The Video Privacy Protection Act in the Age of Pixels: Who Is a Consumer and What Counts as Personally Identifiable

In the fall of 1987 a reporter for a Washington weekly walked away with a list of the movies Robert Bork and his family had rented from a neighborhood video store. There were 146 titles. Judge Easterbrook, writing nearly four decades later, summarized the scandal with some relish: the family "watched Hitchcock mysteries, John Hughes comedies, British costume dramas, and spy thrillers," and nobody turned up any dirt. Congress was appalled anyway, and the judge dryly added that some members "may have had other viewing predilections." A statute followed in a little over a year.

On October 14, 2026, that statute reached the Supreme Court, and the argument had moved a long way from the video store. Paul Clement told the Justices that goods or services from a video tape service provider cannot mean "chicken sandwiches or dog bandanas." Justice Kagan asked whether consent is just "one of those cookies boxes that comes up." After Clement called a string of encoded characters "gobbledegook" while discussing standing, Justice Barrett asked whether that string is even personally identifiable information if "only a computer can figure out what this means." Those are quotations from the official transcript of the October 14, 2026 argument in Salazar v. Paramount Global, No. 25-459, and they mark how far the Video Privacy Protection Act (VPPA) has traveled from a clerk handing a list across a counter.

The short answer

18 U.S.C. § 2710 makes a "video tape service provider" liable for knowingly disclosing a consumer's "personally identifiable information" to any person, with narrow exceptions, and it sets the floor at $2,500. Plaintiffs now use it against websites and apps that run a third-party tracker, usually the Meta Pixel, on a page with a video. Whether such a claim works depends on four questions, and each has a different state of play.

• Is the defendant a video tape service provider? Courts generally treat streamed prerecorded video as "similar audio visual materials." They have rejected claims against movie theaters and, in several district court rulings, businesses whose only videos are marketing. The Supreme Court did not take this question, but several Justices spent much of the argument on it.
• Is the plaintiff a consumer? This is the question before the Court. The Second and Seventh Circuits say a subscriber to any good or service from the provider counts, including a free newsletter. The Sixth and D.C. Circuits say the good or service must be audiovisual. The Court granted certiorari on January 26, 2026, heard argument on October 14, 2026, and has not yet ruled. Check Docket, No. 25-459 before relying on anything below about this split.
• Is a Facebook ID plus a video title personally identifiable information? The Second, Third, and Ninth Circuits ask whether an ordinary person could use the data to identify what someone watched. Under that test the Second Circuit has held that the pixel transmission pleaded in Solomon did not qualify, and a later panel said that ruling effectively shut the door on standard pixel claims. The First Circuit uses a foreseeability test, and a growing group of district courts outside those circuits reject the ordinary-person test outright.
• Did the person consent in the way the statute requires? A sentence in a privacy policy is a weak answer. The statute requires informed, written consent in a form "distinct and separate" from other legal obligations, with a clear way to withdraw, and advance consent lasts at most two years.

For businesses, the practical point has barely moved through all of this litigation: the statute's exposure can be removed by stopping the identified transmission or getting consent in the form the statute describes. For plaintiffs, the claim is now highly dependent on the forum. For everyone else, this is one of the cleanest modern examples of what happens when a narrow statute with a fixed damages floor meets a technology that performs the regulated act millions of times a day.

How a video store scandal produced a federal privacy statute

The VPPA grew out of a specific embarrassment. A newspaper published what the Senate report called a profile of Judge Bork containing the titles of films he and his family had rented, while the Judiciary Committee was holding his confirmation hearings. Senators of both parties reacted fast. Senator Leahy's statement, reproduced in Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024), warned about computers that could "give a profile of a person and tell what they buy in a store, what kind of food they like, what sort of television programs they watch." He called that Big Brother, in 1987, about a video store.

The bill became the Video Privacy Protection Act of 1988, Pub. L. No. 100-618, 102 Stat. 3195. The Senate report, S. Rep. No. 100-599, describes its central idea as the principle of the Privacy Act of 1974: information collected for one purpose may not be used for a different purpose without the individual's consent. That origin explains the statute's shape. It is built around a transaction between a customer and a merchant, and around a merchant's decision to hand a record to someone else. It regulates the discloser. It has very little to say about the recipient, about aggregation, or about inference, because in 1988 the threat was a clerk and a reporter.

Two details from the Senate report keep coming back in the modern cases. One is that "includes" in the definition of personally identifiable information was chosen deliberately to set a floor. The other is a department store example: a store that sells video tapes must protect only the transactions involving video tapes and not its other products. Both sides of the current split quote that department store sentence with confidence, which tells you something about legislative history.

For about 25 years the statute did little work. Congress returned to it once, and the return is revealing. Video services wanted users to be able to share viewing activity on social media on an ongoing basis, and the original statute was understood to require consent for each disclosure. The Pub. L. No. 112-258, 126 Stat. 2414, titled the Video Privacy Protection Act Amendments Act of 2012 although it was signed in January 2013, amended the consent provision and nothing else of substance. The definitions stayed as they were, even though the Electronic Privacy Information Center asked Congress in written testimony to add IP addresses and account identifiers (In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016) recounts it). Courts read that history in opposite directions. The Third Circuit took the inaction to mean that Congress chose not to modernize the definition of personally identifiable information. The First Circuit took it to mean that Congress knew about streaming and left the protection in place.

What the statute actually says

Read 18 U.S.C. § 2710 with a pencil. It is short, and the Seventh Circuit's description has held up: the statute is "not well drafted" (Sterk v. Redbox Automated Retail, LLC, 672 F.3d 535 (7th Cir. 2012)). In Sterk, Judge Posner flagged a plain drafting error. Subsection (b)(1) says a violator is liable "for the relief provided in subsection (d)," but subsection (d) is an evidence rule and the remedies are in subsection (c).

A few structural points deserve a sentence each, because they are often missed.

The statute is civil only, despite its home in Title 18 (Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025), note 1). Only a provider can violate the disclosure ban: Daniel v. Cantrell, 375 F.3d 377 (6th Cir. 2004) rejected the argument that "any person" can be sued, and In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016) held that plaintiffs may sue a person who discloses and not a person who receives. That is why Meta is rarely the VPPA defendant in these suits and the publisher is. Retention violations do not support damages: Sterk v. Redbox Automated Retail, LLC, 672 F.3d 535 (7th Cir. 2012) and Rodriguez v. Sony Computer Entertainment America, LLC, 801 F.3d 1045 (9th Cir. 2015) both held that subsection (c) reaches only disclosure claims, reasoning from where subsection (c) sits and from the absence of any harm until a record leaves the building. In the same Sterk opinion, Judge Posner observed that a plaintiff who seeks only to enjoin an unlawful act needs no express statutory authorization, which leaves injunctive relief as the realistic remedy for a retention violation. And the Second Circuit has summarized a plaintiff's pleading burden as three elements: a provider knowingly disclosed to any person personally identifiable information concerning her use of the service (Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025)). The other circuits break the elements up differently, but consumer status always appears somewhere.

What a pixel actually does on the wire

Courts decide these cases on allegations, and allegations often describe the technology loosely. It helps to know what happens when a person loads a page.

A website operator pastes a snippet of JavaScript, supplied by Meta, into its pages, or loads it through a tag manager. When a browser renders the page, it fetches Meta's script and runs it. The script then sends one or more requests from the visitor's browser to a Meta server. Each request carries data in its web address. Nothing leaves the publisher's own server in this flow. The publisher's code told the visitor's browser to make the call.

A decision from the Western District of Michigan reproduces a real example from a complaint, in Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025). Shortened, it reads:

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=711322226445334
  &ev=PageView
  &dl=https%3A%2F%2Fonline.hillsdale.edu%2Fcourses%2Fpromo%2Ftotalitarian-novels
  &rl=&if=false&ts=1740630825595 ...

The id is the site's pixel. The ev parameter names the event, here a page view. The dl parameter is the address of the page being viewed, percent-encoded, which is why colons and slashes turn into %3A and %2F. If the page address includes the video or course name, so does the request. Other configurations send the page title, which is how the phrase "The Roast of Ric Flair" ended up in the exhibit quoted in Solomon, wrapped in percent signs.

Now the identity half. When someone logs into Facebook, Facebook's servers set cookies in that person's browser, small text files scoped to the facebook.com domain. One of them, c_user, holds the numeric Facebook ID (FID), a number unique to the account. Because a browser automatically attaches a domain's cookies to requests going to that domain, the pixel request can arrive at Facebook carrying both the page address and the c_user value, depending on the browser and its settings. The publisher's own code does not read c_user and cannot, since it belongs to another domain. As the Second Circuit described the allegations, only Facebook's servers can access those cookies (Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025)).

This architecture has legal consequences at four points.

First, the disclosure argument. Defendants have argued that the browser and the user sent the data, and that the site merely hosted a script. The Second Circuit noted that argument in Solomon without reaching it. In Hillsdale the court rejected it at the pleading stage, reasoning that installing code knowingly causing the transmission establishes responsibility, and it distinguished Mollett v. Netflix, Inc., 795 F.3d 1062 (9th Cir. 2015), where Netflix subscribers themselves decided who could see their own queue on their own television. There is no appellate holding squarely on this point.

Second, the two-pieces argument. The page address is the same for every visitor and identifies a video; the cookie identifies a person and says nothing about a video. In In re Hulu Privacy Litigation, 86 F. Supp. 3d 1090 (N.D. Cal. 2015), the magistrate judge granted summary judgment for Hulu because the plaintiffs offered no proof that Hulu knew Facebook would combine the two. Later complaints try to close that gap by alleging that operators choose and configure what the pixel collects, as the complaints in Solomon and Hillsdale did.

Third, variation among users. A logged-out visitor, a visitor in a browser that blocks or partitions third-party cookies, or a visitor without a Facebook account generates a different request. Hillsdale treated that as a class-size question rather than a defense to the named plaintiffs' claim. Class certification records turn on it, as discussed below.

Fourth, the newer tools. The Conversions API sends event data from the operator's server to Meta directly, and in that flow the "the browser did it" argument is gone. Advanced matching sends hashed customer identifiers such as email addresses, which raises a separate question about whether a hash an ordinary person cannot read but the recipient can match is any different from an FID. No appellate decision appears to resolve how the statute applies to either tool, and the reported cases are overwhelmingly about the browser pixel. For a wider treatment of tag technology and wiretap theories, see Tracking Pixels, Session Replay, and the Wiretapping Lawsuits Reshaping Adtech.

Who is a video tape service provider

The defined term is an antique, and it has held up better than the words suggest. Under 18 U.S.C. § 2710, the question is whether the defendant is engaged in the business of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.

Streaming counts, for now. Judge Easterbrook wrote in Gardner v. Me-TV National Ltd. Partnership, 132 F.4th 1022 (7th Cir. 2025) that the word "similar" and the reference to delivery make the statute relevant to streamed video. District courts have generally agreed, reasoning that the phrase concerns the video content and not how it is delivered (Stark v. Patreon, Inc., No. 22-cv-03131 (N.D. Cal. Oct. 13, 2022)). The contrary view has a serious advocate. Senior Judge Randolph, concurring in Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025), would have held that a news site's short clips are not "similar" to a cassette, reasoning from Delaware v. Pennsylvania that similarity turns on function and operation, and from the Senate report's examples of laser disks, open-reel movies, and CDI technology, all physical media. "Technology has overtaken this federal statute and has rendered it largely obsolete," he wrote. At the Supreme Court, Justice Thomas and Justice Alito pressed the same doubts, and even Paramount's counsel said that Netflix "might still be covered" while allowing that streaming raised a good question. Paramount did not contest this element in the Sixth Circuit, so the question is not formally presented, but a sentence from the Court on the subject would matter a great deal.

Theaters do not count. The Ninth Circuit held in Osheske v. Silver Cinemas Acquisition Co., 132 F.4th 1110 (9th Cir. 2025) that selling tickets to an in-theater screening is not the business of rental, sale, or delivery of audiovisual materials. The defendant's pixel fired on the ticket purchase and sent the film name, the location, and the FID. The court read "delivery" alongside "rental" and "sale" and limited it accordingly.

Businesses whose only videos are marketing often do not count. The district court decisions collected in Hillsdale include Carroll v. General Mills, Inc. (C.D. Cal. 2023), Cantu v. Tractor Supply Co. (C.D. Cal. 2024), and Hernandez v. Container Store, Inc. (C.D. Cal. 2024). The working test comes from In re Vizio, Inc., Consumer Privacy Litigation, 238 F. Supp. 3d 1204 (C.D. Cal. 2017), which asks whether the defendant's product is substantially involved in the conveyance of video content and significantly tailored to serve that purpose. At argument, Mr. Hammack disclaimed any contention that Chick-fil-A becomes a provider by putting videos on its website, and he said the court that faced that case was right to dismiss it. That is a useful concession from counsel who has argued several of these appeals.

Side businesses can count. The Second Circuit reads the definition to reach a business for which audiovisual content is only part of its book of business, offering a general store that rents out a few movies as its example (Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024)). In Hillsdale, a college that streams lectures for free was held plausibly to be engaged in the business even though it is a nonprofit, charges nothing, and regards the videos as a side project. The court pointed to related book and recording sales, donation requests, and the data itself.

Live video may not count. "Prerecorded" appears to modify both "video cassette tapes" and "similar audio visual materials." Stark v. Patreon, Inc., No. 22-cv-03131 (N.D. Cal. Oct. 13, 2022) so held, following Louth v. NFL Enterprises LLC, No. 1:21-cv-00405 (D.R.I. Sept. 12, 2022), and Sellers v. Bleacher Report, Inc., No. 23-cv-00368 (N.D. Cal. July 28, 2023) dismissed claims resting on live feeds. The Second Circuit has twice left the point open (Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024), note 9; Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025), note 4). A site that mixes live and on-demand video should expect this to shape the class definition.

One practical consequence: a business should not assume it is safe because it is not a media company, and should not assume it is exposed because a video exists somewhere on its site. For the worked sorting exercise, see Reducing Video Privacy Protection Act Risk on a Website or App: A Practical Guide.

Who is a consumer: two different fights

Almost every discussion of the circuit split collapses two questions that the courts treat separately. Keep them apart.

The first question is what makes someone a subscriber. The statute's three categories are renter, purchaser, and subscriber. A person who pays for a streaming plan is an easy case. A person who pays nothing is the fight, and the courts have converged on some shared ground: no court of appeals requires money.

Ellis v. Cartoon Network, Inc., 803 F.3d 1251 (11th Cir. 2015) came first. Mark Ellis downloaded the free Cartoon Network app and watched clips without creating an account. The court held that payment is one factor among several, and that subscription involves "some type of commitment, relationship, or association," looking for payment, registration, commitment, delivery, expressed association, or access to restricted content. Ellis had none of those. He could delete the app at any time with no consequence, and that was the end of it. Perry v. Cable News Network, Inc., 854 F.3d 1336 (11th Cir. 2017) extended the point to a CNN app user whose only additional link was logging in with his cable provider's credentials, finding that relationship to be with the cable company.

Yershov v. Gannett Satellite Information Network, Inc., 820 F.3d 482 (1st Cir. 2016) reached the opposite result on similar facts, which is why Judge Easterbrook called the two lines "incompatible." Alexander Yershov installed the USA Today app. He paid nothing and created no account, but the app gave Gannett his Android ID and his GPS location each time he watched a clip. The First Circuit treated that information as consideration, and imagined a free hotline installed in the home in exchange for a name and address. It also reasoned that if "subscriber" required money, the word would add nothing to "renter" and "purchaser." The holding was expressly narrow, and the court listed factual questions that might change the result on a fuller record.

District courts drew a further line for the casual website visitor. In Austin-Spearman v. AMC Network Entertainment LLC, 98 F. Supp. 3d 662 (S.D.N.Y. 2015), Judge Buchwald described the "deliberate and durable affiliation" a subscription implies and held that a person who merely visits a free site and watches clips lacks it. Nothing in the later circuit opinions rejects that for a pure visitor, although the Second Circuit took care to say it was leaving the question open.

The second question is what a person must subscribe to. That is the current split, and it arose from what might be called the newsletter theory. A sports site has free videos anyone can watch. It also has a free email newsletter. A plaintiff signs up for the newsletter, later watches a free video on the site in a browser logged into Facebook, and sues. He does not claim to be a consumer of the videos. He claims to be a consumer of the newsletter, and that the provider disclosed his viewing history.

The same plaintiff, Michael Salazar, brought that theory against the NBA and against Paramount's 247Sports. He won in the Second Circuit and lost in the Sixth.

The broad reading: Salazar v. NBA and Gardner v. Me-TV

Judge Robinson's opinion in Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024) is a careful exercise in reading definitions next to one another. "Any" is broad. "Or" is disjunctive. Congress used "audio visual materials" in the provider definition and in § 2710(b)(2)(D)(ii), and "video materials or services" in the definition of personally identifiable information, but it wrote plain "goods or services" in the definition of consumer. Meaningful variation, the court said, shows Congress knew how to add the limit. And if goods or services were already audiovisual, the word "video" in the definition of personally identifiable information would be surplus.

So what stops the general store from being liable for disclosing a customer's bread purchases? The definition of personally identifiable information, which must relate to video. The consumer definition sets who is protected, and the information definition sets what is protected. The court then held that exchanging an email address, IP address, and cookies for a newsletter plausibly made Salazar a subscriber, in part because that information let the NBA reach out to him directly, making him different from a casual viewer. It left for later whether a mere viewer could qualify (note 14), whether the NBA's disclosure was knowing, and whether the privacy policy supplied consent (note 4). The opinion ends: "The VPPA is no dinosaur statute." The Supreme Court denied the NBA's petition on December 8, 2025 (National Basketball Association v. Salazar, No. 24-994).

Gardner v. Me-TV National Ltd. Partnership, 132 F.4th 1022 (7th Cir. 2025) reaches the same place in a few pages. MeTV's site let anyone watch classic television. Signing up with an email address and zip code got you reminders, a channel finder, and comment privileges. "In an Information Age, data can be worth more than money," Judge Easterbrook wrote, so providing a dollar's worth of data must work if paying a dollar would. As for the audiovisual limit, had the plaintiffs bought a Flintstones sweatshirt or a Scooby Doo coffee mug from MeTV, they would have purchased goods from a provider. "What more is required?" He deliberately left the Ellis and Yershov app dispute unresolved.

The narrow reading: Salazar v. Paramount and Pileggi

Judge Nalbandian's majority in Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025) accused the plaintiff of reading words in isolation. "Goods or services" in the definition is followed by "from a video tape service provider," and that defined term specifies audiovisual materials. A general word can be limited by its neighbors. So a consumer is someone who subscribes to goods or services "in the nature of" video cassette tapes or similar audio visual materials. The majority also turned the Second Circuit's surplusage argument around. Because the definition of personally identifiable information says "includes" instead of "means," it is only illustrative, and it makes an odd place to hide the statute's main limit. Salazar's complaint did not allege that he accessed videos through the newsletter, and a request for leave to amend in a closing footnote did not preserve the point.

Judge Bloomekatz dissented on the merits. "But the statute doesn't say that." The majority, she wrote, effectively inserts "audio visual" before "goods or services." Her example was the supermarket with a video department in the 1980s, with a parenthetical aside that should be in every casebook: "(I remember when some did.)"

Judge Millett's opinion in Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025) gives the narrow reading its most worked-out form. Nicole Pileggi signed up for the Washington Examiner newsletter, then independently visited the website and watched videos anyone could watch. The court gave five reasons for reading consumer narrowly: the text taken together, the statute's title and headings, the size of the penalty, the punitive damages, and administrability. The last is the strongest. A provider cannot tell which web visitors once bought a shirt, and coverage would turn on some unrelated purchase made at any time before the viewing. A baseball ticket bought years earlier should not make the team liable for a free clip.

Pileggi then adds a requirement beyond Paramount: "the videos for which viewing history is disclosed must be the same video materials or services that the individual purchased, rented, or subscribed to." A newsletter that embeds videos is not enough if the disclosure concerned videos watched on the site separate from the newsletter. The court expressly did not decide how close the connection between a newsletter and a video must be. Both opinions leave room for a different complaint, most obviously one by a person who actually reached the video through the newsletter.

What happened at the Supreme Court

The Court granted certiorari on January 26, 2026, and heard argument on October 14, 2026, with Joshua Hammack for Salazar and Paul Clement for Paramount (Docket, No. 25-459). Paramount's supporters at the merits stage included Meta, the Motion Picture Association, the News/Media Alliance, the National Retail Federation, and the Chamber of Commerce. The Electronic Privacy Information Center filed in support of Salazar.

An argument is not a decision, and reading tea leaves from a transcript is a way to look foolish. Several things in the transcript of the October 14, 2026 argument are nonetheless worth a practitioner's attention.

The textual fight went as expected. Justice Kagan told Mr. Clement that following the definitions leads most naturally to the petitioner's reading. Justice Jackson offered Justice Breyer buying a book about French films at a video store, previewing a film in the corner, and having a reporter get the viewing list; she could not see why it mattered that he had bought only the book. Justice Thomas's opening question went the other way, asking whether goods or services from a video tape service provider would not naturally be video-related. Chief Justice Roberts offered Justice Breyer's pets-in-the-park hypothetical and asked about purpose. Justice Alito asked why lower courts had so often rejected the literal reading.

Several questions went to issues not presented. Justices Thomas, Alito, and Barrett pressed on whether a sports site with videos is in the relevant business. Justice Kavanaugh pointed out that personally identifiable information would remain open on remand and that the defense could win there. Justice Barrett raised standing, and Mr. Clement said Paramount had not argued the point and offered supplemental briefing. Whatever the Court holds on "consumer," those are the issues that will decide the next round.

Consent drew unusually direct remarks. Justices Kagan, Sotomayor, and Kavanaugh each suggested that going forward a business can get consent or stop sharing. Mr. Clement answered that the statute's consent mechanics are stickier than a cookie banner, and that the provider would be forced to ask everyone since it cannot tell who bought a chicken sandwich.

What each outcome would mean

If the Court adopts the broad reading, the newsletter theory survives everywhere, and the Sixth and D.C. Circuit defendants lose their easiest motion. Defendants then fall back to provider status, personally identifiable information, knowledge, and consent, as Justice Kavanaugh's questions anticipated. Exposure outside the Second Circuit would rise sharply, because that circuit's Solomon defense does not bind other courts.

If the Court adopts the narrow reading, a free newsletter or an unrelated purchase will not do. Plaintiffs would still have paid streaming subscribers, registered video accounts, and perhaps newsletters that deliver or gate video. Publishers with paywalled or account-gated video remain squarely exposed, and any business that requires an account to watch should not treat a win for Paramount as a win for itself. How far the Court's language reaches registered viewing accounts is the question to read for.

The Court could also dispose of the case on narrow grounds or on jurisdiction, given the standing questions at argument. In that event the split stands, and everything in this section stays live.

A worked hypothetical: the yarn shop

Suppose a fictional retailer, Larkspur Yarn Co., sells wool online and posts free knitting tutorials on its site. It has the Meta Pixel on every page, including the tutorial pages, with the page address sent automatically. A customer named Dana bought two skeins in 2023 and has never given Larkspur anything else. In 2025, logged into Facebook in the same browser, she watches "How to Fix a Dropped Stitch."

Start with the provider question. Larkspur's videos promote its yarn, and a court following Vizio and the marketing-video line could well hold Larkspur is not significantly tailored to delivering video. If tutorials are a substantial product in their own right, with a paid class library, the answer changes. Next, the consumer question. In the Second and Seventh Circuits, Dana is a purchaser of goods from Larkspur if Larkspur is a provider. Judge Easterbrook's sweatshirt is exactly this. In the Sixth and D.C. Circuits she is not, because she bought yarn. Then personally identifiable information. In the Second Circuit the claim likely fails under Solomon regardless. So Dana's claim gets past both consumer and identifiability only in places such as the Seventh Circuit, where at least one district court has rejected the ordinary-person test. Her counsel's choice of forum may decide the case. Larkspur's cheapest protection, in every forum, is removing the identified page-view event from its tutorial pages.

What counts as personally identifiable information

All courts agree on one thing: the term covers some data beyond a name. The statute says "includes" and "identifiable," and the Senate report calls the definition a minimum. Mr. Hammack told Justice Barrett at argument that the parties in Salazar agree it requires two strands, something that identifies the person and something that identifies the specific video. The dispute concerns how that link is measured, and from whose perspective. Justice Alito asked the question in the fewest words anyone has managed: "Personally identifiable by whom? By the NSA?"

The foreseeability test

Yershov v. Gannett Satellite Information Network, Inc., 820 F.3d 482 (1st Cir. 2016) gave the plaintiff's side its best language. Judge Kayatta analogized to a football referee who announces a penalty on "No. 12 on the offense": everyone with a game program knows who that is. If Gannett gave Adobe a device identifier and GPS coordinates, and knew Adobe had the game program, the disclosure was "reasonably and foreseeably likely to reveal which" videos Yershov obtained. He then conceded a limit, a point at which linkage becomes "too dependent on too much yet-to-be-done, or unforeseeable detective work." Note also what the facts were. Anyone can look up GPS coordinates on a map, so the Third and Ninth Circuits later said Yershov was consistent with their rule.

The ordinary-person test

In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016) is the origin of the competing test. Children under 13 alleged that Viacom passed Google their usernames, IP addresses, browser fingerprints, and device identifiers, along with the videos they watched. The court held that personally identifiable information means "the kind of information that would readily permit an ordinary person to identify a specific individual's video-watching behavior." Its reasoning was historical and consequential: a 1988 statute should not be read to make third-party cookies on any streaming site presumptively illegal, and Congress declined to add IP addresses when it had the chance in 2013. "Every step away from that 1988 paradigm will make it harder for a plaintiff to make out a successful claim." The court added that disclosures such as precise GPS coordinates or customer ID numbers may suffice, and advised streaming companies to think carefully about notice and consent. It still revived a state-law intrusion claim against Viacom, because a website registration page had said "HEY GROWN-UPS: We don't collect ANY personal information about your kids." Privacy lawyers should read that part as closely as the VPPA part. The promise on the page can be the problem.

Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017) adopted that test, with a different rationale. Because the statute targets what a provider knowingly discloses, it views the disclosure from the discloser's side, so the meaning cannot depend on the recipient's capabilities. ESPN sent Adobe a Roku serial number and video titles. Adobe could identify the person only by combining that with data ESPN never had. The court offered its own example: a store manager who says "a local high school teacher" rented a film has not violated the statute, even if a resourceful investigator could work out who it was. It also left a door open, and plaintiffs have been walking through it ever since: "A Facebook link or an email address may very well readily enable an 'ordinary person' to identify an individual."

District courts in the Ninth Circuit have taken up the invitation. In Stark, the magistrate judge noted that reasonable minds might differ about a standard that disregards actual knowledge, said he was bound by it, and found sufficient an allegation that anyone holding an FID can quickly locate the profile. Plotsker v. Envato Pty Ltd., No. 2:24-cv-04412 (C.D. Cal. Aug. 26, 2025) reached a similar result, relying on the allegation that the c_user cookie conveyed an unencrypted Facebook ID, and it is hard to square with Solomon's treatment of the same cookie.

Solomon: the code itself

Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025) is the most consequential opinion for pixel cases since Nickelodeon. Detrina Solomon subscribed to FITE's streaming service, and no one disputed on appeal that she was a consumer. FITE allegedly configured the pixel's PageView to send the video title and URL, along with the c_user value. Her complaint included a screenshot. The Second Circuit adopted the ordinary-person test and rejected Yershov, then applied the test to the screenshot. An ordinary person, the court said, would not look at twenty-nine lines of code containing a phrase such as "title%22%3A%22" and recognize a video title, or see "c_user=" and understand it as a Facebook ID. It also was not persuaded that the FID differs in kind from the device identifiers in Nickelodeon or the Roku serial number in Eichenberger. And the court noted the complaint's lack of detail on how an ordinary person would obtain the transmission at all.

Seven weeks later, in the non-precedential Hughes v. National Football League, No. 24-2656 (2d Cir. June 20, 2025) (summary order), a Second Circuit panel said it bluntly: "Solomon effectively shut the door for Pixel-based VPPA claims." The plaintiff offered to allege that Facebook sees the data as plain text, that anyone can paste the code into ChatGPT, and that 75 percent of Americans have Facebook accounts. None of that mattered, because the question is whether an ordinary person can understand the communication itself. District judges have applied that language with prejudice (Nixon v. Pond5, Inc., No. 1:24-cv-05823 (S.D.N.Y. July 21, 2025)). The panel also rejected a defendant's attempt to use its privacy policy to attack standing, holding that consent goes to the merits.

Notice what Solomon makes turn on. The analysis asks about legibility in the format transmitted. Critics say this rewards obscurity, and that a statute cannot care whether the record was handed over in plain text. The usual comparison, from the Hulu opinion, is that handing over a list in a code both sides can read would obviously violate the statute.

The growing rejection

Outside the Second, Third, and Ninth Circuits, the ordinary-person test is losing ground in district courts. Hillsdale is the fullest statement. Chief Judge Jarbou followed Manza v. Pesi, Inc., 784 F. Supp. 3d 1110 (W.D. Wis. 2025), reasoning that the courts adopting the test identified little textual basis for it, that the knowledge element limits when a provider is liable without defining what the information is, and that the purpose is not served if a provider and recipient can evade the statute with a number known only to them. She drew support from the Sixth Circuit's language in Paramount, which reads the definition as illustrative, and she cited Haines v. Cengage Learning, Inc., No. 1:24-cv-00710 (S.D. Ohio July 22, 2025). She added that the claim would succeed even under the ordinary-person standard, since the words "totalitarian-novels" are easy to spot in a URL, and that the standard should not apply to the format of the data at all: "The VPPA is not primarily aimed at bystanders who might intercept a disclosure; rather, it is meant to prevent an intended recipient from receiving a disclosure."

Earlier decisions pointing the same way include Belozerov v. Gannett Co., 646 F. Supp. 3d 310 (D. Mass. 2022) and Lebakken v. WebMD, LLC, 640 F. Supp. 3d 1335 (N.D. Ga. 2022), and, in New York before Solomon, Collins v. Pearson Education, Inc., No. 23 Civ. 2219 (S.D.N.Y. Mar. 1, 2024). Collins does not appear to survive Solomon on this point.

Where the identifiers fall

Treat that table as a map, with "likely" marking a judgment call and not a holding. At the argument, Mr. Hammack agreed with Justice Kavanaugh that the split on this question runs three to one against his side, and that the question would remain open on remand. Justice Barrett's remark that "only a computer can figure out what this means" suggests at least one Justice has noticed how the question and the standing question interact.

A second worked hypothetical: the streaming gym

Suppose Ridgeback Fitness, a fictional company, sells a $19 monthly subscription to on-demand workout videos. Its marketing team uses the Meta Pixel and, since a website rebuild, also sends server events through the Conversions API, including the workout's title and a hashed member email.

Paying members are consumers everywhere, and Ridgeback is plainly in the business. That removes the first two defenses in every circuit, so Salazar does not help. A member sues in Michigan. Under Hillsdale's reasoning, the FID and URL suffice, and the server-side event removes any argument that the member's own browser did the disclosing. In New York, Ridgeback would cite Solomon and argue that hashed values and encoded titles are unreadable to an ordinary person. The plaintiff would answer that Solomon looked at a screenshot of a browser transmission, whereas here Ridgeback's own server sends structured data to a recipient that matches the hash as designed. No appellate court has decided that. Ridgeback has staked its exposure on a legal argument that works in only some courts, for a marketing benefit it could get from members who consent.

Knowledge: the element nobody can skip

Section 2710(b)(1) requires that the provider "knowingly" disclose. In In re Hulu Privacy Litigation, 86 F. Supp. 3d 1090 (N.D. Cal. 2015), the court held that this means consciousness of transmitting the private information and not merely transmitting code, and it required proof that Hulu knew Facebook might combine the page address with the c_user cookie to connect a person to a video. Hulu's employees had not been shown to know that, so Hulu won on summary judgment. That ruling came from a magistrate judge in 2015, on a record about a Facebook Like button loaded on Hulu's watch pages.

Pleading standards have since moved. Complaints now allege that the site owner chose the pixel for the purpose of matching users, and that Meta's documentation explains that. Hillsdale took knowledge from the allegation that the college knowingly installed the code. Stark v. Patreon, Inc., No. 22-cv-03131 (N.D. Cal. Oct. 13, 2022) found the allegations sufficient at the pleading stage and left Patreon free to challenge, on an evidentiary record, what it knew about the pixel and what an ordinary person could derive from an FID. Discovery has a role. A marketing team's emails about match rates are the documents plaintiffs want. The evidentiary burden belongs to plaintiffs at summary judgment under Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618 (7th Cir. 2014), which faulted the plaintiffs there for thinking the provider had to disprove a violation.

The Second and D.C. Circuits have declined to reach knowledge (Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024), note 4; Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025)). It is a real defense in a case where a third-party vendor added the pixel through a tag manager and nobody at the company understood it, and a much weaker one after a demand letter arrives and the pixel keeps firing. Companies should think about that second scenario.

Consent and the exceptions

Consent under § 2710(b)(2)(B)

The 2013 amendment gave online businesses a workable path. A provider may disclose "to any person with the informed, written consent (including through an electronic means using the Internet) of the consumer" that meets three conditions:

1. It is "in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer."
2. At the consumer's election, it is given either at the time of the disclosure or in advance for a set period, not more than two years or until withdrawn.
3. The provider "has provided an opportunity, in a clear and conspicuous manner, for the consumer to withdraw on a case-by-case basis or to withdraw from ongoing disclosures, at the consumer's election."

Each word pulls against the way websites usually work. A sentence inside terms of use or a privacy policy is in a form setting out other legal obligations. A browsewrap notice is neither informed nor written in any meaningful sense, and Sellers v. Bleacher Report, Inc., No. 23-cv-00368 (N.D. Cal. July 28, 2023) shows how hard a court is on a notice sitting at the bottom of a page. A banner that says "we use cookies" does not tell a person that a named recipient will learn what videos she watched. And two years is a statutory limit, so a consent record needs a date and a renewal process.

The leading appellate decisions have so far left open what a policy can do. Salazar left the point for the district court because of the detailed examination it requires, and Hughes restated that approach, noting the dispute over whether a policy disclosed sharing or only collection. The Stark plaintiffs pointed to a promise that the company would never provide information to third parties for marketing without prior consent, which is the kind of sentence that turns a weak consent defense into an exhibit for the other side.

What about a Facebook user's agreement with Facebook? Hillsdale rejected that route in passing, observing that the college did not argue those agreements met the statutory requirements, including the provider-supplied withdrawal opportunity. For drafting that tracks the text, see Video Privacy Toolkit: Consent Language, Pixel Audits, and Litigation Response and, for notice design generally, Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC.

Ordinary course of business

Section 2710(b)(2)(E) permits disclosures incident to the ordinary course of business, defined to mean only four things. Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618 (7th Cir. 2014) held that Redbox's outsourced call center fell within "request processing," even though employees used customer records for training. Rodriguez v. Sony Computer Entertainment America, LLC, 801 F.3d 1045 (9th Cir. 2015) affirmed dismissal of a claim over a transfer of operations between Sony affiliates.

Advertising is a harder fit, and courts have been nearly uniform in saying so. In Hillsdale the court noted that "ordinary course of business" is narrowly defined and collected decisions including Saunders v. Hearst Television, Inc., 711 F. Supp. 3d 24 (D. Mass. 2024) and Markels v. AARP, 689 F. Supp. 3d 722 (N.D. Cal. 2023). The defense's best text is a passage in the Senate report mentioning "mailing houses, warehouses, computer services, and similar companies for marketing to their customers." Hillsdale read that as reaching specific kinds of marketing support and noted that Congress addressed marketing separately elsewhere. An analytics vendor that truly processes data only on the provider's behalf has a stronger argument than an advertising platform using the data for its own purposes, a distinction the Second Circuit drew in discussing standing, when it noted Meta is not a ministerial intermediary. Recipients under that exception also become providers themselves as to that information, under § 2710(a)(4), which vendors often overlook.

Names and addresses

Section 2710(b)(2)(D) lets a provider disclose solely names and addresses of consumers if it has offered a clear and conspicuous opt-out and the disclosure does not identify the title, description, or subject matter of any video, except that subject matter may be disclosed for the exclusive use of marketing goods and services directly to the consumer. This was the 1988 mailing-list exception. Mr. Hammack used it at argument to show that Congress knew video information had advertising value and chose exactly how far to let it travel. A pixel that sends a title does not fit, since it sends more than a name and address and a title is more than a subject matter.

What the disclosure must concern

A provider can also disclose to the consumer. In Mollett v. Netflix, Inc., 795 F.3d 1062 (9th Cir. 2015), Netflix displayed recently watched titles on a shared television. The Ninth Circuit held those were disclosures to the subscriber, and what she did with her own account was her affair. Hillsdale distinguished that holding from code that sends data to Meta. Compulsory process is covered by subparagraphs (C) and (F), which contain their own conditions, and a business that receives a subpoena for viewing records should read them first.

Standing after TransUnion

Spokeo, Inc. v. Robins, 578 U.S. 330 (2016) and TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) require a concrete injury even for a statutory violation, and a concrete injury needs a close historical or common-law analog. On the VPPA, every circuit to address it has found standing, and the reasoning has shifted over time.

Before TransUnion, Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618 (7th Cir. 2014) said that "technical" violations are what Congress sought to outlaw. Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017) called § 2710(b)(1) a substantive privacy right and said every violation offends the protected interest. Perry v. Cable News Network, Inc., 854 F.3d 1336 (11th Cir. 2017) and In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016) reached the same place. After TransUnion, the analysis became more careful and landed in the same spot. Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024) relied on public disclosure of private facts and on Bohnak v. Marsh & McLennan Companies, Inc., 79 F.4th 276 (2d Cir. 2023), distinguishing the mail-vendor cases on the ground that Meta is no ministerial intermediary. Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025) found the analogy to both disclosure and intrusion, unanimously on this point. Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025) found the injury "concrete twice over," in intrusion upon seclusion and publicity given to private life, and it noted that a person's viewing can reveal religious beliefs, medical concerns, and political views. Even the Paramount defendant had dropped its standing argument in the Sixth Circuit.

Three pressure points remain.

The Eleventh Circuit's en banc decision in Hunstein v. Preferred Collection & Management Services, Inc., 48 F.4th 1236 (11th Cir. 2022) (en banc) requires more of the publicity analog. Pileggi acknowledged that disagreement openly. A defendant in the Eleventh Circuit can argue that a transfer to a single company is not publicity, although Perry v. Cable News Network, Inc., 854 F.3d 1336 (11th Cir. 2017) remains on the books.

The Ninth and Third Circuits have tightened privacy standing in the neighboring tracking cases. Popa v. Microsoft Corp., No. 24-14 (9th Cir. Aug. 26, 2025) held that a session-replay plaintiff lacked standing and said that the Eichenberger analysis "finds no support in TransUnion" for the proposition that a statutory privacy violation is automatically concrete. Cook v. GameStop, Inc., 148 F.4th 153 (3d Cir. 2025), as applied in Popa v. Harriet Carter Gifts, Inc., No. 25-1760 (3d Cir. Mar. 26, 2026) (not precedential), reached a similar result for a shopper who did not input personal information. Those cases did not involve video records, and a VPPA plaintiff can respond that a viewing history is more sensitive than mouse movements. A defendant should raise them anyway. For the general doctrine, see Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims, and for the parallel in breach litigation, Data Breach Class Actions: Article III Standing, Negligence Claims, and Forensic Report Privilege.

And then there is the Supreme Court. Justice Barrett pressed Mr. Hammack on what harm exists when no person read the data, and Mr. Clement's "gobbledegook" answer framed the question: is a machine-readable string sent to a company's server close enough to telling someone a private fact? If the Court addresses standing and narrows it, federal courts will lose many of these cases. That has an awkward wrinkle. Section 2710(c)(1) says a person "may bring a civil action in a United States district court." Whether a state court could hear a VPPA claim that fails Article III appears to be open, and it would not be a small question.

The damages arithmetic

Section 2710(c)(2) says a court "may award" actual damages "but not less than liquidated damages in an amount of $2,500," plus punitive damages, fees, and equitable relief. The D.C. Circuit read that literally. Because the statute speaks of "any act," it said each transmission about one video that one plaintiff watched to one third party draws at least $2,500, and it gave the example that a site with 100 visitors watching five videos apiece faces at least $1.25 million (Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025)). That reasoning supported the narrow consumer reading, so expect plaintiffs to quote it about damages and defendants to quote it about lenity.

Not everyone will agree with that unit of violation. Defendants can argue that "may award" gives a court discretion, that $2,500 is a per-person figure, and that aggregated statutory damages raise due process limits of the sort discussed in Wakefield v. ViSalus, Inc., 51 F.4th 1109 (9th Cir. 2022). Those arguments are stronger at the end of a case than at the start. In settlement the arithmetic does its work anyway.

Class certification is where the technology returns. In Jancik v. WebMD LLC, No. 1:22-cv-644 (N.D. Ga. Feb. 20, 2025), the court certified classes under Fed. R. Civ. P. 23(b)(3) and (b)(2), reasoning that Meta's event data should reveal who was transmitted, that the fixed $2,500 eases damages, and that device and browser variation could be handled by an administrator. In Martinez v. D2C, LLC, No. 23-21394 (S.D. Fla. Oct. 1, 2024), the court found the proposed class ascertainable but denied certification on numerosity. The plaintiffs' theory that the mere presence of the pixel transmitted tens of thousands of subscribers' data was, the court said, conclusory and undercut by unrefuted defense expert testimony and the plaintiffs' own evidence. So the same record problem, identifying who actually had an FID sent, produced opposite results within a year. Plaintiffs should plan on a subpoena to Meta and defendants should plan on testing it. For the Rule 23 framework, see Class Actions Under Rule 23: Certification, Settlement, and Defense Strategy.

Limitations can also be important. Section 2710(c)(3) gives two years from the act or its discovery, and Nixon v. Pond5, Inc., No. 1:24-cv-05823 (S.D.N.Y. July 21, 2025) shows defendants raising it at the pleading stage. Mr. Clement alluded at argument to a two-year overhang of liability from any new decision.

Arbitration and mass arbitration

Many video platforms have terms with an arbitration clause and a class waiver. AT&T Mobility LLC v. Concepcion, 563 U.S. 333 (2011), Epic Systems Corp. v. Lewis, 584 U.S. 497 (2018), and 9 U.S.C. § 2 make those generally enforceable if a contract was formed. So the first fight is formation. Nguyen v. Barnes & Noble Inc., 763 F.3d 1171 (9th Cir. 2014) and Berman v. Freedom Financial Network, LLC, 30 F.4th 849 (9th Cir. 2022) require reasonably conspicuous notice and an unambiguous manifestation of assent, Meyer v. Uber Technologies, Inc., 868 F.3d 66 (2d Cir. 2017) found assent through a well-designed registration flow, Oberstein v. Live Nation Entertainment, Inc., 60 F.4th 505 (9th Cir. 2023) enforced Live Nation's sign-in wrap, and Chabolla v. ClassPass Inc., 129 F.4th 1147 (9th Cir. 2025) refused to enforce ClassPass's. A newsletter sign-up box usually has less notice design than a checkout page. The newsletter theory creates a further question: does the newsletter form bind the person to terms covering website video viewing? Sellers v. Bleacher Report, Inc., No. 23-cv-00368 (N.D. Cal. July 28, 2023) denied a motion to strike class claims because a pop-up at the bottom of the page did not show assent.

Then comes the problem that has driven VPPA defense strategy: the plaintiffs' firms accepted the invitation. Mass arbitration means filing thousands of individual demands at once, each generating fees the business must pay under the forum's consumer rules. At $2,500 per claim plus fees, the economics work. Two recent orders show what this looks like.

In Powers v. Discovery Communications LLC, No. 25-cv-6398 (S.D.N.Y. June 3, 2026), 4,225 Discovery+ users represented by one firm sued for a declaration about which arbitration forum applied to their VPPA claims, after they noticed claims three days before Discovery posted new terms moving disputes from JAMS to National Arbitration and Mediation and requiring aggregate arbitration. The order recites that an earlier court had decided that the forum depended on when each user's subscription ended. After the company's motion to dismiss, all but two plaintiffs dropped the case. Those two had died, one of them before filing. The court denied the company's request for sanctions, distinguishing the bad-faith cases it cited. Defense teams now routinely test claimant rosters for exactly this kind of problem, and claimants' firms should expect it.

In Dougherty v. Zynga Inc., No. 25-cv-04051 (N.D. Cal. Mar. 31, 2026), plaintiffs bringing VPPA and California claims over mobile games fought a Take-Two terms update that had first sent mass arbitrations to New Era ADR, then changed the threshold and moved them to JAMS. The court transferred the case to New York on the forum clause and left the arbitration question for that court.

Other decisions set the limits for clause design. Heckman v. Live Nation Entertainment, Inc., 120 F.4th 670 (9th Cir. 2024) held New Era's mass-arbitration rules and the clause adopting them unconscionable under California law, with particular concern over the way Ticketmaster bound users. Wallrich v. Samsung Electronics America, Inc., 106 F.4th 609 (7th Cir. 2024) held in a biometric case that consumers could not make Samsung pay arbitration fees after the American Arbitration Association terminated the proceedings, and that they failed to prove an agreement at all, leaving them free to sue in court. That can be a pyrrhic win for a defendant whose clause then leads back to a class action. Retroactive changes are a recurring dispute, and a business that responds to a wave of demands with a rewritten clause should expect it to be challenged. The settlement side has its own wrinkle: in Stark v. Patreon, Inc., No. 22-cv-03131 (N.D. Cal. July 8, 2025), the court refused to revisit a ruling that a claims aggregator's 927 assigned opt-outs were an invalid group opt-out from the Patreon class settlement.

Procedural points matter here too. A defendant loses the right to arbitrate by litigating too long, without needing to show prejudice (Morgan v. Sundance, Inc., 596 U.S. 411 (2022)), and an interlocutory appeal from denial of arbitration stays the district court (Coinbase, Inc. v. Bielski, 599 U.S. 736 (2023)). Delegation clauses are enforced according to their terms (Rent-A-Center, West, Inc. v. Jackson, 561 U.S. 63 (2010)) unless they fall under an unconscionability analysis such as Heckman's. For the fuller treatment, see Mass Arbitration: How Thousands of Individual Claims Became a Strategic Problem and Designing a Consumer Arbitration Program That Survives Mass Filings: A Practical Guide.

How the pieces fit, circuit by circuit

What this means for each reader

For a business with video on its site. The legal questions are interesting. The operational one is simple: find out what leaves the browser on your video pages, and decide whether it needs to. The controls that matter are removing identifying pixels from video pages, stripping titles from event data, or obtaining real consent. For how to do that, the audit method in Auditing Your Website Tracking Stack: A Practical Guide is the starting point, and the sequenced steps are in Reducing Video Privacy Protection Act Risk on a Website or App: A Practical Guide. A one-page control list is in Video Privacy Protection Act Compliance Checklist: A Practical Checklist. If children may watch, the COPPA overlay in Children's Privacy Under COPPA and the Age-Appropriate Design Codes also applies, including the definition of personal information in 15 U.S.C. § 6501, which Congress wrote far more broadly than this one, and if the videos concern health, see Consumer Health Data Outside HIPAA: My Health My Data, the FTC, and the Apps That Know Too Much. Parallel exposure under wiretap statutes such as 18 U.S.C. § 2511 and under deception authority such as 15 U.S.C. § 45 does not go away because a VPPA motion succeeds.

For a plaintiff's lawyer. Forum and facts first. A paying subscriber or registered account holder avoids the Supreme Court's question. The Solomon complaint relied on an exemplar screenshot and a hypothetical Facebook profile, and the court remarked on the missing detail, so plead the plaintiff's own transmission if you can get it. Allegations should explain what the recipient reads and how an ordinary person could use it, and should not ask for leave to amend in a footnote, the mistake punished in both Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025) and Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025). For pleading mechanics under Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007) and Ashcroft v. Iqbal, 556 U.S. 662 (2009), see Drafting a Complaint That Survives a Motion to Dismiss.

For a judge. The hard choice is about how to read a narrow statute in a changed world, and the opinions are candid about this. Nickelodeon says each step from the 1988 paradigm makes a claim harder. Salazar v. NBA says the statute's words reach what they reach. What the record shows about the transmission matters in both frames, and many motions can be narrowed by asking what the complaint actually shows.

For a policymaker. Most of these fights exist because Congress has left a 1988 vocabulary in place, and it has made one substantive edit since. Both sides at the Supreme Court argued from what Congress did and did not change in 2013. The serious questions for an amendment would be whether protection should turn on being a consumer at all, as Justices Sotomayor and Kavanaugh both wondered, whether the recipient should have duties, and whether a per-act liquidated floor fits a technology that acts millions of times. Scholars have been working on this for some time, including Marc Chase McAllister, Modernizing the Video Privacy Protection Act, 25 Geo. Mason L. Rev. 102 (2017); Yarden Z. Kakon, Note, "Hello, My Name Is User #101": Defining PII Under the VPPA, 33 Berkeley Tech. L.J. 1251 (2018); Daniel L. Macioce Jr., Comment, PII in Context: Video Privacy and a Factor-Based Test for Assessing Personal Information, 45 Pepp. L. Rev. 331 (2018); and Elizabeth Gemdjian, The Extraordinary Extension of the Video Privacy Protection Act, 90 Brook. L. Rev. 553 (2025), which the Second Circuit cited in Solomon.

For anyone who just watches videos. The statute protects you only if you are a consumer, and today that depends on where you live and how you signed up. You can see some of what has been shared in Meta's off-Facebook activity tools (the Ninth Circuit's Osheske opinion describes a plaintiff using such a report). You can log out of social accounts before watching things you would prefer to keep to yourself, or use a browser that limits third-party cookies. For broader steps, see Protecting Your Personal Information: A Practical Guide.

This article is general information about a fast-moving area, not legal advice on any particular site, claim, or demand. If a demand letter has landed on your desk or you think your viewing data was shared, a short conversation with counsel who has read the opinions will usually be worth the time, and the primary sources linked here can be pulled up on UpLaw.

Related Documents

Related Guides

• Reducing Video Privacy Protection Act Risk on a Website or App: A Practical Guide: the sequenced audit, decisions, and fixes for a publisher, retailer, or fitness or e-learning business, with the plaintiff's view.
• Auditing Your Website Tracking Stack: A Practical Guide: how to find out what your tags actually send.
• Designing a Consumer Arbitration Program That Survives Mass Filings: A Practical Guide: clause and program design with mass filings in mind.
• Drafting a Complaint That Survives a Motion to Dismiss: pleading mechanics that matter on identifiability and consumer status.
• Defending or Bringing a Data Breach Class Action: A Practical Guide: a neighboring privacy class action with similar standing fights.

Related Articles

• Tracking Pixels, Session Replay, and the Wiretapping Lawsuits Reshaping Adtech: the wiretap and session-replay theories that travel with VPPA claims.
• Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims: the standing doctrine in full.
• Mass Arbitration: How Thousands of Individual Claims Became a Strategic Problem: how mass filing works and why it shapes these cases.
• Class Actions Under Rule 23: Certification, Settlement, and Defense Strategy: certification and settlement.
• Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC: why a policy cannot carry this consent, and what it must still say.
• Data Breach Class Actions: Article III Standing, Negligence Claims, and Forensic Report Privilege: a batch companion on disclosure-based injury.
• Consumer Health Data Outside HIPAA: My Health My Data, the FTC, and the Apps That Know Too Much: the added exposure when videos reveal health interests.
• Age Verification and Minors Online After Free Speech Coalition v. Paxton: What States Can Require of Websites and Apps: related obligations when the audience includes minors.
• Children's Privacy Under COPPA and the Age-Appropriate Design Codes: the broader children's privacy definitions.

Related Checklists

• Video Privacy Protection Act Compliance Checklist: A Practical Checklist: a desk-ready control list for this statute.
• Website Tracking Compliance Checklist: A Practical Checklist: the general tracking checklist.

Related Toolkits

• Video Privacy Toolkit: Consent Language, Pixel Audits, and Litigation Response: consent language, audit worksheets, demand response, and a motion outline.
• Adtech Privacy Toolkit: Tag Inventories, Consent Records, and Litigation Defense: tag inventories and records for the wider stack.
• Mass Arbitration Toolkit: Clause Architecture, Batching Protocols, and Response Plans: working papers for arbitration clauses and responses.