Video Privacy Protection Act Compliance Checklist: A Practical Checklist

How to use this checklist

Print this, assign an owner to each phase, and date each box when it is done. Counsel owns Phases 1, 5, 7, and 8. An engineer owns Phases 2 and 3. Product or marketing owns Phases 4 and 6, with counsel reviewing. Phases 1 through 6 are preventive. If a demand letter or complaint is already on your desk, start with Phase 8 and return to the others after the hold is in place.

Every reference to the statute is to 18 U.S.C. § 2710. The doctrine behind these tasks is in The Video Privacy Protection Act in the Age of Pixels: Who Is a Consumer and What Counts as Personally Identifiable, the sequencing and trade-offs are in Reducing Video Privacy Protection Act Risk on a Website or App: A Practical Guide, and copyable templates for many items are in Video Privacy Toolkit: Consent Language, Pixel Audits, and Litigation Response.

The state of the law matters to several boxes. The Supreme Court granted certiorari in Salazar v. Paramount Global, No. 25-459, on January 26, 2026, heard argument on October 14, 2026, on the meaning of "consumer," and has not yet ruled (Docket, No. 25-459). Check the docket before you close Phase 9.

Phase 1: Decide whether the statute reaches you

• List every way you deliver prerecorded video. Web pages, apps, connected-TV channels, email, downloads, physical media. Authority: § 2710(a)(4) ("rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials"). Note: Delivery by streaming is treated as covered in Gardner v. Me-TV National Ltd. Partnership, 132 F.4th 1022 (7th Cir. 2025). One judge disagrees, in Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025) (Randolph, J., concurring), and the point came up repeatedly at the Supreme Court. Assume coverage until a court says otherwise.
• Separate live from prerecorded. Treat replays of live events as prerecorded unless counsel concludes otherwise. Authority: Stark v. Patreon, Inc., No. 22-cv-03131 (N.D. Cal. Oct. 13, 2022); Sellers v. Bleacher Report, Inc., No. 23-cv-00368 (N.D. Cal. July 28, 2023). Note: The Second Circuit has twice left this open (Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024), note 9; Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025), note 4).
• Test "engaged in the business." Ask whether video is a substantial and tailored part of what you do, using the test in In re Vizio, Inc., Consumer Privacy Litigation, 238 F. Supp. 3d 1204 (C.D. Cal. 2017). Record the answer and the facts: dedicated video sections, advertising sold on video, video revenue, staffing.
• Do not stop because you are a nonprofit or the video is free. Authority: Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025) (nonprofit college, free lectures, plausibly covered).
• Note any argument that your videos are only advertising. Authority: decisions collected in Hillsdale, including Carroll v. General Mills, Inc., Cantu v. Tractor Supply Co., and Hernandez v. Container Store, Inc. Note: This is a defense for pure brand marketers. Hillsdale distinguished lectures with an independent educational purpose.
• Note any in-theater business separately. In-theater ticket sales are outside the definition. Authority: Osheske v. Silver Cinemas Acquisition Co., 132 F.4th 1110 (9th Cir. 2025).
• Identify other statutes that attach to the same data. State video and reader privacy statutes such as California Civil Code § 1799.3 (see Mollett v. Netflix, Inc., 795 F.3d 1062 (9th Cir. 2015)), the cable privacy provision at 47 U.S.C. § 551 (noted in Perry v. Cable News Network, Inc., 854 F.3d 1336 (11th Cir. 2017)), and children's rules under 15 U.S.C. § 6501. Note: Section 2710(f) preempts only state or local law requiring disclosure the Act prohibits, so state analogs generally survive.
• Write a one-page applicability memo, signed and dated. Revisit it annually and whenever video strategy changes.

Red flag: "We're not a media company" is a conclusion, not an analysis. If the only record of that conclusion is a marketing manager's email, you have no record.

Phase 2: Inventory video and audiences

• Build the surface list. For each template or app screen: URL pattern, player, host, content type, access level. Authority: § 2710(a)(3) ("specific video materials or services").
• Flag URLs and page titles that reveal the video. Authority: Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025) (course title legible in a URL).
• Flag autoplay and pre-roll. A request for a page can be a request for the video. Authority: Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025) (clicking a video's page is enough to show it was requested).
• Record every embedded third-party player and its data terms. Authority: § 2710(b)(1) (disclosure "to any person").
• List each customer relationship: paid video subscriber; registered free account; newsletter; purchaser of non-video goods; app installer; anonymous viewer. Authority: § 2710(a)(1).
• Tie each relationship to the current law in your likely forums. Authority: Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024) and Gardner v. Me-TV National Ltd. Partnership, 132 F.4th 1022 (7th Cir. 2025) (any good or service); Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025) and Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025) (audiovisual only; Pileggi also requires that the disclosed video be the one subscribed to); Yershov v. Gannett Satellite Information Network, Inc., 820 F.3d 482 (1st Cir. 2016) compared with Ellis v. Cartoon Network, Inc., 803 F.3d 1251 (11th Cir. 2015) and Perry v. Cable News Network, Inc., 854 F.3d 1336 (11th Cir. 2017) (free apps); Austin-Spearman v. AMC Network Entertainment LLC, 98 F. Supp. 3d 662 (S.D.N.Y. 2015) (casual visitor). Note: Paying video subscribers and accounts needed to watch are exposed under every reading.
• Decide who holds the data. Identify who can see viewing logs in your own systems, for Phase 7.

Red flag: A free account required to watch video is not the same as a free newsletter. A company reading a headline about Paramount may treat them alike and be wrong about its largest population.

Phase 3: Test what leaves the browser

• Conduct the test at counsel's direction if a dispute is foreseeable. Authority: Fed. R. Civ. P. 26(b)(3) (work product).
• Export the tag manager container and version history. Include the date, author, and stated purpose for each tag.
• Record the Meta Events Manager settings. Pixel IDs, events, automatic events, advanced matching, Conversions API, and connected partners.
• Run a logged-in network test on each template. Use a clean browser profile with a test social account logged in, then capture the requests after pressing play. Note: In the Network tab, look at ev, dl, page-title fields, cookie headers including c_user, fr, and datr, and any ud[...] fields. The sample request in Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025) shows what a page address looks like in a pixel call.
• Repeat in other states. Logged out, third-party cookies blocked, as paid member, as newsletter arrival, on mobile, and under each consent state. Authority: Jancik v. WebMD LLC, No. 1:22-cv-644 (N.D. Ga. Feb. 20, 2025) (device, browser, and setting differences at certification); Plotsker v. Envato Pty Ltd., No. 2:24-cv-04412 (C.D. Cal. Aug. 26, 2025) (allegation about the fr cookie after logout).
• Test the apps with a proxy. SDKs do not show up in a browser audit, and an app's device identifier raised the first circuit-level disputes (Ellis v. Cartoon Network, Inc., 803 F.3d 1251 (11th Cir. 2015); Yershov v. Gannett Satellite Information Network, Inc., 820 F.3d 482 (1st Cir. 2016); Perry v. Cable News Network, Inc., 854 F.3d 1336 (11th Cir. 2017)).
• Identify server-side sends. Conversions API, customer data platform, and offline uploads.
• Test other vendors the same way. TikTok, Google, X, LinkedIn, Pinterest, Adobe, session-replay tools. Authority: Yershov v. Gannett Satellite Information Network, Inc., 820 F.3d 482 (1st Cir. 2016) and Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017) (Adobe); Ellis v. Cartoon Network, Inc., 803 F.3d 1251 (11th Cir. 2015) (Bango).
• Fill in the data-flow grid: person identifier, video identifier, recipient, trigger, consent gate. Authority: In re Hulu Privacy Litigation, 86 F. Supp. 3d 1090 (N.D. Cal. 2015) (identity, video, and connection as separate components).
• Save the dated logs and screenshots. They are the record of what was true on that date.

Red flag: A tag list is not an audit. Tags have conditions, partners add other tags, and a page title may be collected by a setting nobody remembers enabling.

Phase 4: Choose a fix for each surface

• Remove identifying tags from video surfaces that do not need them. This stops the disclosure at its source. Authority: § 2710(b)(1).
• Or strip the data. Send generic events with no title or slug, scrub URLs and referrers, and disable automatic collection. Authority: § 2710(a)(3). Note: A numeric video ID is a weak fix if the recipient can resolve it. Test the result again.
• Or gate the tag behind statutory consent (Phase 5). Authority: § 2710(b)(2)(B).
• Or record a decision to accept the risk. State who decided and on what ground, knowing that the record bears on knowledge. Authority: § 2710(b)(1); In re Hulu Privacy Litigation, 86 F. Supp. 3d 1090 (N.D. Cal. 2015).
• Do not rely on a format defense outside the Second Circuit. Authority: Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025) and Hughes v. National Football League, No. 24-2656 (2d Cir. June 20, 2025) (summary order) (code not legible to an ordinary person), compared with Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025) (format irrelevant) and Plotsker v. Envato Pty Ltd., No. 2:24-cv-04412 (C.D. Cal. Aug. 26, 2025) and Stark v. Patreon, Inc., No. 22-cv-03131 (N.D. Cal. Oct. 13, 2022) (FID allegations sufficient on the pleadings).
• Do not rely on a filter that keeps the data but hides it from a marketer's view. The recipient still receives it.
• Do not rely on the ordinary course exception for ad tech. Authority: § 2710(a)(2) (a closed list); Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025); Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618 (7th Cir. 2014) (a call center was within "request processing").
• Retest after each fix. Re-run the Phase 3 test on the same templates and log the before and after.
• Assign a tag owner. Quarterly retest; no new script on video templates without review; rerun after every redesign or agency change.

Red flag: Moving a tag from the browser to the server may reduce visibility without reducing liability. If anything, it removes the argument that the visitor's browser made the disclosure.

Phase 5: Consent that matches the statute

Skip this phase only if nothing identified about video leaves your systems.

• Separate form. Consent sits on its own screen or modal, apart from terms, checkout, and billing. Authority: § 2710(b)(2)(B)(i).
• Informed content. Name the recipient, say that titles or subject matter are included, and state the purpose. Authority: § 2710(b)(2)(B) ("informed, written consent").
• Affirmative action. No pre-ticked box, and no consent by continuing to browse.
• Election of timing. Offer consent at the time of disclosure, or in advance for a set period. Authority: § 2710(b)(2)(B)(ii).
• Two-year limit. Advance consent ends at the earlier of two years or withdrawal. Calendar re-consent. Authority: § 2710(b)(2)(B)(ii)(II).
• Clear and conspicuous withdrawal. Offer case-by-case and ongoing withdrawal, in settings and near video. Authority: § 2710(b)(2)(B)(iii).
• Tag gating. Confirm by network test that no identifying request fires before consent, after refusal, or after withdrawal.
• Consent log. Record user or session, time, text version, screen version, choice, expiry, and withdrawal. Keep it as long as the limitations period requires. Authority: § 2710(c)(3).
• Version archive. Keep a screenshot and the text of each version.
• Do not treat a privacy policy as consent. Authority: § 2710(b)(2)(B)(i); Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024), note 4, and Hughes v. National Football League, No. 24-2656 (2d Cir. June 20, 2025) (summary order) (issue left for the district court, with a dispute over disclosure versus collection).
• Do not rely on the user's agreement with the platform. Authority: Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025) (noting the argument was not made and pointing to the provider's duty to offer withdrawal).
• Ask children's questions first. If the audience includes children, involve the COPPA analysis before any consent design. Authority: 15 U.S.C. § 6501; In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016). See COPPA Children's Privacy Compliance Checklist: A Practical Checklist.

Red flag: A consent banner that loads the pixel first and asks second is evidence of the disclosure and evidence that you knew consent mattered.

Phase 6: Vendors, contracts, and public statements

• Read the platform's current business terms and your representations in them. Meta's Business Tools Terms address rights, legal basis, and consent.
• Sort each vendor into two groups: service providers that handle viewing data only for you, and recipients that use it for themselves. Authority: § 2710(a)(2), (b)(2)(E); Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024) (Meta is no ministerial intermediary).
• Amend service-provider contracts. Use limits, no combination, no onward disclosure, deletion, and notice of legal process. Authority: § 2710(b)(2)(E); Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618 (7th Cir. 2014).
• Warn vendors about their own status. Recipients under (D) or (E) become providers as to that information. Authority: § 2710(a)(4).
• Bind agencies. No tags without approval, with a written log and a duty to remove.
• Do not use the names-and-addresses path for pixels. It covers only names and addresses with an opt-out, and it bars titles. Authority: § 2710(b)(2)(D).
• Align the privacy policy with the audit. Delete absolute statements you cannot keep. Authority: In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016) ("We don't collect ANY personal information about your kids"); 15 U.S.C. § 45; Privacy Policy Drafting and Review Checklist: A Practical Checklist.
• Align marketing and sales statements. A sales deck bragging about match rates is a future exhibit on knowledge.

Red flag: A vendor's indemnity is only as good as the vendor's balance sheet, and platform terms generally put the compliance burden on you.

Phase 7: Retention, access, and records requests

• Set retention for watch history, logs, and exports. Destroy within one year after the data is no longer necessary, absent a pending request or order. Authority: § 2710(e). Note: Courts have refused damages for retention alone (Sterk v. Redbox Automated Retail, LLC, 672 F.3d 535 (7th Cir. 2012); Rodriguez v. Sony Computer Entertainment America, LLC, 801 F.3d 1045 (9th Cir. 2015)), and Daniel also treats subsection (b) as the basis for a civil action (Daniel v. Cantrell, 375 F.3d 377 (6th Cir. 2004)). The duty still stands, and injunctive relief has been treated as available.
• Limit internal access to viewing records. Log access.
• Respect hold exceptions. A legal hold overrides routine deletion. Authority: Fed. R. Civ. P. 37(e).
• Route law enforcement requests to counsel. Warrant, grand jury subpoena, or court order with prior notice and probable cause for court orders. Authority: § 2710(b)(2)(C), (b)(3).
• Route civil requests to counsel. An order on a showing of compelling need, with notice and a chance for the consumer to appear. Authority: § 2710(b)(2)(F).
• Do not show a viewer's history to others in support channels without process. Displaying it to the subscriber is fine. Authority: § 2710(b)(2)(A); Mollett v. Netflix, Inc., 795 F.3d 1062 (9th Cir. 2015).
• Review arbitration and class waiver terms. Check assent evidence and flows. Authority: Berman v. Freedom Financial Network, LLC, 30 F.4th 849 (9th Cir. 2022); Meyer v. Uber Technologies, Inc., 868 F.3d 66 (2d Cir. 2017); Chabolla v. ClassPass Inc., 129 F.4th 1147 (9th Cir. 2025); Sellers v. Bleacher Report, Inc., No. 23-cv-00368 (N.D. Cal. July 28, 2023).
• Decide what you would do with 4,000 demands. Fees, rosters, and batching. Authority: Powers v. Discovery Communications LLC, No. 25-cv-6398 (S.D.N.Y. June 3, 2026); Wallrich v. Samsung Electronics America, Inc., 106 F.4th 609 (7th Cir. 2024); Heckman v. Live Nation Entertainment, Inc., 120 F.4th 670 (9th Cir. 2024). See Mass Arbitration Readiness Checklist: A Practical Checklist.

Red flag: Archived watch history kept "just in case" is what turns a modest claim into proof of every viewing for every class member.

Phase 8: When a demand letter or complaint arrives

• Issue a litigation hold the same day. Include tag manager versions, Events Manager history, consent logs, video catalogs, marketing email, and agency communications. Authority: Fed. R. Civ. P. 37(e); see Litigation Hold and Evidence Preservation Checklist: A Practical Checklist.
• Capture the current state, then stop the ongoing disclosure. Preservation precedes the fix.
• Notify insurers. Read notice provisions and privacy exclusions.
• Calendar deadlines. Response date, Fed. R. Civ. P. 12 timing, removal under 28 U.S.C. § 1453 and 28 U.S.C. § 1332 if filed in state court, and the two-year period under § 2710(c)(3).
• Test the claimant list. Are these actual account holders? Were they customers at the relevant time? Did they watch while a tag was firing? Authority: Martinez v. D2C, LLC, No. 23-21394 (S.D. Fla. Oct. 1, 2024); Powers v. Discovery Communications LLC, No. 25-cv-6398 (S.D.N.Y. June 3, 2026).
• Identify arbitration rights before any merits motion. Authority: Morgan v. Sundance, Inc., 596 U.S. 411 (2022) (no prejudice needed for waiver); Coinbase, Inc. v. Bielski, 599 U.S. 736 (2023) (stay on appeal); Rent-A-Center, West, Inc. v. Jackson, 561 U.S. 63 (2010) (delegation).
• Run the defenses in order. Provider (§ 2710(a)(4)); consumer (§ 2710(a)(1)); identifiability (§ 2710(a)(3)); knowing disclosure (§ 2710(b)(1)); consent or exception (§ 2710(b)(2)); limitations (§ 2710(c)(3)); standing (TransUnion LLC v. Ramirez, 594 U.S. 413 (2021); Popa v. Microsoft Corp., No. 24-14 (9th Cir. Aug. 26, 2025); Hunstein v. Preferred Collection & Management Services, Inc., 48 F.4th 1236 (11th Cir. 2022) (en banc)). Note: Every circuit to decide the question has found standing for a VPPA disclosure, including Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024), Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025), and Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025). Preserve the argument, but do not build the defense on it alone.
• Consider a stay. Where Salazar may dispose of the case, ask for a short stay with a report after decision.
• Answer with verified facts only. Do not deny sharing before the audit is complete. Mark settlement talks under Fed. R. Evid. 408.
• Evaluate class issues early. Who can be shown to have had an FID transmitted? Authority: Jancik v. WebMD LLC, No. 1:22-cv-644 (N.D. Ga. Feb. 20, 2025); Martinez v. D2C, LLC, No. 23-21394 (S.D. Fla. Oct. 1, 2024); Fed. R. Civ. P. 23.
• For plaintiffs, avoid the footnote. Seek leave to amend by motion with the proposed facts. Authority: Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025); Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025); Hughes v. National Football League, No. 24-2656 (2d Cir. June 20, 2025) (summary order) (futility).
• For plaintiffs, plead the client's own facts. A generic exemplar invites the problem described in Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025), note 15.

Red flag: Deleting tags the morning a demand arrives without capturing them is the fastest way to turn a defensible case into a spoliation dispute.

Phase 9: Re-check after the Supreme Court rules

• Read the opinion, not the headline. Docket, No. 25-459 will link to it.
• Update Phase 2's mapping for newsletter, purchaser, and app populations. Authority: the holding on § 2710(a)(1).
• Review what the Court said about registered or paid viewers. A narrow holding may not help you there.
• Review any language on provider status. The transcript of the October 14, 2026 argument shows several Justices raising it. Update Phase 1.
• Review any language on standing. A disclosure to a single company of machine-readable data was the subject of questions at argument. Authority: TransUnion LLC v. Ramirez, 594 U.S. 413 (2021).
• Review pending matters and stays. Calendar motions and renewed motions.
• Keep the controls in place until counsel signs off. Two years of look-back remain, and identifiability remains unresolved.
• Reissue the applicability memo. Date it.

Authority reference table

This checklist is a general working aid and does not tell you what your particular site or claim requires, so bring the results to counsel before relying on them.

Related Documents

Related Articles

• The Video Privacy Protection Act in the Age of Pixels: Who Is a Consumer and What Counts as Personally Identifiable: the doctrine and circuit splits behind each phase.
• Tracking Pixels, Session Replay, and the Wiretapping Lawsuits Reshaping Adtech: wiretap claims that often accompany VPPA claims.
• Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case: the preservation law behind Phase 8.

Related Guides

• Reducing Video Privacy Protection Act Risk on a Website or App: A Practical Guide: the same work explained step by step, with trade-offs and examples.
• Auditing Your Website Tracking Stack: A Practical Guide: fuller audit method for Phase 3.
• Responding to a Consumer Class Action Demand Letter: more on Phase 8.
• Bringing a Health App Into Compliance With Consumer Health Data Laws: A Practical Guide: a batch companion if your videos concern health.

Related Checklists

• Website Tracking Compliance Checklist: A Practical Checklist: the wider tracking controls.
• Mass Arbitration Readiness Checklist: A Practical Checklist: preparing for mass demands.
• Litigation Hold and Evidence Preservation Checklist: A Practical Checklist: hold mechanics.
• COPPA Children's Privacy Compliance Checklist: A Practical Checklist: child-directed video.
• Privacy Policy Drafting and Review Checklist: A Practical Checklist: keeping the policy accurate.
• Minors Online Compliance Checklist: A Practical Checklist: a batch companion for services used by minors.
• Data Breach Litigation Readiness Checklist: A Practical Checklist: a batch companion for when the same logs are exposed.

Related Toolkits

• Video Privacy Toolkit: Consent Language, Pixel Audits, and Litigation Response: templates for the audit grid, consent text, vendor clauses, and letters.
• Adtech Privacy Toolkit: Tag Inventories, Consent Records, and Litigation Defense: tag inventory forms.