Reducing Video Privacy Protection Act Risk on a Website or App: A Practical Guide

Picture a company that sells cooking classes online. The marketing team added a tag three years ago, on a Friday, because an agency asked for it. Nobody in legal knew. Nobody in legal needed to, the thinking went, because the company is not exactly Blockbuster. Then a letter arrives from a law firm claiming to represent 1,400 of the company's customers, each said to be owed at least $2,500 under a statute named for video tapes. The chief executive does the multiplication and comes to your door.

The details are invented, but the pattern is real. A statute from 1988 now produces claims against news sites, gyms, retailers, nonprofits, and course platforms that embed a tracking pixel on pages with video. Some of the claims are weak and some are not, and the difference turns on facts your company can find out in an afternoon. This guide tells you how to find them, what to decide, and what to do if the letter has already come.

The short answer

• You can scope this quickly. Three questions decide whether the Video Privacy Protection Act, 18 U.S.C. § 2710 matters to you: Do you deliver prerecorded video as a real part of your business? Does anyone rent, buy, or subscribe to anything from you? Does a third party receive an identifier together with the video's name or address?
• Test the network traffic and do not rely on the tag list. Open a video page in a browser logged into a test Facebook account and watch what goes out. That takes minutes and answers more than any policy review.
• Choose one of four routes for each video surface. Remove the tag, strip the data, get consent in the statutory form, or accept the risk knowingly. For most non-media companies, removing identifying tags from video pages costs little.
• Do not rely on your privacy policy. The statute asks for informed, written consent in a form distinct and separate from other legal obligations, with a clear way to withdraw, lasting at most two years.
• Do not plan around one court decision. The Supreme Court granted certiorari in Salazar v. Paramount Global on January 26, 2026, heard argument on October 14, 2026, and has not yet ruled (Docket, No. 25-459). That case addresses who is a consumer. Paying customers and account holders may be protected under any outcome, so the audit is worth doing regardless.
• If a demand has arrived, preserve first and fix second. You can usually do both within a day, but in that order.

Who should run this, and how to keep it privileged

Assign three people. Counsel directs the work and holds the decisions. An engineer who can read network traffic does the testing. Someone from marketing explains what each tag is for and what would be lost without it. In a company without in-house counsel, outside counsel should retain the engineer or a forensic vendor if a dispute is reasonably foreseeable, so that the work is done at counsel's direction. Privilege protects communications made to get legal advice, and work product protects material prepared because of anticipated litigation under Fed. R. Civ. P. 26(b)(3). Neither protects the underlying facts. The tags were firing whether or not anyone wrote a memo about it, and those facts will come out in discovery if a case proceeds.

Write the audit results plainly. Avoid speculating in email about whether something "looks illegal." The people who write those emails are often the ones later asked to explain them.

Step 1: Triage in two hours

Answer these on one page. Unknown is an acceptable answer at this stage.

Are you plausibly a video tape service provider? The statute reaches a person "engaged in the business" of "rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials." The table sorts common situations, using the cases as they stand.

The in-between case is the most common. A retailer with how-to videos may be a brand marketer on one set of facts and a video provider on another. In In re Vizio, Inc., Consumer Privacy Litigation, 238 F. Supp. 3d 1204 (C.D. Cal. 2017), the test was whether the product is substantially involved in conveying video and significantly tailored to that purpose. Ask how much the video library looks like a product in its own right. Does it have its own navigation, its own sign-ups, its own advertising, or its own revenue?

Do you have consumers? The statute protects "any renter, purchaser, or subscriber of goods or services from a video tape service provider." List each way a person can have a relationship with you.

Does identity travel with the video? Only testing can answer this, which is Step 3.

If the first answer is plainly no, write down why, date it, and revisit annually or when the video strategy changes. Otherwise continue.

Step 2: Build a video inventory

Plaintiffs' complaints start with a video on your site, so yours should too. For each surface, record:

• Where it lives: page templates, subdomains, apps, connected-TV channels, and email.
• Who hosts it: your own player, or an embedded YouTube, Vimeo, Wistia, Brightcove, or similar player. Embedded players bring their own cookies and data flows, and the contract with that vendor matters.
• What it is: prerecorded, live, or a replay of live, and whether it is an advertisement, editorial content, or a paid product. The label should reflect the content and not what you wish it were.
• Who can reach it: anonymous visitors, registered accounts, paid members, or newsletter recipients through a link or an embed.
• How its address reads: does the URL or page title contain the video's name? /videos/how-to-fix-a-leaking-faucet discloses its subject. /v/88213 is less obvious, although it still identifies a specific video to anyone holding the catalog.
• Autoplay: Paramount's counsel told the Supreme Court that on many sites a video starts playing without a click. A page view can then be a video view. In Hillsdale, the court held that clicking on an individual video's page is enough to show the video was requested, even if it was not played.

An e-learning business usually gets through this quickly because its catalog is already structured. A news publisher may need to work by templates rather than individual clips.

Step 3: Audit what actually leaves the browser

The tag inventory in your tag manager tells you what you meant to do. The network log tells you what happened. Do both, in that order.

Pull the configuration. Export the tag manager container. In Meta Events Manager, record which pixels are associated with your domains, which events fire, whether automatic advanced matching is on, whether the Conversions API is connected, and whether "automatically collected events" are enabled. Do the same for TikTok, Google Ads, Google Analytics, X, LinkedIn, Pinterest, and session-replay vendors. Ask the agency what it installed. Check for pixels from former agencies, which often remain.

Test as a real user. Create a clean browser profile. Log into a test account on the platform. In a second tab, open a video page. Open the browser's developer tools, go to the Network tab, and filter by facebook, tr, or the vendor's domain. Play the video. For each outgoing request, look at:

• the request URL and its query string, including ev (the event name) and dl (the page address);
• any field carrying the page title or video name;
• the request's cookies, including c_user, fr, and datr on facebook.com, and _fbp on your own domain;
• any ud[...] fields carrying hashed customer data.

A complaint in Plotsker v. Envato Pty Ltd., No. 2:24-cv-04412 (C.D. Cal. Aug. 26, 2025) alleged that the c_user cookie carried an unencrypted Facebook ID, and that a separate fr cookie was sent even after logout, so test both logged-in and logged-out states. Then repeat as a paying member, as a newsletter subscriber arriving from an email link, in a browser with third-party cookie blocking on, in your mobile app using a proxy tool, and with the consent banner in each of its states. Save the request log (a HAR file) and screenshots, dated, under counsel's direction.

Check the server side. Ask engineering whether anything is sent server to server: Conversions API, a customer data platform, or an analytics export. A server-side event removes the argument that the user's browser, and not the company, made the disclosure. In Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025), the court rejected even the browser-based version of that argument at the pleading stage.

Check the record of change. Find out when each tag was added, by whom, and for what stated purpose. A plaintiff will ask, and the two-year limitations period in § 2710(c)(3) will make the date matter.

Write down what you found, by surface. A simple grid is enough:

The working papers in Video Privacy Toolkit: Consent Language, Pixel Audits, and Litigation Response include this grid in copyable form. The wider method is in Auditing Your Website Tracking Stack: A Practical Guide.

Step 4: Sort your audience by consumer status

Now map people to legal categories, keeping the pending Supreme Court question in mind.

The practical insight is that the Supreme Court case will sort rows three through five. It should not move rows one and two much, and those rows are where a subscription business's money is.

Step 5: Map where you can be sued

Forum shapes everything, because the two big splits run in different directions. A claim can be filed where a defendant is subject to jurisdiction, generally including its home and sometimes a plaintiff's home where it does business. Class claims can reach federal court under 28 U.S.C. § 1332(d), and the private right of action itself refers to a federal district court. Check these against your footprint:

• Second Circuit. A broad consumer rule, but Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025) and Hughes v. National Football League, No. 24-2656 (2d Cir. June 20, 2025) (summary order) make standard pixel claims hard to sustain.
• Third and Ninth Circuits. The ordinary-person test. In the Ninth Circuit, district courts have found FID allegations sufficient on the pleadings (Stark v. Patreon, Inc., No. 22-cv-03131 (N.D. Cal. Oct. 13, 2022); Plotsker v. Envato Pty Ltd., No. 2:24-cv-04412 (C.D. Cal. Aug. 26, 2025)).
• First Circuit. A foreseeability test (Yershov v. Gannett Satellite Information Network, Inc., 820 F.3d 482 (1st Cir. 2016)).
• Sixth and D.C. Circuits. A narrow consumer rule, now under review. District courts in the Sixth Circuit have been receptive on identifiability (Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025)).
• Seventh Circuit. A broad consumer rule (Gardner v. Me-TV National Ltd. Partnership, 132 F.4th 1022 (7th Cir. 2025)) with no circuit ruling on identifiability.

Then check your contract. If your terms have a forum clause, as in Dougherty v. Zynga Inc., No. 25-cv-04051 (N.D. Cal. Mar. 31, 2026), or an arbitration clause, the map may be different. Review whether users truly assented, which is Step 10. For deeper treatment of the federal forum, see Getting Into or Staying Out of Federal Court: A Practical Guide to Jurisdiction and Removal.

Step 6: Choose a route for each surface

There are four routes. You can choose differently for different surfaces.

Route A is the default for companies whose video is incidental. A brand that puts 40 how-to videos on a marketing site gets little from retargeting those viewers. Remove the tag from those templates and move on. Make sure the fix applies to apps and to whichever tag manager rule actually fires.

Route B has several levels. You can configure a video page to send a generic event, such as a custom "VideoView" event, with no title. You can scrub the URL and referrer before they are transmitted. You can also keep the title and drop identity, which is what a privacy-configured analytics tool aims to do. Two cautions apply. Swapping a video's name for a numeric ID is weak protection, since the recipient may have a catalog or the ID may be resolvable. And a defendant cannot hide behind the Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025) format argument indefinitely without accepting the risk that a court follows Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025), which said encryption or coding between parties who both understand it does not save a disclosure.

Route C makes sense where the marketing value is high and the audience will reasonably agree, such as a fitness app that promotes social sharing. Step 7 shows how.

Route D is a legitimate business choice in a few settings, such as a defendant confident it is outside the definition of provider. But knowing what your tags do and leaving them in place weakens the knowledge defense that In re Hulu Privacy Litigation, 86 F. Supp. 3d 1090 (N.D. Cal. 2015) offered to a company whose employees did not know how Facebook used the data. Have counsel record the decision. The people who make it should understand that a later judge may read that record.

A worked example: the online cooking school

Suppose a fictional company, Sagebrush Culinary, sells $25 monthly memberships to 600 on-demand cooking lessons and also has 200 free recipe videos on its public blog. It has 40,000 members, 300,000 newsletter subscribers, and headquarters in Ohio. Its audit finds the Meta Pixel on every page, with page addresses containing lesson names, and c_user traveling in logged-in browsers.

Provider? Yes. Memberships to lessons are the business. Consumers? Members, in every circuit. Newsletter subscribers depend on Salazar. Identifiability? As a company headquartered in Ohio, it faces Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025)-style reasoning, and it cannot count on Solomon there.

Exposure, as a matter of arithmetic. If one in five members watched one lesson while logged into Facebook in a two-year window, the plaintiff's number is 8,000 people at $2,500, or $20 million, and the per-video reading in Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025) would raise it further. That number is not a likely outcome, and a settlement rarely resembles it, but it is the number that will be in the demand. Martinez and Jancik show that proving who was affected is a real fight.

Decision. Sagebrush removes the pixel from member lesson pages today, since the audience is already paying and retargeting them has little value. It strips titles from blog events, keeping general page-view measurement for acquisition. It preserves the old configuration. It then builds a consent screen for members who want social recommendations, as a product feature. Marketing loses some lookalike data and keeps acquisition reporting. That is a trade worth making for most businesses in this position.

Step 7: Build consent that matches the statute

Section 2710(b)(2)(B) gives the elements. The design question is how to satisfy each one in a real interface.

Sample consent text follows. Adapt it to your facts, and do not leave a name in that does not match the recipient.

Share what you watch with Meta?

If you say yes, [Company] will send Meta Platforms, Inc. information that can identify you, such as your Facebook ID, along with the titles of videos you watch on [Service]. Meta and [Company] may use this to show you ads and measure how they perform, on our service and on others.

This is your choice, and you can use [Service] either way. Your answer lasts for 2 years unless you change it sooner. You can change it at any time under Settings > Video Sharing, or by using the control on any video page.

[Yes, share] [No, don't share]

Next come engineering points that often get missed:

• The tag must not fire until consent is recorded. Firing first and asking afterwards defeats the point. Test each banner state in Step 3's network view.
• Log a real record. Log the user or session identifier, timestamp, the version of the text and screen, the choice, the expiry date, and every withdrawal. Keep a screenshot of each version.
• Handle "no" properly. The site must behave as promised. A consent manager that is misconfigured for one region produces a worse record than no banner at all.
• Think about who is being asked. A statute protecting consumers does not stop you from asking everyone. At the Supreme Court argument, Paul Clement complained that providers cannot tell who bought something and so will have to ask everyone; Justice Kavanaugh agreed that consent would be overbroad but said it remained an easy fix. Asking every viewer of a video is the safe design.
• Think about children. If your audience includes children, a parent's consent and COPPA Children's Privacy Compliance Checklist: A Practical Checklist come first.

How much will a court hold you to the letter? That remains undeveloped, because many consent defenses are deferred past the pleadings. Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024) and Hughes v. National Football League, No. 24-2656 (2d Cir. June 20, 2025) (summary order) both left the privacy-policy argument for the district court, and Hughes noted the dispute over whether a policy disclosed sharing or only collection. Design for the strictest reading, because a banner is cheap compared to a dispute over its wording. Mr. Clement told the Court that plaintiffs have argued even website consents were not clear enough, and you should assume they will keep doing so.

For the general law of online assent to a disclosure, see Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records. For what makes an electronic signature binding, see Electronic Signatures and Records Under ESIGN and UETA: What Actually Binds.

Step 8: Fix the vendor relationships

Three contract questions matter.

What have you promised the platform? Meta's Business Tools Terms require a business to represent that it has the necessary rights, permissions, and legal basis to share the data, and that end users have given any legally required consent where cookies or similar tools are used. They also restrict sharing data in sensitive categories. Read the current version. That representation runs from you to Meta, so a VPPA problem can also be a contract problem, and the platform's terms will not rescue you.

Can you fit a vendor within the ordinary-course exception? Section 2710(b)(2)(E) allows disclosures incident to "debt collection activities, order fulfillment, request processing, and the transfer of ownership," and nothing else. Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618 (7th Cir. 2014) held that an outsourced call center qualified, even when records were used to train agents. So did a transfer of operations between Sony affiliates in Rodriguez v. Sony Computer Entertainment America, LLC, 801 F.3d 1045 (9th Cir. 2015). A real service provider, such as a video host, content delivery network, or support platform, can usually be fitted within those terms if the contract limits use. An ad platform that uses the data for its own purposes is a poor fit. District courts have been skeptical of marketing and analytics, as Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025) collects. Your contract should say:

• the vendor uses viewing data only to perform named services for you;
• no combination with other data, no use for the vendor's own products or advertising, and no onward disclosure;
• deletion on instruction and at the end of the term;
• notice of legal demands, since a recipient under the (D) and (E) exceptions becomes a provider itself as to that information under § 2710(a)(4).

Who controls the tags? Agencies and marketing platforms add tags. Adopt a change-control rule: no new third-party script on video templates without review. Assign an owner, run the network test quarterly, and rerun it after a site redesign. For the vendor side, see Building a Vendor and Third-Party Risk Management Program, and for the contract mechanics, Adtech Privacy Toolkit: Tag Inventories, Consent Records, and Litigation Defense.

Step 9: Retention, policies, and legal demands

Retention. Section 2710(e) requires you to destroy personally identifiable information "as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected," unless a request or court order is pending. Sterk v. Redbox Automated Retail, LLC, 672 F.3d 535 (7th Cir. 2012) and Rodriguez v. Sony Computer Entertainment America, LLC, 801 F.3d 1045 (9th Cir. 2015) held that this does not support a damages suit. It is still the law. It may be enforceable by injunction, and over-retention creates breach risk and discovery burdens. Set retention for watch histories, event logs, and exports. Decide how long recommendations truly need the history. See Data Minimization and Avoiding the Over-Retention of Personal Information.

Policies. Your privacy policy should match reality, and it should not make promises you cannot keep. In In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016), a Nickelodeon registration page saying "We don't collect ANY personal information about your kids" kept an intrusion claim alive after the VPPA claim failed. In Stark, the plaintiffs pointed to a promise not to provide data to third parties for marketing without consent. A false statement can also draw deception claims under 15 U.S.C. § 45 and state law. See Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC.

Legal demands for viewing records. Sections 2710(b)(2)(C) and (F) and (b)(3) set conditions for law enforcement and civil requests, including a warrant, grand jury subpoena, or court order with prior notice to the consumer in the case of court orders under (C), and a showing of compelling need for civil orders. An ordinary civil subpoena does not by itself meet (F). Route these to counsel. Section 2710(d) excludes improperly obtained records from evidence.

Step 10: Decide what your arbitration clause is for

Class waivers remain enforceable under AT&T Mobility LLC v. Concepcion, 563 U.S. 333 (2011) and Epic Systems Corp. v. Lewis, 584 U.S. 497 (2018) if assent is shown. For a business with many users, a clause can trade one class action for thousands of individual claims with filing fees. Powers v. Discovery Communications LLC, No. 25-cv-6398 (S.D.N.Y. June 3, 2026) involved 4,225 people claiming under the VPPA alone. Think it through before a dispute.

Formation first. Courts focus on conspicuous notice and an unambiguous manifestation of assent (Berman v. Freedom Financial Network, LLC, 30 F.4th 849 (9th Cir. 2022); Nguyen v. Barnes & Noble Inc., 763 F.3d 1171 (9th Cir. 2014); Meyer v. Uber Technologies, Inc., 868 F.3d 66 (2d Cir. 2017)), and a link at the bottom of the page is unlikely to do. Chabolla v. ClassPass Inc., 129 F.4th 1147 (9th Cir. 2025) refused to enforce a multi-screen sign-in design. Sellers v. Bleacher Report, Inc., No. 23-cv-00368 (N.D. Cal. July 28, 2023) found insufficient evidence of assent to a class waiver in a footer notice. Newsletter forms are frequently weak here. Add terms acceptance where it counts, with a record.

Choice of forum and rules. Mass-arbitration protocols vary. Heckman v. Live Nation Entertainment, Inc., 120 F.4th 670 (9th Cir. 2024) struck down a clause using New Era's rules under California law. Do not copy a clause because a large company used it.

Changes to the clause. Discovery's January 2023 update came days after individual claims were noticed, and an earlier decision sorted users by when their subscriptions ended, as Powers v. Discovery Communications LLC, No. 25-cv-6398 (S.D.N.Y. June 3, 2026) recounts. Expect any update made after claims start to be challenged, and give notice and an opt-out.

Fee strategy. Wallrich v. Samsung Electronics America, Inc., 106 F.4th 609 (7th Cir. 2024) held that consumers could not compel Samsung to pay fees after the American Arbitration Association closed the matters, leaving the claims free to go to court. Refusing to pay can return you to a class action, which you may have wanted to avoid. If you intend to arbitrate, use the right promptly, because Morgan v. Sundance, Inc., 596 U.S. 411 (2022) removed any prejudice requirement for waiver. If you are denied arbitration, you can appeal and get a stay under Coinbase, Inc. v. Bielski, 599 U.S. 736 (2023).

The clause language options are in Mass Arbitration Toolkit: Clause Architecture, Batching Protocols, and Response Plans, and the program design is in Designing a Consumer Arbitration Program That Survives Mass Filings: A Practical Guide.

Step 11: When the demand letter arrives

Same day. Issue a litigation hold. A duty to preserve attaches when litigation is reasonably foreseeable, and Fed. R. Civ. P. 37(e) applies when electronically stored information is lost. Preserve the tag manager container and its version history, Events Manager settings and history, consent logs, site templates, marketing emails about the tags, and video logs. Take a HAR capture of current behavior before anyone changes anything. Then fix. Stopping an ongoing disclosure is sensible, and preservation means capturing the old state first. A company that deletes its tags in a panic without capturing them will have to explain why its evidence is gone. See Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case.

This week. Notify insurers, since policies may respond in unexpected ways and late notice is an unforced error. Read the demand and identify the claimed provider, the claimed consumer theory, the data alleged, and any arbitration basis. Check whether claimants have identified themselves. Ask whether the people named really have accounts with you, and whether they were customers when the tag fired. In a mass claim, a name list deserves testing, and Powers v. Discovery Communications LLC, No. 25-cv-6398 (S.D.N.Y. June 3, 2026) shows why.

Respond with substance. Say what you can verify. Do not make factual statements about your tags until the audit confirms them. Do not state that "we don't share data with third parties" as a reflex. If you discuss resolution, mark the communication as subject to Fed. R. Evid. 408. If limitations matter, weigh a tolling agreement rather than a filed complaint. A template appears in Video Privacy Toolkit: Consent Language, Pixel Audits, and Litigation Response, and the general approach is in Responding to a Consumer Class Action Demand Letter.

Assess your defenses honestly. In order:

1. Formation and arbitration, because filing a merits motion first can waive it (Morgan v. Sundance, Inc., 596 U.S. 411 (2022)).
2. Provider status: marketing videos, a theater, live-only content.
3. Consumer status under your circuit's rule, with Salazar pending.
4. Identifiability under your circuit's rule.
5. Knowledge, on the actual facts, including who set up the tag and what they understood.
6. Consent, if real.
7. Standing, using Popa v. Microsoft Corp., No. 24-14 (9th Cir. Aug. 26, 2025) and Hunstein v. Preferred Collection & Management Services, Inc., 48 F.4th 1236 (11th Cir. 2022) (en banc) where they fit, with the awareness that every circuit to rule on a VPPA claim has so far found standing, including Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024), Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025), and Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025).
8. Limitations, under § 2710(c)(3).

Consider moving for a stay if the decision in Salazar would be dispositive. A motion to dismiss under Fed. R. Civ. P. 12 can be powerful in the right circuit. Motions to Dismiss Under Rule 12: A Practical Guide for Plaintiffs and Defendants covers the mechanics.

A worked example: the regional newspaper

Suppose a fictional paper, the Millbrook Courier, gets a demand from a firm representing 200 readers. The paper's site has news clips that play on article pages, an email newsletter with links to clips, and a print and digital subscription. Its pixel sends page addresses with story slugs.

The Courier's counsel starts with who the 200 are. Print and digital subscribers paid for a publication that also delivers video on the site. Under Paramount and Pileggi, if the Courier is in a Sixth or D.C. Circuit court, a print subscriber likely did not subscribe to video, while a digital subscriber whose subscription includes video has a better argument. Newsletter-only readers are exactly the Salazar group. Clips reachable by anyone are helpful to the defense in Pileggi's reasoning, but a clip behind the paywall is not. Next, identifiability: if the Courier is in New York, Solomon gives a strong motion. Elsewhere it depends. Then whether short news clips are "similar" to a cassette, on which only a concurrence has spoken for the defense so far.

The right response is a measured letter that asks for each claimant's identity and basis, notes the pending Supreme Court case, and proposes a tolling agreement and a short standstill. The Courier meanwhile preserves its old configuration, removes the pixel from article templates with video, and stops telling readers in its policy that it "does not share personal information." It has spent little and improved its position with every step.

The plaintiff's view: evaluating and bringing a claim

Good claims are not hard to tell from bad ones, and a plaintiff's lawyer should do the same sorting before filing.

Start with the client's relationship. A paying subscriber or a registered account holder avoids the Salazar question. A newsletter subscriber or a purchaser of an unrelated item needs the right circuit and a good answer to the pending case. In a narrow-reading circuit, plead facts connecting the subscription to the video: gated access, delivery through the newsletter, clicks through newsletter links. Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025) left that question open, and Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025) faulted a complaint that did not allege it.

Document the transmission. Ask whether the client had a Facebook account in that browser, on what device, and during which period. Ask for the client's off-Facebook activity report, the same kind of record the plaintiff used in Osheske v. Silver Cinemas Acquisition Co., 132 F.4th 1110 (9th Cir. 2025). Capture the site's behavior before filing, preferably with the client's own session or a controlled test that an expert can explain. A hypothetical profile and a generic screenshot gave the court in Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025) something to criticize. Remember that the fix may have happened by the time you investigate, so public archives and prior complaints can help.

Pick the forum. After Solomon and Hughes, a standard pixel claim in the Second Circuit needs something new, and the court has already rejected ChatGPT and plain-text-rendering theories. Elsewhere, Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025) and Manza give strong reasoning. Check the client's contract with the site first, including arbitration and forum clauses. Under Dougherty v. Zynga Inc., No. 25-cv-04051 (N.D. Cal. Mar. 31, 2026), a clickwrap forum clause moved a California case to New York.

Plead each element. Provider: the video library's role in the business, not merely its existence. Consumer: the exchange and the value given. Identifiability: what was sent, in what format, what the recipient reads, and how an ordinary person could use it. Knowledge: configuration choices, the purpose of the tag, and what the defendant was told. Absence of consent under each statutory element. Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007) and Ashcroft v. Iqbal, 556 U.S. 662 (2009) apply. If you think you may need to amend, do it properly under Fed. R. Civ. P. 15; both Solomon and Paramount affirmed denial of leave requested in a footnote.

Think about class or mass. Jancik v. WebMD LLC, No. 1:22-cv-644 (N.D. Ga. Feb. 20, 2025) certified classes based on the expected Meta event data, and Martinez v. D2C, LLC, No. 23-21394 (S.D. Fla. Oct. 1, 2024) denied one because the plaintiffs had little proof that the pixel transmitted data for enough members. Retain a technical expert early. Under Rule 23 and cases such as Comcast Corp. v. Behrend, 569 U.S. 27 (2013) and Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338 (2011), the question is whether common proof can show who was disclosed. For mass arbitration, know that your roster is going to be tested and that an assignment or aggregation device can fail, as the 927 assignments did in Stark v. Patreon, Inc., No. 22-cv-03131 (N.D. Cal. July 8, 2025).

Consider the realistic remedy. The floor is $2,500 per the statute. The court "may award" it, and that verb will be argued. Fees are available, punitive damages are available, and injunctive relief often matters more to a client than the check. Limitations run two years from the act or discovery.

For an individual who is worried about their data. You do not need a lawsuit to take sensible steps. Check your off-Facebook activity in your account settings, disconnect it, and log out of social accounts in the browser you use for sensitive viewing. If you think a site disclosed what you watched and you paid for or registered with the service, save what you can and talk with a lawyer before the two-year period runs. For broader steps, see Protecting Your Personal Information: A Practical Guide.

What to do when the Supreme Court rules

Prepare a short decision memo now, because the opinion in Salazar v. Paramount Global will move fast through plaintiffs' firms. Read it for four things:

• The holding on "goods or services." If broad, re-examine your newsletter, purchaser, and app populations everywhere. If narrow, check whether your paid and registered populations are still fully exposed, and look for how the Court treats registered viewing accounts.
• Anything said about provider status. Several Justices doubted that a general site with videos qualifies. Dictum could change your Step 1 table.
• Standing. If the Court addresses it, watch for whether a machine-readable transmission to one company is enough. A ruling for defendants may send cases out of federal court.
• The treatment of consent. Remarks at argument suggest the Justices view consent as simple. An opinion saying so would help businesses that adopted real consent screens, and provide no help at all to anyone relying on a policy link.

Do not unwind your controls until you have read the opinion, and do not assume that a win for Paramount removes your risk.

Common mistakes

• Reading the privacy policy instead of the network log. The disclosure happens in traffic. A compliant-sounding policy does not stop a request.
• Assuming "we're not a media company" is the end of the analysis. A nonprofit college with free lectures was held plausibly covered in Hillsdale.
• Assuming a win in New York travels. Solomon binds only in the Second Circuit, and other courts have expressly disagreed.
• Treating a banner as consent. A cookie notice is generally not informed, distinct, and separate, and it often fires tags first.
• Burying consent in terms of use or at checkout. The statute says distinct and separate, and it says so for a reason.
• Forgetting the two-year clock on consents. Advance consent expires. Put the expiry date in the record.
• Removing the pixel from the website and leaving it in the app. Test every surface.
• Deleting first. Removal before preservation invites a spoliation dispute under Fed. R. Civ. P. 37(e).
• Fixing one vendor only. The next demand will mention a tag from another platform.
• Relying on retention being unenforceable. There may be no damages claim under Sterk and Rodriguez, but the duty remains and the data remains discoverable.
• Rewriting the arbitration clause mid-dispute without a plan. Expect a fight about which version applies.
• Requesting leave to amend in a footnote. Two circuits have now affirmed denial in that posture.
• Betting the company on a pending case. Oral argument is not a ruling. Paying subscribers and account holders may lose nothing whichever way the Court goes.

A timeline you can use

A company with few templates can finish in days. A publisher with many properties will take the full quarter, and it should begin with the templates with the highest traffic. A one-page tracking list is in Video Privacy Protection Act Compliance Checklist: A Practical Checklist, and the reasoning behind these steps is in The Video Privacy Protection Act in the Age of Pixels: Who Is a Consumer and What Counts as Personally Identifiable.

If your videos cover health topics or your audience includes minors, add Bringing a Health App Into Compliance With Consumer Health Data Laws: A Practical Guide or Deciding Whether Your Website or App Must Verify Age: A Practical Guide to the plan, because those regimes have their own rules for this same data. If you later face a breach of the same logs, Defending or Bringing a Data Breach Class Action: A Practical Guide covers what comes next.

This guide offers general information, and the right steps for your site depend on facts no guide can see, so please treat it as a starting point and not as legal advice. If you want a second set of eyes on an audit or a demand, a lawyer who reads network logs as readily as opinions can usually narrow the problem in one conversation.

Related Documents

Related Articles

• The Video Privacy Protection Act in the Age of Pixels: Who Is a Consumer and What Counts as Personally Identifiable: the doctrine, the splits, and the Supreme Court case behind these steps.
• Tracking Pixels, Session Replay, and the Wiretapping Lawsuits Reshaping Adtech: the wiretap claims that usually arrive with VPPA claims.
• Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims: standing arguments in depth.
• Mass Arbitration: How Thousands of Individual Claims Became a Strategic Problem: what a wave of demands looks like.
• Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case: preservation before you change anything.
• Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC: making the policy accurate.
• Electronic Signatures and Records Under ESIGN and UETA: What Actually Binds: what makes an electronic consent record stand up.

Related Guides

• Auditing Your Website Tracking Stack: A Practical Guide: the audit method for every tag, not only those near video.
• Responding to a Consumer Class Action Demand Letter: general demand letter practice.
• Motions to Dismiss Under Rule 12: A Practical Guide for Plaintiffs and Defendants: the motion and its timing.
• Designing a Consumer Arbitration Program That Survives Mass Filings: A Practical Guide: clause and program design.
• Data Minimization and Avoiding the Over-Retention of Personal Information: retention rules for viewing data.
• Building a Vendor and Third-Party Risk Management Program: controlling agencies and tools.
• Getting Into or Staying Out of Federal Court: A Practical Guide to Jurisdiction and Removal: a batch companion on the forum question.
• Bringing a Health App Into Compliance With Consumer Health Data Laws: A Practical Guide: a batch companion for health video and apps.
• Deciding Whether Your Website or App Must Verify Age: A Practical Guide: a batch companion for services with minors.
• Defending or Bringing a Data Breach Class Action: A Practical Guide: a batch companion on privacy class actions.
• Protecting Your Personal Information: A Practical Guide: steps for individuals.

Related Checklists

• Video Privacy Protection Act Compliance Checklist: A Practical Checklist: this guide's tasks in check-off form.
• Website Tracking Compliance Checklist: A Practical Checklist: the broader tracking checklist.
• COPPA Children's Privacy Compliance Checklist: A Practical Checklist: for child-directed video.

Related Toolkits

• Video Privacy Toolkit: Consent Language, Pixel Audits, and Litigation Response: the audit grid, consent language, vendor terms, and letters in copyable form.
• Adtech Privacy Toolkit: Tag Inventories, Consent Records, and Litigation Defense: tag inventories across the stack.
• Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records: consent flows and change records.
• Mass Arbitration Toolkit: Clause Architecture, Batching Protocols, and Response Plans: clause options and response plans.