Video Privacy Toolkit: Consent Language, Pixel Audits, and Litigation Response

How to use this toolkit

These are working papers. Copy them into your own documents, fill in the [bracketed placeholders], and delete what does not fit. Section references are to 18 U.S.C. § 2710. Papers 1 through 5 help you learn your position. Papers 6 through 9 change it. Papers 10 through 16 are for a dispute, and Paper 15 is for plaintiffs. For the reasoning, read The Video Privacy Protection Act in the Age of Pixels: Who Is a Consumer and What Counts as Personally Identifiable. For sequence and trade-offs, read Reducing Video Privacy Protection Act Risk on a Website or App: A Practical Guide. To track completion, use Video Privacy Protection Act Compliance Checklist: A Practical Checklist.

Have counsel review anything you send or publish. The Supreme Court granted certiorari in Salazar v. Paramount Global, No. 25-459, on January 26, 2026, heard argument on October 14, 2026, and has not yet ruled (Docket, No. 25-459). Any paper that depends on who counts as a consumer should be reviewed once the opinion issues.

Contents

1. Video inventory worksheet
2. Network audit protocol
3. Data-flow grid
4. Audience and forum matrix
5. Route decision memo
6. Consent language set
7. Consent log schema
8. Vendor clause bank
9. Tag change-control policy and policy statements
10. Litigation hold notice
11. Demand-letter responses
12. Motion to dismiss outline
13. Arbitration clause notes
14. Exposure worksheet
15. Plaintiff's intake questionnaire
16. Discovery topics for either side

Paper 1: Video inventory worksheet

Purpose: a single list of everywhere video is delivered. Owner: product or web lead, with counsel. Timing: week 1, refreshed each quarter.

Drafting notes. The "prerecorded" column tracks § 2710(a)(4), and two district courts have dismissed claims resting on live video (Stark v. Patreon, Inc., No. 22-cv-03131 (N.D. Cal. Oct. 13, 2022); Sellers v. Bleacher Report, Inc., No. 23-cv-00368 (N.D. Cal. July 28, 2023)). The "nature" and "revenue" columns gather facts for the "engaged in the business" analysis under In re Vizio, Inc., Consumer Privacy Litigation, 238 F. Supp. 3d 1204 (C.D. Cal. 2017) and Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025), which looked at related sales, donations, and the educational purpose of the videos. Autoplay matters because Hillsdale treated clicking on a video's page as enough to show the video was requested.

Paper 2: Network audit protocol

Purpose: to see what third parties actually receive. Owner: an engineer, directed by counsel. Timing: week 1; quarterly; after every redesign. Keep the output under counsel's direction if a dispute is foreseeable, recognizing that the underlying facts are not privileged (Fed. R. Civ. P. 26(b)(3)).

SETUP
  Browser: clean profile, extensions off, developer tools open, "Preserve log" on
  Test accounts: one logged-in social account per platform (no real person's account)
  Site accounts: anonymous | newsletter arrival via email link | free account | paid member

TEMPLATES
  One page of each surface in Paper 1, plus a page where the video has a distinctive name

STEPS, for each template and account state
  1. Load the page. Do not press play. Save a HAR file.
  2. Press play. Wait 30 seconds. Save a HAR file.
  3. Filter for vendor domains: facebook, connect.facebook, tiktok, google, doubleclick,
     twitter/x, linkedin, pinterest, adobe, and any session-replay vendor.
  4. For each request, record:
       - destination host and path
       - event name (for Meta: ev=)
       - page address (for Meta: dl=) and referrer (rl=)
       - any field with the video title or description
       - cookies sent with the request (for facebook.com: c_user, fr, datr)
       - first-party IDs (for Meta: _fbp, _fbc)
       - hashed fields (for Meta: ud[em], ud[ph], and similar)
  5. Search each HAR for the distinctive video name and for a test email address,
     including its SHA-256 hash.
  6. Repeat with: consent refused | consent given | third-party cookies blocked | logged out.
  7. Mobile apps: repeat through an intercepting proxy with a test device.
  8. Ask engineering for server-to-server sends (Conversions API, CDP exports).

OUTPUT
  Dated HAR files, screenshots, tag manager export with version history, Events Manager
  settings. Record the tester's name and method so a witness can later describe them.

Drafting notes. The sample request reproduced in Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025) shows the id, ev, and dl fields, with the course name readable in the address. Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025) describes the title in a percent-encoded field and an FID in a c_user value. Plotsker v. Envato Pty Ltd., No. 2:24-cv-04412 (C.D. Cal. Aug. 26, 2025) involved an allegation about the fr cookie after logout. The protocol tests those cases directly. Parameter names belong to the vendor and can change, so verify current names in the vendor's documentation and in your own captures. The named tester matters because someone may later need to authenticate this evidence.

Paper 3: Data-flow grid

Purpose: a single page showing whether identity and video travel together. Owner: counsel. Timing: after Paper 2.

Drafting notes. The two columns follow In re Hulu Privacy Litigation, 86 F. Supp. 3d 1090 (N.D. Cal. 2015), which separated the consumer's identity, the video's identity, and the connection between them. If a row is empty on either side, that row probably has no § 2710(a)(3) problem, subject to linkage. The "format" column matters under Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025) and Hughes v. National Football League, No. 24-2656 (2d Cir. June 20, 2025) (summary order), and does not matter under Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025). The "recipient's use" column bears on the exception in § 2710(b)(2)(E) and on the Second Circuit's distinction between a ministerial intermediary and a company using data for itself in Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024). "Date first seen" feeds the limitations analysis under § 2710(c)(3).

Paper 4: Audience and forum matrix

Purpose: to apply the current splits to your users. Owner: counsel. Timing: after Paper 3; on any Supreme Court decision.

Drafting notes. The authorities are Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025), Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025), Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025), Gardner v. Me-TV National Ltd. Partnership, 132 F.4th 1022 (7th Cir. 2025), Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025), Yershov v. Gannett Satellite Information Network, Inc., 820 F.3d 482 (1st Cir. 2016), Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017), Ellis v. Cartoon Network, Inc., 803 F.3d 1251 (11th Cir. 2015), and Perry v. Cable News Network, Inc., 854 F.3d 1336 (11th Cir. 2017). "PII hard" and "PII open" are shorthand for the state of the personally identifiable information question. They are not predictions. Mark each cell after checking recent decisions in the circuit. A row that reads "consumer" everywhere is where to spend your first dollar.

Paper 5: Route decision memo

Purpose: to record the decision for each surface. Owner: counsel and the business lead. Timing: after Paper 4.

PRIVILEGED AND CONFIDENTIAL | ATTORNEY-CLIENT COMMUNICATION
To: [Decision maker]   From: [Counsel]   Date: [date]
Re: Video surface decision: [surface]

1. Facts. Tags on this surface: [ ]. Data sent, per audit dated [ ]: [ ].
2. Population. [ ] paid, [ ] registered, [ ] newsletter, [ ] open.
3. Business value. What marketing would lose if the tag were removed: [ ].
4. Options.
   A. Remove. Effect: [ ]. Cost: [ ].
   B. Strip title or identifier. Effect: [ ]. Cost: [ ]. Leak risks: [ ].
   C. Consent under section 2710(b)(2)(B). Expected opt-in: [ ]. Build: [ ].
   D. Keep and rely on defenses: [ ]. Forums where those defenses fail: [ ].
5. Decision: [ ]. Effective date: [ ]. Retest date: [ ]. Owner: [ ].
6. Review trigger. Any Supreme Court decision in No. 25-459; any demand; any new tag.

Drafting notes. Keep the factual section accurate and spare. A decision to keep a tag bears on the knowledge element in § 2710(b)(1), since In re Hulu Privacy Litigation, 86 F. Supp. 3d 1090 (N.D. Cal. 2015) turned on the absence of proof that the company knew what was being connected. Legal advice in this memo should stay in a privileged channel, but do not assume the underlying decision stays secret. If you ever rely on advice of counsel as a defense, privilege over the advice may be waived. A business summary should go in a separate document without legal analysis.

Paper 6: Consent language set

Purpose: text for each place consent can be captured. Owner: counsel and product. Timing: before any consent-gated tag goes live. Choose one or more versions, and use the same core disclosure in each.

Version A: stand-alone screen at sign-up, after terms are accepted

One more choice: sharing what you watch

With your permission, [Company] will send [Recipient, e.g., Meta Platforms, Inc.] information that can identify you, such as your [Recipient] account ID, together with the titles of the videos you watch on [Service]. [Company] and [Recipient] will use it to show you advertising and measure how it performs.

You can use [Service] whether or not you agree. If you agree, your permission lasts 2 years, unless you withdraw it earlier in Settings > Privacy > Video Sharing or from any video page.

( ) Yes, share my viewing information as described ( ) No, do not share it

[Continue]

Version B: player-level gate at the time of disclosure

Before this video plays: may we tell [Recipient] that you watched it, using information that can identify you? [Share for this video] [Share for 2 years] [Don't share]

Version C: settings page control

Video Sharing with [Recipient] Status: [On until DATE / Off] When on, we send [Recipient] the titles of videos you watch along with information that can identify you. [Turn off] [Turn off for the next video only]

Version D: renewal prompt, 30 days before expiry and at next login

Your permission to share your viewing information with [Recipient] ends on [DATE]. Unless you renew it, we will stop sharing on that date. [Renew for 2 years] [Let it end]

Version E: confirmation message after withdrawal

You've turned off Video Sharing with [Recipient]. We will not send your viewing information to [Recipient] from now on. Information already sent is handled under [Recipient]'s terms: [link].

Drafting notes.

• Distinct and separate. § 2710(b)(2)(B)(i). Version A follows terms acceptance and has its own control. Do not merge it with a terms checkbox or a payment button.
• Informed. Each version names the recipient and says titles are included. Vague references to "partners" or "improving your experience" invite the kind of dispute noted in Hughes v. National Football League, No. 24-2656 (2d Cir. June 20, 2025) (summary order) about whether a policy disclosed sharing at all.
• Election. § 2710(b)(2)(B)(ii). Version B offers both a one-time and a period option. The choice is the consumer's, under the statute's words "at the election of the consumer."
• Two years. § 2710(b)(2)(B)(ii)(II). The word "lasts" in Version A and the prompt in Version D are how you honor it. The 2013 amendment, Pub. L. No. 112-258, 126 Stat. 2414, allowed this.
• Withdrawal. § 2710(b)(2)(B)(iii) requires a clear and conspicuous opportunity to withdraw case by case or from ongoing disclosures. Version B supplies case-by-case choices, and Version C supplies both.
• Choice not tied to service. The statute does not expressly bar conditioning access on consent. At the Supreme Court argument, Justice Sotomayor imagined a viewer who is told consent is the price of the free video. Conditioning may nonetheless weaken "informed" consent and create trouble under other privacy laws, so choose deliberately, and change the text if you do.
• Argument isn't law. Justices Kagan and Kavanaugh suggested at argument that consent is easy, and Justice Kagan compared it to a cookie box (transcript of the October 14, 2026 argument). Paramount's counsel answered that the statute requires more. A generic cookie banner does not address titles or a named recipient, so do not use it alone.

For general consent flow design and change records, see Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records.

Paper 7: Consent log schema

Purpose: proof, for each person, that consent met the statute. Owner: engineering. Timing: with Paper 6.

consent_id           unique
user_id              or session/device ID for logged-out users
recipient            named recipient covered
consent_text_ver     pointer to archived text
screen_ver           pointer to archived screenshot
placement            signup | player | settings | renewal
choice               granted | refused | withdrawn | expired
scope                single_video | ongoing
video_id             for single_video
timestamp_utc        time of action
expires_at           no later than timestamp + 2 years
withdrawal_method    settings | video page | support
ip_country           if regional logic applies
tag_gate_check_ver   version of the rule that controls whether the tag fires

Drafting notes. The fields map to § 2710(b)(2)(B)(i) (form, through the text and screen versions), (ii) (timing and expiry), and (iii) (withdrawal). Keep records at least through the limitations period in § 2710(c)(3), which runs from the act or its discovery, and through any hold. Ensure the log is limited in access and not itself a new viewing record that goes elsewhere: video_id is sensitive, and § 2710(e) applies to it. A consent log is worth little unless a person can testify how the tag gate used it, so keep the rule version.

Paper 8: Vendor clause bank

Purpose: contract language for parties that touch viewing data. Owner: counsel. Timing: at renewal, or sooner if the audit reveals an issue. These are starting points, and large platforms rarely negotiate them.

Clause 1: service-provider limits

Vendor will process Viewing Data solely to provide [the Services] to Company and for no other purpose. Vendor will not (a) use Viewing Data to build or enhance profiles, or for its own or a third party's advertising; (b) combine Viewing Data with data from any other source except as needed to perform the Services at Company's written instruction; or (c) disclose Viewing Data to anyone other than subprocessors bound by equivalent terms. "Viewing Data" means information that identifies or can be used to identify a person as having requested or obtained specific video materials or services from Company.

Clause 2: ordinary-course function statement

The parties intend Vendor's access to Viewing Data to be limited to [order fulfillment / request processing / debt collection / transfer of ownership] within the meaning of 18 U.S.C. § 2710(a)(2). Vendor acknowledges that, under 18 U.S.C. § 2710(a)(4), a recipient of a disclosure under 18 U.S.C. § 2710(b)(2)(D) or (E) may be treated as a video tape service provider with respect to the information disclosed.

Clause 3: no pixel or SDK addition

Vendor will not add or enable any tag, pixel, SDK, script, or server-to-server integration that transmits information from Company's properties to a third party without Company's prior written approval, identifying the recipient and the data elements.

Clause 4: deletion and retention

Vendor will delete Viewing Data within [ ] days of Company's instruction or the end of the Services, and in any event within one year after it is no longer necessary for the purpose for which it was collected, unless subject to a pending request or order of which Vendor has notified Company.

Clause 5: legal demands

If Vendor receives legal process seeking Viewing Data, Vendor will, unless legally prohibited, notify Company within [2] business days and allow Company to respond, so that the disclosure complies with 18 U.S.C. § 2710(b)(2)(C) or (F).

Clause 6: compliance cooperation and indemnity

Vendor will give Company information reasonably needed to determine what Vendor receives and how it is used, including for audits and litigation. Vendor will indemnify Company for third-party claims arising from Vendor's breach of Clauses 1 through 5.

Drafting notes. The definition in Clause 1 borrows § 2710(a)(3). Clause 2's list is the closed list in § 2710(a)(2), and it describes a real function, since a label alone will not satisfy a court. Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618 (7th Cir. 2014) shows a call center fits "request processing," including training use, because of the actual function performed. An advertising platform will not fit, and Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025) collects the cases, so do not sign a clause suggesting otherwise. Clause 5 reflects the conditions in § 2710(b)(2)(C), (F), and (b)(3). As for platforms, Meta's Business Tools Terms put representations about legal basis and consent on the business. Assume there is no indemnity from a platform.

Paper 9: Tag change-control policy and policy statements

Purpose: to stop the problem from recurring, and to keep public statements true. Owner: privacy owner. Timing: after remediation.

TAG CHANGE CONTROL
1. Scope. Any third-party script, pixel, SDK, or server-to-server feed on any property.
2. Request. Requester states: vendor, purpose, data elements, pages, recipient's use.
3. Review. Privacy owner reviews. Any change touching a video surface goes to counsel.
4. Test. Network test before and after release; attach HAR summary to the ticket.
5. Log. Date, approver, release, removal date.
6. Agencies. Agencies have no publishing rights in the tag manager without approval.
7. Quarterly. Export the container; run Paper 2; compare with the log; report gaps.

Privacy policy insert (adapt to what your audit shows):

Video viewing information. When you watch videos on [Service], we record which videos you watch in order to [provide, resume, and recommend videos]. We do not disclose information that identifies you together with the titles of videos you watch to advertising or social media companies unless you have given separate permission in [Settings > Privacy > Video Sharing]. You can withdraw permission at any time there. We keep viewing history for [period] and then delete or de-identify it.

Drafting notes. Use this insert only if it is true on the day it is published, and retest on a schedule. A promise such as "We don't collect ANY personal information about your kids" kept a state-law intrusion claim alive in In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016) after the VPPA claim failed, and a false statement may be deceptive under 15 U.S.C. § 45. A privacy-policy statement is not VPPA consent. See Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC. The retention clause should match your § 2710(e) schedule. For wider tag governance, see Adtech Privacy Toolkit: Tag Inventories, Consent Records, and Litigation Defense.

Paper 10: Litigation hold notice

Purpose: to preserve evidence before changing anything. Owner: counsel. Timing: on the day a demand or complaint arrives, or when a dispute becomes reasonably foreseeable.

LEGAL HOLD NOTICE | DO NOT DELETE
Date: [ ]    From: [Counsel]    To: [Web, marketing, product, data, agency contacts, IT]

We have received a claim concerning video viewing information and third-party
tracking tools on [properties]. You must keep, and must not delete, alter, or
overwrite, the following until told otherwise:

  - Tag manager containers, versions, change history, and account logs
  - Meta Business Manager and Events Manager settings, datasets, and history
    (and the equivalent at other vendors)
  - Site code and templates for video pages, including prior releases
  - Consent banner settings, consent logs, and text versions
  - Video catalogs, viewing logs, and account and subscription records
  - Privacy policies and terms, all versions, with dates
  - Contracts and communications with agencies and vendors about tags or audience data
  - Email, chat, and documents about pixels, retargeting, match rates, audiences,
    or video viewing data

Auto-delete rules for these sources are suspended: [list, by system].
Before any change to a tag or page, contact [Counsel]. We will capture the current
state first. Do not discuss this matter outside this group or with outside parties.
Questions: [Counsel, contact].

Drafting notes. The hold follows the reasonable-anticipation trigger behind Fed. R. Civ. P. 37(e). A live tag should come down quickly, but only after capture. Vendor-held data can expire, so send a preservation request to the vendor where needed. Viewing logs set for § 2710(e) destruction must be held once a request or order is pending, and the statute itself makes that exception. For the checklist, see Litigation Hold and Evidence Preservation Checklist: A Practical Checklist.

Paper 11: Demand-letter responses

Purpose: to respond without conceding facts or forfeiting rights. Owner: counsel. Timing: acknowledgment within days; substance after the audit.

Letter A: acknowledgment

[Date] Re: Your letter of [date] to [Company]

We represent [Company] and have received your letter. Please direct further communications to me. [Company] takes these matters seriously and has taken steps to preserve relevant information.

To evaluate your clients' claims, please provide: (1) each claimant's full name and the email address or account used with [Company]; (2) the service, account, or purchase on which each relies; (3) the approximate dates and the specific videos at issue; (4) the data your clients contend was disclosed, to whom, and how you determined this, including any screenshots or reports; and (5) any retainer or assignment basis for your authority to act for each claimant.

Nothing in this letter is an admission or waiver, and [Company] reserves all rights and defenses, including rights under its [Terms of Use / arbitration provisions].

Letter B: substantive response to a single or small group claim

We have reviewed your letter. On the current information, [Company] disputes the claim for reasons including the following, each of which it reserves: [Company is not "engaged in the business" of delivering prerecorded video, 18 U.S.C. § 2710(a)(4), because (facts)]; [your client is not a "consumer," § 2710(a)(1), in light of (circuit authority), and the Supreme Court is considering that question in Salazar v. Paramount Global, No. 25-459]; [the information alleged is not personally identifiable under (circuit authority)]; [your client agreed to arbitrate individually under (provision) on (date)].

Without admission, [Company] is willing to discuss a tolling and standstill agreement until [30] days after the Supreme Court's decision. This letter is a compromise communication under Fed. R. Evid. 408 to the extent it discusses resolution.

Letter C: mass arbitration demand

We have received [number] notices purporting to be on behalf of individual claimants. The notices do not provide enough information for [Company] to identify many claimants or determine whether they are bound by, or comply with, the pre-dispute process in [provision]. Please provide a list stating, for each claimant: name, account email, dates of use, the relevant service, and a signed authorization or other confirmation that the claimant personally retained your firm. [Company] will respond under [provision] within [ ] days after receiving a complete list. [Company] reserves its rights regarding the forum, the applicable version of its terms, and claimants who are not eligible.

Drafting notes. Authority for each bracket: provider, In re Vizio, Inc., Consumer Privacy Litigation, 238 F. Supp. 3d 1204 (C.D. Cal. 2017), Osheske v. Silver Cinemas Acquisition Co., 132 F.4th 1110 (9th Cir. 2025), and Goodman v. Hillsdale College, No. 1:25-cv-417 (W.D. Mich. Oct. 17, 2025); consumer, Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025) and Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025) in narrow-reading circuits; identifiability, Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025), Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017), and In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016); arbitration, Morgan v. Sundance, Inc., 596 U.S. 411 (2022), since delay can waive. Make no factual statement about tags before the audit, and never write "we do not share your data" unless a witness can back that up. Rule 408 is limited: Fed. R. Evid. 408 restricts use to prove or disprove validity or amount, and the letter's facts can still be used for other purposes. A signed authorization request in Letter C is prudent after Powers v. Discovery Communications LLC, No. 25-cv-6398 (S.D.N.Y. June 3, 2026), where two of 4,225 named plaintiffs had died, one before filing, and where Stark v. Patreon, Inc., No. 22-cv-03131 (N.D. Cal. July 8, 2025) rejected 927 assigned opt-outs. Keep the tone neutral, because the Powers court declined to sanction counsel. See also Responding to a Consumer Class Action Demand Letter and Drafting a Settlement Agreement and Release: A Practical Guide.

Paper 12: Motion to dismiss outline

Purpose: to organize a motion under Fed. R. Civ. P. 12(b)(6) and, if appropriate, (b)(1). Owner: litigation counsel. Timing: by the response date, after arbitration has been considered.

INTRODUCTION
  The statute regulates a specific actor and a specific act. The complaint alleges neither.

BACKGROUND (only pleaded facts and materials properly noticed)
  Site; videos; alleged relationship; alleged transmission; what the exhibit shows.

LEGAL STANDARD
  Twombly; Iqbal.

ARGUMENT
I.   [If forum clause or arbitration applies, move first; see Paper 13.]
II.  Defendant is not a "video tape service provider." Section 2710(a)(4).
     A. Marketing content is not the business of delivering video (Vizio; district line).
     B. Theater, live, or other outside content (Osheske; Stark; Bleacher Report).
     C. Preserve: streaming is not "similar" (Pileggi concurrence). [Check the
        Supreme Court's opinion.]
III. Plaintiff is not a "consumer." Section 2710(a)(1).
     A. No subscription: Ellis; Perry; Austin-Spearman. Distinguish Yershov on its facts.
     B. No audiovisual subscription: Paramount; Pileggi. [Check the Supreme Court's opinion.]
     C. In broad-reading circuits, preserve the point and argue no exchange of value.
IV.  No "personally identifiable information." Section 2710(a)(3).
     A. Ordinary person: Nickelodeon; Eichenberger; Solomon; Hughes.
     B. Apply to the exhibit: what an ordinary person would see, and what is missing.
     C. Answer Hillsdale and Manza where not bound; distinguish Yershov (GPS).
V.   No "knowing" disclosure. Section 2710(b)(1); Hulu. [Weakest on the pleadings.]
VI.  [If the record allows] Consent or exception. Section 2710(b)(2). Caution: Salazar
     note 4 and Hughes leave policy-based consent for later.
VII. [If true] Time bar. Section 2710(c)(3). Compare Pond5.
VIII.[Rule 12(b)(1)] No concrete injury. Spokeo; TransUnion; Hunstein; Popa v. Microsoft.
     Acknowledge Salazar v. NBA, Paramount, Pileggi, Eichenberger, Perry.
IX.  Leave to amend should be denied where sought only in a footnote: Solomon; Paramount.

CONCLUSION

Circuit adjustments

Drafting notes. Consider asking for a stay under the court's inherent authority pending Salazar if consumer status is dispositive. A Second Circuit panel said in Hughes that a consent attack on standing belongs with the merits, so do not dress up consent as a jurisdictional argument. The argument transcript is not authority, but it shows which issues are drawing attention (transcript of the October 14, 2026 argument). For the motion's mechanics, see Motions to Dismiss Under Rule 12: A Practical Guide for Plaintiffs and Defendants, and for the Article III motion, Justiciability Toolkit: Standing Allegations, Rule 12(b)(1) Motions, and Mootness Briefing. For removal decisions, see Federal Jurisdiction Toolkit: Notices of Removal, Remand Motions, and Jurisdictional Allegations.

Paper 13: Arbitration clause notes

Purpose: decisions to make before relying on arbitration against VPPA claims. Owner: counsel. Timing: at the next terms revision and before any dispute.

Sample clause fragment, for discussion only:

This Section applies to any dispute arising out of or relating to your use of [Service], including its websites, apps, newsletters, and videos, and any collection or disclosure of information about that use. [Insert forum, rules, individual-only provision, opt-out within 30 days, and mass-filing procedure.] Changes to this Section do not apply to any dispute of which a party gave written notice before the change.

Drafting notes. A clause is a business decision as much as a legal one. At $2,500 per claim, consumer arbitration fees can exceed the claim value for each filing. Morgan v. Sundance, Inc., 596 U.S. 411 (2022) means you should invoke arbitration early, and Coinbase, Inc. v. Bielski, 599 U.S. 736 (2023) gives an automatic stay during an interlocutory appeal from the denial of a motion to compel. The forum clause in Dougherty v. Zynga Inc., No. 25-cv-04051 (N.D. Cal. Mar. 31, 2026) succeeded in moving a case, which is separate from whether arbitration will be compelled. Full clause architecture is in Mass Arbitration Toolkit: Clause Architecture, Batching Protocols, and Response Plans and Arbitration and ADR Toolkit: Choosing a Forum, Drafting Clauses, and Running an Arbitration.

Paper 14: Exposure worksheet

Purpose: a defensible number for reserves, insurers, and settlement. Owner: counsel and finance. Timing: after Papers 3 and 4; update with facts.

A. Limitation window start (2 years before filing or claim date):        [date]
B. Tag active period overlapping A:                                      [dates]
C. Population by row in Paper 4:                                         [counts]
D. Share who watched at least one covered video in B:                    [%, source]
E. Share with a transmission linking identity (logged-in, browser
   allowed, consent absent):                                             [%, source]
F. Estimated claimants = C x D x E, by row:                              [ ]
G. Statutory floor (per person, per the narrow view):         F x $2,500 = [ ]
H. Per-video view, following Pileggi (average videos per person):   F x V x $2,500 = [ ]
I. Scenario adjustments:
     - consumer rule against plaintiffs (drop rows)                       [ ]
     - PII rule against plaintiffs (forum probability)                    [ ]
     - arbitration (claim rate; fees per case from current schedules)     [ ]
     - class certification risk                                           [ ]
J. Defense cost through motion to dismiss / certification / trial:       [ ]
K. Fee exposure under section 2710(c)(2)(C):                             [ ]

Drafting notes. The per-video reading comes from Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025), which described each transmission as an "act" and gave the example of $1.25 million for 100 visitors watching five videos each, in the course of reading the statute narrowly. Defendants have good reasons to contest it, including the verb "may award." Rows E and F are where class fights occur: Jancik v. WebMD LLC, No. 1:22-cv-644 (N.D. Ga. Feb. 20, 2025) accepted event data as a path to identify who was disclosed, and Martinez v. D2C, LLC, No. 23-21394 (S.D. Fla. Oct. 1, 2024) rejected a conclusory theory. Aggregated damages also raise due process issues. Check current fee schedules for any arbitration provider you name, because they change. Keep this worksheet in the privileged file, and share it only with those who need it for legal advice or reserves. For class-related exposure, see Class Certification Toolkit: Damages Models, Daubert Motions, and Certification Records, and for the settlement stage, Class Action Defense Toolkit: From Complaint Through Settlement Approval.

Paper 15: Plaintiff's intake questionnaire

Purpose: to sort viable claims before filing. Owner: plaintiff's counsel. Timing: at first contact, and before limitations run.

RELATIONSHIP
1. Which site or app? Your account email or username?
2. Did you pay? For what, and when? (Attach receipts.)
3. Did you register a free account? What did you give? What did it unlock?
4. Newsletter? When? Did it include or link to videos? Did you click through?
5. Did you buy anything else from this company? When?

VIEWING
6. Which videos, about when, on which device and browser?
7. Prerecorded or live?
8. Were you logged in to the site? To Facebook, in the same browser?

DATA
9. Have you had a Facebook account during this period? Does it use your real name?
10. Please download your off-Facebook activity report and any platform data export.
11. Have you changed browsers or settings to block cookies?

CONSENT AND CONTRACT
12. Do you recall any pop-up about sharing video? Terms or arbitration screens?
13. Have you cancelled or changed your account since signing up?

TIMING AND HISTORY
14. When did you first learn your viewing may have been shared, and how?
15. Have you signed up with any other firm or assigned your claim?

Drafting notes. Questions 1 through 5 sort clients by § 2710(a)(1) and the split in Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024), Gardner v. Me-TV National Ltd. Partnership, 132 F.4th 1022 (7th Cir. 2025), Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025), and Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025). Question 4's click-through detail answers what Pileggi and Paramount found missing. Question 7 addresses Stark v. Patreon, Inc., No. 22-cv-03131 (N.D. Cal. Oct. 13, 2022) and Sellers v. Bleacher Report, Inc., No. 23-cv-00368 (N.D. Cal. July 28, 2023). Question 9 goes to arguments made in Plotsker v. Envato Pty Ltd., No. 2:24-cv-04412 (C.D. Cal. Aug. 26, 2025), where the defendant argued names were not alleged, and in Stark. Question 10 reflects the report in Osheske v. Silver Cinemas Acquisition Co., 132 F.4th 1110 (9th Cir. 2025). Question 14 addresses the discovery trigger in § 2710(c)(3). Question 15 addresses Stark v. Patreon, Inc., No. 22-cv-03131 (N.D. Cal. July 8, 2025) and the rejected assignments, and it protects you against a duplicate claim. Under Fed. R. Civ. P. 11, you need a factual basis for each allegation you sign, and a screenshot from someone else's session is not a basis for saying what happened to your client. A pleading guide is at Drafting a Complaint That Survives a Motion to Dismiss.

Paper 16: Discovery topics for either side

Purpose: what will actually be asked. Owner: litigation counsel. Timing: after a motion to dismiss is denied, or earlier if a Rule 26(f) conference requires.

Rule 30(b)(6) topics, for the plaintiff to notice and the defendant to prepare:

1. Each pixel, SDK, and server-side integration on [properties] during [period], including dates, purpose, and who installed it.
2. The configuration of each, including events, automatic collection, advanced matching, and data fields.
3. What the company understood the recipient would do with the data, including matching, audiences, and attribution.
4. Revenue, advertising, or other value received in connection with those tools.
5. The role of video in the business, including catalog size, traffic, staffing, and revenue.
6. Sign-up flows for accounts, subscriptions, and newsletters, including what users provide and receive.
7. Terms of use, arbitration provisions, consent mechanisms, and privacy policies, by version and date.
8. Records identifying class members, viewing logs, and retention practices.

Document requests (short form): tag manager exports; Events Manager history and any event-level data; contracts with Meta and agencies; marketing plans mentioning audiences or match rates; video catalog; consent logs; policy version history.

Third-party subpoena to the recipient: event data for the pixel ID, for the class period, including whether matches to accounts occurred. Expect objections to burden and privacy, and expect the first dispute over format and cost to be important. Jancik v. WebMD LLC, No. 1:22-cv-644 (N.D. Ga. Feb. 20, 2025) rested certification in part on that anticipated production. Fed. R. Civ. P. 45 governs, and the subpoena itself may raise consumer-notice questions under § 2710(b)(2)(F) if it seeks viewing records.

Defense preparation notes. Prepare the witness on the difference between what was configured and what was understood. In re Hulu Privacy Litigation, 86 F. Supp. 3d 1090 (N.D. Cal. 2015) turned on knowledge of the connection. Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618 (7th Cir. 2014) places the burden on plaintiffs at summary judgment to point to evidence of a violation, so do not volunteer more than the topic requires. For deposition preparation, see Witness Preparation Toolkit: Session Agendas, Instruction Sheets, and Practice Examinations. Plan for confidentiality too: consumer viewing records should be produced under a protective order, and de-identified where possible. See Negotiating a Protective Order and Filing Under Seal: A Practical Guide.

For a broader view of parallel exposure if the same logs are later compromised, see Data Breach Litigation Toolkit: Privileged Investigation Protocols, Standing Motions, and Settlement Terms, and if your audience includes children or teenagers, see Minors Online Toolkit: Applicability Matrices, Age Assurance Vendor Terms, and Parental Consent Flows.

These papers are general forms meant to be adapted by someone who knows your facts, and using them does not by itself create compliance or amount to legal advice about your situation.

Related Documents

Related Articles

• The Video Privacy Protection Act in the Age of Pixels: Who Is a Consumer and What Counts as Personally Identifiable: the law behind these templates.
• Tracking Pixels, Session Replay, and the Wiretapping Lawsuits Reshaping Adtech: parallel wiretap theories to consider when using Papers 11 and 12.
• Mass Arbitration: How Thousands of Individual Claims Became a Strategic Problem: context for Paper 13.

Related Guides

• Reducing Video Privacy Protection Act Risk on a Website or App: A Practical Guide: the sequence and decisions these papers support.
• Auditing Your Website Tracking Stack: A Practical Guide: a wider audit than Paper 2.
• Responding to a Consumer Class Action Demand Letter: broader demand-letter guidance for Paper 11.
• Motions to Dismiss Under Rule 12: A Practical Guide for Plaintiffs and Defendants: procedure for Paper 12.

Related Checklists

• Video Privacy Protection Act Compliance Checklist: A Practical Checklist: tracks completion of these tasks.
• Litigation Hold and Evidence Preservation Checklist: A Practical Checklist: supports Paper 10.

Related Toolkits

• Adtech Privacy Toolkit: Tag Inventories, Consent Records, and Litigation Defense: tag inventory forms across the stack.
• Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records: consent flows and change records.
• Mass Arbitration Toolkit: Clause Architecture, Batching Protocols, and Response Plans: clause architecture.
• Class Action Defense Toolkit: From Complaint Through Settlement Approval: class defense forms.
• Data Breach Litigation Toolkit: Privileged Investigation Protocols, Standing Motions, and Settlement Terms: a batch companion on privacy litigation.
• Minors Online Toolkit: Applicability Matrices, Age Assurance Vendor Terms, and Parental Consent Flows: a batch companion for services used by minors.
• Witness Preparation Toolkit: Session Agendas, Instruction Sheets, and Practice Examinations: a batch companion for preparing the Rule 30(b)(6) witness.