The Video Privacy Protection Act (VPPA) bars sharing what people watch without written consent, and the Supreme Court is deciding who can sue under it. If your site plays video and also runs tracking pixels such as the Meta Pixel, the VPPA is one of the laws most likely to produce a class action against you. The Court heard argument in Salazar v. Paramount Global on 14 October 2026 and has not ruled. This guide covers what the statute says, the two circuit splits that decide your risk, what recent settlements required, and what to change on your site. It is general information, not legal advice.
Where Salazar v. Paramount stands
- Case: Salazar v. Paramount Global, Supreme Court No. 25-459, from the Sixth Circuit.
- Question presented: whether "goods or services from a video tape service provider" in the definition of "consumer" means all of a provider's goods or services, or only its audiovisual ones.
- Timeline: review granted 26 January 2026; argued 14 October 2026.
- Status on 4 November 2026: no decision. The docket shows nothing after argument except a corporate disclosure letter dated 23 October 2026.
- What happens next: the Court normally issues its opinions by the end of its term, around June or early July 2027, though a ruling can come earlier. If the Court reverses, the case would go back to the lower courts. If it affirms, the Sixth Circuit's narrower reading stands. We are not predicting the outcome, and we will update this guide when the Court rules.
What the Video Privacy Protection Act says
Congress passed the VPPA in 1988 (Public Law 100-618, codified at 18 U.S.C. 2710) after Robert Bork's video rental history was reported while his Supreme Court nomination was pending. The report was published by the Washington City Paper in 1987, according to secondary accounts we could read. The law was written for video rental stores. It has since been applied to websites and apps.
The core rule is one sentence. A "video tape service provider" may not knowingly disclose "personally identifiable information concerning any consumer" to any person. Three definitions do most of the work:
- Video tape service provider: someone in the business of renting, selling or delivering prerecorded video cassette tapes or similar audiovisual materials.
- Consumer: a renter, purchaser or subscriber of goods or services from a video tape service provider.
- Personally identifiable information: includes information that identifies a person as having requested or obtained specific video materials or services.
A site that embeds video and runs a pixel can send a viewer's identifier and the video title to an ad platform. Plaintiffs say that is a disclosure of personally identifiable information. Defendants answer that they are not video tape service providers, that the plaintiff is not a consumer, that nothing identifying was disclosed, or that the plaintiff consented.
What it costs if you lose
The statute lets a person sue in federal court without waiting for a regulator. A court may award actual damages "but not less than liquidated damages in an amount of $2,500", plus punitive damages, reasonable attorneys' fees and costs, and preliminary or equitable relief. The limitation period is two years from the act or its discovery.
Many articles, including the draft this guide replaced, say "$2,500 per violation". The statute does not use those words. In a class action the minimum is multiplied by the number of class members, which is how settlements reach millions. Whether several disclosures to one person multiply the award is a question we found no appellate ruling on. Treat "per person" as the safe reading and "per violation" as unsettled.
On volume, commentary from 2025 describes hundreds of putative class actions over pixel tracking. We could not find a reliable count, and we could not confirm that the VPPA is the single biggest source of tracking suits. California wiretap claims (see our guide to CIPA compliance) are also brought in large numbers. "One of the most active" is the claim that holds up.
The 2013 amendment on social sharing
President Obama signed an amendment on 10 January 2013, after Netflix lobbied for it. It allows a consumer to give consent online and to consent in advance for up to two years, with a way to withdraw. That is why the consent route in the statute is workable for streaming and video sites at all.
Salazar v. Paramount Global: the facts and the argument
The case is Salazar v. Paramount Global, No. 25-459. Michael Salazar subscribed to a 247Sports.com email newsletter, a Paramount site, and watched videos there. He says Paramount sent his Facebook ID and viewing history to Facebook through a pixel without consent. The district court held he was not a "consumer" because a newsletter is not audiovisual content. A divided Sixth Circuit panel affirmed on 3 April 2025 (133 F.4th 642), and rehearing was denied on 13 May 2025.
The Court granted review on 26 January 2026 and heard argument on 14 October 2026. The question presented is narrow: whether "goods or services from a video tape service provider", in the definition of "consumer", means all of the provider's goods or services, or only its audiovisual ones. The petition states that both lower courts assumed Paramount is a video tape service provider and assumed the disclosed information is personally identifiable information. So the Court is not deciding those two issues.
As of 4 November 2026 the docket shows no decision. A ruling is expected by the end of the Court's term in mid-2027. Press accounts of the argument say the justices seemed inclined to let Salazar's suit go forward, but argument tone is a weak guide. SCOTUSblog also reported that several justices questioned whether a website like 247Sports fits the statute at all, that Justice Kavanaugh raised overbreadth worries, and that Justice Barrett asked about standing. Those open points could still help defendants even if Salazar wins on "consumer".
Two circuit splits, not one
The draft this guide replaced described a split between "a Michigan federal court and a New York federal court". That is not how the law divides. There are two separate splits between federal appeals courts, and only one is before the Supreme Court.
| Question | Position A | Position B | Status on 4 Nov 2026 |
|---|---|---|---|
| Who is a "consumer"? | Any goods or services from the provider count: Second Circuit (Salazar v. NBA, 2024), Seventh Circuit (Gardner v. Me-TV, 2025) | Only audiovisual goods or services count: Sixth Circuit (Salazar v. Paramount, 2025), D.C. Circuit (Pileggi, 2025) | Argued 14 Oct 2026, no decision |
| What is "personally identifiable information"? | "Ordinary person" test: Third Circuit (In re Nickelodeon, 2016), Ninth Circuit (Eichenberger v. ESPN, 2017), Second Circuit (Solomon v. Flipps, May 2025; Hughes v. NFL, June 2025) | Reasonable foreseeability: First Circuit (Yershov v. Gannett, 2016) | Not in Salazar; cert denied in Solomon (Dec 2025) and Hughes (Mar 2026); Golden v. NBCUniversal (No. 26-398) pending |
The second split matters more for pixel cases. Under the ordinary person test, a Facebook ID that only Facebook can decode may not count, and the Second Circuit has dismissed pixel claims on that basis. In the First Circuit, the test turns on what the provider could foresee the recipient would understand. The petition in Golden v. NBCUniversal, filed on 18 September 2026, asks the Court to take the issue. NBCUniversal's response is due on 23 December 2026, so a decision on whether to hear it will come later.
There are further disputes outside these two. The Eighth Circuit held in December 2025 that a movie theater was not in the business of delivering audiovisual materials, so it was not a video tape service provider. A concurrence in the D.C. Circuit's Pileggi decision doubted that a news site with videos qualifies either. In the Michigan Attorney General's case against Roku, a federal court dismissed the non-COPPA claims, which included the VPPA, for lack of standing in April 2026, as we describe in our Roku TV consent guide.
The practical result is that two businesses with the same video and pixel setup can face different outcomes depending on the court. A ruling for Paramount would end many claims by newsletter and account holders. A ruling for Salazar would widen who can sue, and the other defenses would carry more weight.
What recent settlements show
Settlements are private deals approved by a court. They are not a regulator's standard, and the amounts below come mostly from settlement aggregators and legal news, not from the orders themselves.
| Case | Court | Amount | What it shows |
|---|---|---|---|
| Carbone v. Limited Run Games | E.D.N.Y., No. 2:24-cv-08861 | $2.72 million | Final approval reported in March 2026. About one third of the fund went to class counsel. More than 27,000 claims were accepted. |
| Fan v. NBA Properties (NBA Top Shot) | N.D. Cal., No. 3:23-cv-05069-SI | $7.05 million | Defendants agreed to stop running the Meta Pixel on the NBA Top Shot site. Final approval hearing set for 19 December 2025. |
| Ohebshalom v. Dapper Labs | New York Supreme Court, Nassau County, No. 615987/2025 | $5 million | A separate case covering five platforms (NBA Top Shot, NFL All Day, Disney Pinnacle, UFC Strike, La Liga Golazos). Claim deadline 15 April 2026. |
| Stark v. Patreon | N.D. Cal., No. 3:22-cv-03131-JCS | $7.25 million | Alleged sharing of viewing data with Facebook. We could not read the approval order. |
The draft this guide replaced said the Limited Run Games settlement was approved in September 2026. Reports date the final approval to March 2026. It also called the $5 million and $7.05 million Dapper Labs payments two settlements of one problem. They are two different cases in two different courts.
The useful part of the Limited Run Games settlement is the injunction. The company agreed not to knowingly resume using the Meta Pixel, TikTok tracking technologies, Google tracking technologies or the X pixel on the US-accessible parts of its service to disclose specific video content requested by identifiable users. That restriction does not apply if it first obtains VPPA-compliant consent, or if the statute is amended or invalidated. It is a term of one private settlement, so it shows what plaintiffs ask for. It does not set a legal rule.
What counts as valid consent
The statute sets the test in section 2710(b)(2)(B). Consent must be informed and in writing (including electronic form). It must be in a form distinct and separate from other legal or financial obligations. It can be given at the time disclosure is sought, or in advance for up to two years or until withdrawn, whichever is sooner. The provider must offer a clear and conspicuous way to withdraw it.
Can a cookie banner do this? We found no appellate court that has decided. One trial court, in Lakes v. Ubisoft (N.D. Cal., 1 April 2025), dismissed VPPA and other claims on consent at the pleading stage. It counted a first-visit cookie banner, the terms accepted at account creation and the checkout flow together, and found the disclosures distinct enough. That is one decision on its facts, and a privacy group argued in that case that banners and clickwrap are not enough. The safer reading is that a general banner on its own is a weak foundation, because the statute asks for something specific, separate and withdrawable. See our comparison of a CMP and a cookie banner for how the two differ in practice.
What to do now
- Find every page where video and a third-party tag meet. Include embedded players, logged-in video areas and landing pages with trailers. Check pixels, analytics and ad tags. Our guides to the TikTok pixel, the LinkedIn Insight Tag and Meta consent mode show where these tags send data.
- Decide whether you are a video tape service provider. A company whose business is delivering video is in a different position from one that hosts a few marketing clips. Courts disagree on the line, so ask counsel before relying on this defense.
- Choose between removing the tag and gating it. Taking tracking off video pages is the cheapest fix. If you keep it, fire the pixel only after separate, logged consent for sharing video viewing data.
- Write the consent so it meets the statute. Make it a clear request, separate from your terms, with a withdrawal route and an expiry within two years.
- Keep records. You will need to show who consented, to what wording, and when.
- Check state law. The federal statute preempts only state laws that require disclosures it prohibits (section 2710(f)), so stricter state video privacy laws can still apply. The Michigan Attorney General pleaded Michigan's Preservation of Personal Privacy Act next to the VPPA against Roku. We did not verify the details of other states' video privacy laws. Our US state privacy law tracker covers the comprehensive state laws.
- Watch two dates. The Salazar ruling is expected by mid-2027, and the Court's handling of the Golden petition will show whether the identification question gets heard.
If you need a consent platform, Secure Privacy's help centre describes a contextual consent feature that shows an overlay in place of an embedded video, such as a YouTube or Vimeo embed, until the visitor agrees. Separately, the v2 platform overview lists iframe overlays for video as a feature meant to address VPPA exposure, in one line and without technical detail, so check how an overlay behaves on your own pages before relying on it. We do not claim the feature makes a site "VPPA-safe": whether a given setup meets the statute is a legal question for your counsel. The Consent Solution page describes detecting, blocking and logging consent more generally.
Video Privacy Protection Act compliance checklist
▢ List every page with embedded or hosted video
▢ List every pixel, tag and SDK that runs on those pages
▢ Record which tags send a user identifier or a video title to a third party
▢ Decide for each tag: remove, or gate behind consent
▢ Write separate video-sharing consent text, apart from terms and general cookie choices
▢ Give a clear way to withdraw, and expire consent within two years
▢ Block the tags until consent, and test that they stay blocked
▢ Log consent with wording, date and version
▢ Review player and embed vendor contracts
▢ Ask counsel about your video tape service provider status and your state exposure
▢ Re-check after the Salazar decision
FAQ
What does VPPA stand for, and what is the Video Privacy Protection Act?
In privacy law, VPPA is short for the Video Privacy Protection Act, a 1988 federal law at 18 U.S.C. 2710. It bars a video tape service provider from knowingly disclosing personally identifiable information about a consumer without consent. The same letters also stand for a virtual power purchase agreement in the energy sector, which is an unrelated topic.
What triggers a VPPA lawsuit?
Most recent cases claim that a website with video sent a visitor's identifier and the video watched to a third party through a pixel, without valid written consent. The plaintiff must also fit the statute's definitions, which is where most legal fights happen.
How much can a VPPA violation cost?
The statute allows actual damages but not less than $2,500 in liquidated damages, plus punitive damages, attorneys' fees and equitable relief. In a class action the minimum applies to each class member. Recent settlements range from $2.72 million to $7.25 million.
What is Salazar v. Paramount Global?
It is Supreme Court case No. 25-459. The Court granted review on 26 January 2026 and heard argument on 14 October 2026. It will decide whether a "consumer" is a subscriber to any of a video provider's goods or services, or only to its audiovisual ones. No decision had been issued on 4 November 2026.
Does the Salazar decision settle the whole VPPA debate?
No. The petition says the lower courts assumed Paramount is a video tape service provider and that the data was personally identifiable information. The split over what counts as personally identifiable information, and the questions about video tape service providers and standing, stay open.
Is a cookie consent banner enough for VPPA compliance?
Not reliably. The statute asks for informed, written consent in a form separate from other obligations, with a way to withdraw. One trial court counted a banner as part of valid consent alongside other steps, but we found no appellate ruling that a banner alone is enough. Separate, logged consent for video sharing is the safer design.
Does VPPA risk depend on where I am sued?
Yes. The circuits disagree on who is a consumer and on what is personally identifiable information, and the Second Circuit has dismissed pixel claims that other courts might allow. The Salazar ruling will settle the first question, and the second is still open.
