Introduction: Why the Supreme Court Just Made VPPA Litigation More Dangerous
On January 26, 2026, the U.S. Supreme Court granted certiorari in Salazar v. Paramount Global (No. 25-459), setting up what could be the most consequential VPPA decision in a generation.
For companies that operate websites, stream video content, or use pixel-based tracking tools, this matters. The Supreme Court is about to clarify who can sue you under the Video Privacy Protection Act—and depending on how the Court rules, the answer could mean the difference between manageable litigation risk and a litigation nightmare.
Here's what's at stake:
The Narrow Question: Does "consumer" under the VPPA mean anyone who subscribes to any goods or services from a company that also provides video content? Or does it mean only those who specifically subscribe to audiovisual content?
The Broader Stakes: A broad ruling could transform VPPA from a statute that targets video service providers into a universal privacy litigation machine. Companies with embedded video on their websites, news publishers with Meta Pixels, streaming services bundling written content with video—all could face exponential class action exposure.
A narrow ruling would offer some relief, but would still leave meaningful liability for anyone with a camera and a tracking pixel.
This guide walks you through the Salazar case, the circuit split it's meant to resolve, and what you should do right now while the Supreme Court deliberates.
Part 1: The Salazar Fact Pattern—How a Newsletter Subscriber Became a VPPA Plaintiff
Michael Salazar didn't buy a subscription to watch videos. He signed up for a free newsletter from 247Sports.com, a Paramount-owned website that covers college sports recruiting.
But he watched videos on the site. And Paramount used technology to track that activity.
The Technology Stack:
- Salazar visited 247Sports.com while logged into his Facebook account
- The site embedded a Meta Pixel (formerly known as the Facebook Pixel) on its pages
- The Meta Pixel is tracking code that records user activity on websites and sends that data back to Facebook/Meta
- When Salazar watched videos on 247Sports, the Meta Pixel transmitted his Facebook ID and the URLs he visited back to Meta
- That data included information about the videos he watched on 247Sports
The VPPA Theory:
Salazar argued that by transmitting his Facebook ID and video-viewing history to Meta, Paramount disclosed his "personally identifiable information" about his video viewing habits in violation of the Video Privacy Protection Act.
The VPPA prohibits video service providers from knowingly disclosing "personally identifiable information concerning any consumer" without informed written consent. "Personally identifiable information" includes information that identifies a person as having requested or obtained specific video materials.
The Central Question Salazar Created:
But was Salazar a "consumer" under the VPPA?
The VPPA defines "consumer" as "any renter, purchaser, or subscriber of goods or services from a video tape service provider."
Salazar subscribed to a newsletter (a good or service). Paramount is a video service provider (it operates a website with video content). So logically, Salazar should be a consumer.
But the lower courts said no.
Part 2: How the Courts Split on "Consumer"—The Circuit Divide
This is where the case gets interesting. The lower courts didn't agree on the answer, and their disagreement reflects a real split in how federal courts are interpreting a 38-year-old statute written for a world that no longer exists.
The Broad View: Second and Seventh Circuits
The Position: If you subscribe to any goods or services from a company that also provides video, you're a VPPA "consumer" of that company—even if you never bought, rented, or subscribed to video specifically.
Key Cases:
- Salazar v. National Basketball Association, 118 F.4th 533 (2d Cir. 2024): NBA League Pass subscribers sued, claiming the league disclosed their video-watching data to third parties. The Second Circuit held that subscribers to League Pass (a video service) were "consumers" under the VPPA. But more broadly, the court suggested that someone who buys merchandise from the NBA's store might also qualify as a "consumer" if the league also provides video content.
- Gardner v. Me-TV National Limited Partnership, 998 F.3d 1359 (7th Cir. 2021): The Seventh Circuit took a similarly expansive view, holding that the statute's language on "goods or services" is broad enough to capture any subscription or purchase from a video provider, even if unrelated to video.
Why This Matters: Under this view, a person who subscribes only to a newsletter, app, or merchandise from a media company becomes a VPPA "consumer" if that company also embeds video anywhere on its platform. Liability explodes.
The Narrow View: Sixth and D.C. Circuits
The Position: "Consumer" means someone who actually subscribed to, purchased, or rented video content—or goods/services specifically connected to video consumption. A generic newsletter doesn't cut it.
Key Cases:
- Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025): The Sixth Circuit (the court whose decision the Supreme Court just reviewed) held that a newsletter subscriber who also watched videos on 247Sports was NOT a "consumer" because the newsletter itself contained no audiovisual material. Judge Nalbandian's majority opinion reasoned that "consumer" must be read in the context of "video tape service provider"—meaning the goods or services consumed must be video-related.
- Pileggi v. Washington Newspaper Publishing Co., 89 F.4th 661 (D.C. Cir. 2024): The D.C. Circuit reached the same conclusion, holding that someone who read newspaper articles (and thus consumed the newspaper's goods or services) but also saw embedded video didn't automatically become a VPPA "consumer" just because the newspaper included video. The plaintiff had to have consumed the video content itself.
Why This Matters: Under this view, a company can embed Meta Pixels and share pixel-tracked viewing data with third parties—as long as the person suing didn't specifically subscribe to or pay for video. Narrower liability, but still meaningful for anyone actually trading video content.
The Split, Explained
The disagreement hinges on how to read the phrase "goods or services from a video tape service provider":
Broad Reading (2d & 7th Circuits):
- "Goods or services" = all goods or services that a video provider sells
- "From a video tape service provider" = from a company in the business of providing video
- Therefore: Anyone who buys anything from a company that also provides video is a "consumer"
- Real-world result: Every Unilever Prestige customer who visits the brand's website (which has video), receives a newsletter, or buys a product from the website is a potential VPPA plaintiff
Narrow Reading (6th & D.C. Circuits):
- "Goods or services" must be read in context—video-related goods or services
- "From a video tape service provider" means the provider in its capacity as a provider of video
- Therefore: You're only a "consumer" if you actually consumed video or subscribed specifically to access video
- Real-world result: Only people who watched videos and had their viewing data shared face liability exposure; newsletter subscribers or merchandise purchasers are safe
Part 3: What the Supreme Court Decision Could Mean—Three Scenarios
The Supreme Court will resolve this circuit split during the 2026-27 term. Oral arguments are scheduled for October 2026, with a decision expected in spring 2027.
The Court could rule three different ways. Each has massive implications for your website.
Scenario 1: Broad VPPA (Second/Seventh Circuit Logic Prevails)
The Ruling: The Supreme Court adopts the Second and Seventh Circuits' expansive reading: "Consumer" under the VPPA means anyone who subscribes to or purchases any goods or services from a company that also provides video.
What This Means for Your Business:
- Class Action Exposure Explodes: Every person who visited your website, subscribed to your email newsletter, made a purchase, created an account, or engaged with any digital property becomes a potential VPPA plaintiff if your website includes embedded video—even a single YouTube video embedded in a blog post.
- Damages Multiply: The VPPA allows private right of action for statutory damages of $100 to $2,500 per violation, per person. In a class action with 100,000 class members, that's $10 million to $250 million in aggregate damages before you even get to attorney's fees.
- Pixel Technology Becomes Radioactive: Meta Pixel, Google Analytics with video events, TikTok pixel, Hotjar, Crazy Egg, and any tracking tool that records user behavior on pages with video becomes prima facie evidence of VPPA violations.
- Consent Becomes Mandatory: Any disclosure of personally identifiable information tied to video viewing (even incidental viewing) requires informed written consent. "Informed" likely means affirmative opt-in, not passive acceptance or newsletter signup.
- Newsletter Liability: Even if your newsletter contains zero video, if your company's website has video, newsletter subscribers become "consumers"—and any data sharing (e.g., to email service providers, marketing automation platforms, ad networks) could trigger VPPA claims.
Example: A luxury beauty brand publishes a newsletter about skincare trends. The brand's website has embedded makeup tutorial videos. Under a broad ruling, everyone on the newsletter list becomes a VPPA "consumer" of the beauty brand, even though they subscribed to read about trends, not watch tutorials. If the brand shares newsletter subscriber data with its email vendor or retargeting platform, that's a VPPA violation.
Scenario 2: Narrow VPPA (Sixth/D.C. Circuit Logic Prevails)
The Ruling: The Supreme Court adopts the Sixth and D.C. Circuits' narrow reading: "Consumer" means someone who actually subscribed to, purchased, or rented video content, or goods/services specifically tied to video consumption.
What This Means for Your Business:
- Class Action Risk Shrinks, But Doesn't Disappear: You're not liable for tracking newsletter subscribers or merchandise purchasers. But you are liable for tracking anyone who actually watched video on your site and had that viewing data disclosed to third parties.
- Pixel Data Still Matters: If your Meta Pixel fires on pages where users actually watch video, and that data links back to a user's Facebook ID or other personally identifiable information, you still have liability exposure.
- Consent Still Required (But More Targeted): For anyone who actually viewed video, disclosure of that viewing to third parties requires informed written consent. But companies get breathing room for users who never engaged with video.
Business Impact: Manageable, but requires operational discipline. You need clear tracking of who viewed video vs. who didn't, consent mechanisms specifically for video viewers, pixel transparency, and data minimization for video-viewer segments.
Scenario 3: The Middle Path (Some Form of Nuance)
The Ruling: The Supreme Court takes a middle path, perhaps holding that "consumer" includes people who subscribe to any goods or services from a video provider, but only where those goods or services are reasonably connected to the video offering, or where the company's video presence was material to the person's subscription decision.
What This Means: Broader than the narrow view, but narrower than the broad view. Creates fact-intensive litigation around "reasonable connection" and materiality. Still drives consent requirements, but with more context-dependent liability. This is the most unpredictable scenario because it creates ongoing litigation risk.
Part 4: Immediate Actions to Take (Before the Salazar Decision)
You don't need to wait for the Supreme Court to act. There are concrete steps you can take right now to reduce your VPPA liability exposure.
1. Conduct a VPPA Audit
Ask yourself: Do we have embedded video on our website? Do we use Meta Pixel, Google Analytics with event tracking, or similar tracking tools on pages where users can view video? Do we share user data (especially data linked to video viewing) with third parties? Do we have informed written consent from users before making these disclosures?
If the answer to the first three is "yes" and the fourth is "no," you have VPPA exposure.
2. Understand Your Data Flows
Create a data inventory: Who sees user video-viewing data? How is that data transmitted? Does the data include personally identifiable information? When does the disclosure happen?
3. Implement Consent Mechanisms (If You Haven't Already)
If you have embedded video and pixel tracking, you need informed written consent. "Informed" likely means clear, specific disclosure that your company shares video-viewing data with third parties; identification of the third parties; and a choice to opt in or out. "Written" likely means digital consent (checkbox, toggle, button) documented in a system you can prove.
4. Prepare for Multiple Scenarios
If the Supreme Court Rules Broadly: Accelerate consent implementation to all users who interact with any company product/service. Consider liability insurance. Prepare for increased plaintiff's bar activity.
If the Supreme Court Rules Narrowly: Implement consent specifically for video viewers. Ensure your marketing automation and analytics platforms can distinguish video viewers from non-viewers.
5. Monitor the Case
The Salazar docket will see activity: merits briefs March–May 2026, reply briefs June–August 2026, oral arguments October 2026, decision spring 2027. Subscribe to SCOTUSblog, Bloomberg Law, or set up Google Alerts for "Salazar v. Paramount Global."
Conclusion: Salazar Is a Turning Point
The Salazar decision will either constrain or expand VPPA dramatically. Either way, it's a turning point.
For companies with embedded video, pixel tracking, and data-sharing arrangements, the next 12 months are a critical window to: (1) understand your exposure, (2) implement defensible consent mechanisms, (3) prepare for either outcome, and (4) monitor the Supreme Court case as it develops.
The time to act is now—before the decision lands and forces reactive changes.
The infrastructure answer
The free PieEye compliance scan identifies whether your website has the VPPA vulnerabilities that plaintiffs' attorneys look for — tracking pixels firing on video pages without consent, data flowing to third parties before users have agreed, and policy-to-practice mismatches.
For the complete VPPA compliance framework — audit, consent mechanisms, and implementation roadmap — see our VPPA compliance guide.
Run a free PieEye compliance scan — it takes minutes, requires no code changes to initiate, and tells you exactly what a plaintiffs' attorney's scanning tool would find if it looked at your website today.