.
- Where disclosure is needed, get VPPA consent in a separate, distinct form, not buried in terms.
- Delete viewing records no later than one year after they are no longer needed.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Recent developments
-
Supreme Court to decide VPPA consumer definition in Salazar v. Paramount Global
The ruling will determine how broadly the VPPA applies to digital video platforms and tracking technologies. The Supreme Court will hear Salazar v. Paramount Global in the October 2026 term to resolve a circuit split on the definition of “consumer” under the Video Privacy Protection Act. The case arises from a class action alleging Paramount disclosed a user’s video‑viewing history via a Meta tracking pixel without consent. Lower courts dismissed the claim, with the Sixth Circuit affirming dismissal in April 2025.
Source: EPIC. VPPA in the regulations library.
Sources
- Video Privacy Protection Act, 18 U.S.C. 2710 Office of the Law Revision Counsel · Official text or regulator