The Video Privacy Protection Act (VPPA) Explained: Streaming, Pixels, and Your Rights

Congress passed the VPPA on November 5, 1988, after a newspaper published the video rental history of Supreme Court nominee Robert Bork. The law was written for video stores, but its definitions are broad enough that courts apply it to streaming and online video today.

The core rule is in 18 U.S.C. 2710(b)(1): a "video tape service provider" who knowingly discloses a consumer's "personally identifiable information" is liable to that person. Three definitions do most of the work:

• Video tape service provider: anyone in the business of renting, selling, or delivering prerecorded video cassette tapes "or similar audio visual materials." Courts have applied this to streaming platforms and websites that host video.
• Consumer: any renter, purchaser, or subscriber of goods or services from a video tape service provider. What "subscriber" means is the question now before the Supreme Court.
• Personally identifiable information: information that identifies a person as having requested or obtained specific video materials or services.

The VPPA protects the combination of who you are and what you watched: a disclosure has to link an identifiable person to specific video titles or services to count. A company sharing that someone watched a video, without identifying who, is generally not a violation.

Section 2710(b)(2) lists the permitted disclosures. A provider may share viewing information:

• With you.
• With your informed, written consent, which can be given electronically. The consent must be in a form "distinct and separate" from other legal or financial terms, you must be able to give it either at the time or in advance for up to 2 years, and you must be given a clear way to withdraw it.
• To law enforcement with a warrant, grand jury subpoena, or court order.
• As names and addresses only, for marketing, if you were given a clear chance to opt out and the disclosure does not reveal titles or descriptions of what you watched.
• When the disclosure is "incident to the ordinary course of business," such as billing or order fulfillment.
• Under a court order in a civil case, after notice to you.

A checkbox buried in general terms of service usually does not meet the VPPA's consent rule, because the statute requires consent in a form separate from other legal or financial obligations. The consent provision was rewritten on January 10, 2013 (Public Law 112-258) to allow online consent, after Netflix and others pushed for a way to let users share viewing on social media.

Companies sued under the VPPA often argue the "ordinary course of business" exception. In the TED VPPA settlement, for example, TED said it used the software at issue only to run its site and apps. The court did not decide who was right; the case settled.

Most VPPA cases filed in the last decade follow the same pattern. A site or app with video content installs a tracking tool, often the Meta Pixel or a similar software development kit. When a logged-in user watches a video, the tool allegedly sends the page URL or video title to the ad platform along with an identifier such as the user's Facebook ID. The lawsuit says that pairing is a disclosure of who watched what.

Defendants push back on several fronts: that the plaintiff is not a "consumer," that a string of code is not "personally identifiable information," that the company did not "knowingly" disclose anything, or that the disclosure was part of ordinary business. Many companies also rely on an arbitration clause in their terms to keep claims out of court.

Courts do not agree on what counts as identifying information:

• Ordinary person standard. The Ninth Circuit (Eichenberger v. ESPN) and, since May 1, 2025, the Second Circuit (Solomon v. Flipps Media, 136 F.4th 41) ask whether the information would readily let an ordinary person identify a specific person's video watching. In Solomon, the court held that a Facebook ID and URL buried in transmitted code did not meet that bar.
• Reasonable foreseeability standard. The First Circuit (Yershov v. Gannett) asks whether the provider knew the recipient could use the data to identify the person, a test more favorable to plaintiffs.

The Supreme Court declined on December 8, 2025 to review Solomon v. Flipps Media, so the ordinary person standard still controls federal courts in New York, Connecticut, and Vermont. Where you live, and where the case is filed, can decide whether a pixel claim survives.

The biggest open question is whether you have to subscribe to video to be protected. The federal appeals courts split:

• Broad reading. In Salazar v. National Basketball Association, 118 F.4th 533 (2d Cir. 2024), the Second Circuit held that a person who subscribed to the NBA's online newsletter was a "consumer" even though the newsletter itself was not video. The Seventh Circuit agreed in Gardner v. Me-TV National Ltd. Partnership, 132 F.4th 1022 (7th Cir. 2025). The Supreme Court declined to review the NBA case on December 8, 2025.
• Narrow reading. In Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025), the Sixth Circuit held that only people who subscribe to audiovisual goods or services qualify, so a newsletter subscriber who watched videos on 247Sports.com was not covered. The D.C. Circuit went further in Pileggi v. Washington Newspaper Publishing Co. (2025), requiring that the videos disclosed be the same video materials or services the person bought, rented, or subscribed to.

The Supreme Court granted review in Salazar v. Paramount Global (No. 25-459) on January 26, 2026, and set oral argument for Wednesday, October 14, 2026. A decision is expected by mid-2027. If the Court adopts the narrow reading, many pending cases based on newsletter sign-ups or free accounts could be dismissed. If it adopts the broad reading, more people who never paid for video could have claims.

Until then, the answer to "am I covered?" depends on which federal circuit your claim is in. People who paid for or subscribed to a streaming service directly are on the firmest ground under every reading.

Under 18 U.S.C. 2710(c)(2), a court may award actual damages but not less than $2,500 in liquidated damages, plus punitive damages, reasonable attorney fees and costs, and other equitable relief. Those statutory damages do not require you to prove any financial loss, which is why a single VPPA case can involve very large potential exposure.

Class settlements pay far less than $2,500 per person. Because a class action can include millions of users, companies settle for a fraction of the theoretical total, and each claimant's share depends on how many people file. Two examples in our database:

Settlement	Fund	Per-person benefit
TED Foundation	$350,000	$5 cash or 2 free months
VPPA case cited in the TikTok approval	Not stated	$16.50 per claim

The TikTok privacy settlement approval opinion cited a VPPA settlement paying $16.50 per claim as a point of comparison. Our guide on why payouts are smaller than expected explains the math.

The 2-year deadline

A VPPA lawsuit must be filed within 2 years from the date of the disclosure or the date of discovery (18 U.S.C. 2710(c)(3)). Because pixel disclosures happen every time you watch, new violations can keep the window open while the tracking continues. Once a company removes a pixel, the statute of limitations for past views starts to run out.

You usually cannot see the disclosure yourself; attorneys and technical experts reconstruct it from how the site's code behaves. What you can do is preserve the facts that establish you as a consumer:

1. Your account details. Screenshots of your subscription, account creation date, and any paid plan or newsletter sign-up.
2. Your viewing activity. Many services keep a watch history you can export or screenshot.
3. Your social media login status. Whether you were logged into Facebook or Instagram on the same browser or device while watching matters in pixel cases.
4. The terms you agreed to. Save a copy of the privacy policy and terms, including any arbitration clause, as they read when you signed up if you can find them.
5. Settlement notices. If you get a notice by email, check it against the court-approved site before clicking. Our guide to settlement scams shows what to look for.

If a settlement already exists, you file only on its official website, run by the court-approved settlement administrator. For streaming breaches that exposed more than viewing data, see the Crunchyroll data breach page. If you subscribed to a video service and suspect it shared what you watched, a free case review can connect you with independent attorneys who handle VPPA claims.