The Plain Language Problem
The VPPA defines "consumer" as "any renter, purchaser, or subscriber of goods or services from a video tape service provider."
This seemingly simple definition has become the central battleground in VPPA litigation.
The question: Does "consumer" mean anyone who subscribes to any goods or services from a company that also provides video? Or does it mean only those who specifically subscribed to audiovisual content?
The answer determines whether VPPA liability is narrow (affecting only video subscribers) or explosive (affecting everyone who interacts with a video company).
Grammatically, this could mean:
Reading 1 (Broad): Any [goods or services] from [video tape service provider]
- If you subscribe to ANY goods or services from a company that also provides video, you're a "consumer"
- Example: Subscribe to Paramount+ newsletter → you're a consumer → entitled to VPPA protection
Reading 2 (Narrow): Any [goods or services from video tape provider IN ITS CAPACITY AS A VIDEO PROVIDER]
- Only goods or services related to video are what make you a consumer
- Example: Subscribe to Paramount+ newsletter, but NOT specifically to watch video → you're NOT a consumer for VPPA purposes
The Circuit Split
Broad View (2nd & 7th Circuits):
- Any goods or services from a video provider = consumer status
- Salazar v. NBA (2d Cir. 2024): Any subscriber to any goods/services from video provider = consumer
- Gardner v. Me-TV (7th Cir. 2021): Even free users = consumers
Narrow View (6th & D.C. Circuits):
- Only video-specific subscribers = consumers
- Salazar v. Paramount (6th Cir. 2025): Newsletter subscriber to non-video content ≠ consumer
- Pileggi v. Washington Post (D.C. Cir. 2024): Article reader with embedded video ≠ consumer
What Each Outcome Means for Your Business
If Supreme Court Adopts Broad Reading:
- Every visitor to your website = VPPA consumer
- Every email subscriber = VPPA consumer
- Every customer = VPPA consumer
- Potential class: All your users
- Exposure: $10M-$250M+ for large companies
If Supreme Court Adopts Narrow Reading:
- Only users who specifically watched video = VPPA consumer
- Newsletter subscribers ≠ consumers
- Merchandise purchasers ≠ consumers
- Potential class: Video viewers only
- Exposure: $5M-$100M (smaller but still significant)
The infrastructure answer
The free PieEye compliance scan identifies whether your website has the VPPA vulnerabilities that plaintiffs' attorneys look for — tracking pixels firing on video pages without consent, data flowing to third parties before users have agreed, and policy-to-practice mismatches.
For the complete VPPA compliance framework, see our VPPA compliance guide. For the Supreme Court case that will clarify the "consumer" definition, see Salazar v. Paramount Global.
Run a free PieEye compliance scan — it takes minutes, requires no code changes to initiate, and tells you exactly what a plaintiffs' attorney's scanning tool would find if it looked at your website today.
How the Broad Reading Affects Your Shopify Store
If courts adopt the broad interpretation, your exposure expands dramatically because "consumer" status attaches the moment someone interacts with your brand—not just when they watch video.
For a Shopify store, this means:
- Email subscribers become VPPA consumers the moment they opt into your marketing list, even if your emails never mention video
- Product page visitors who see an embedded product demo video become consumers
- Cart abandoners who previously viewed any video content on your site remain consumers
- Social followers who click through from Instagram or TikTok (both video platforms) may trigger consumer status under the broad view
The practical danger: your email marketing tool (like Klaviyo) might be sharing subscriber data with Meta Pixel or Google Analytics without explicit VPPA consent. Under the broad reading, every subscriber is a "consumer," and sharing their behavior data without their agreement becomes a violation.
Even a simple YouTube embed on your homepage—showing a product unboxing or brand video—could classify your entire customer list as VPPA consumers. You'd then owe each of them statutory damages ($100–$150 per violation) if you later track their behavior without their prior written consent.
This is why the definition matters more than the compliance mechanics. A narrow ruling lets you segment your audience by actual video engagement. A broad ruling treats your entire database as protected.
What "Subscriber" Actually Means in eCommerce
The VPPA text uses "subscriber" but doesn't define it clearly for modern commerce. Courts are now split on whether this includes:
- Email list signups (most likely YES under broad view; likely NO under narrow view)
- SMS opt-ins (similarly unclear—depends on whether SMS counts as a "good or service")
- Account creation (registering for your Shopify store—is that a "subscription"?)
- Free trial users (the 7th Circuit says YES; the 6th Circuit leans NO)
- App installs (does downloading your mobile app make someone a subscriber?)
For eCommerce, this ambiguity is painful because you need to decide today how to handle consent—before the Supreme Court clarifies the rule.
Most compliance-first brands are now treating anyone in a trackable relationship (email, SMS, account, or logged-in session) as a potential VPPA consumer. This means:
- Implementing consent before firing Meta Pixel or Google Analytics for all users, not just video watchers
- Documenting which users have opted into tracking
- Disabling third-party cookies for anyone who hasn't given explicit consent
- Keeping audit trails showing when consent was obtained and for what purpose
The narrow reading would let you skip consent for most users. The broad reading requires consent infrastructure from day one. Until the Supreme Court rules, the safer path is to assume the broad reading applies to your business.
The Cookie Banner and VPPA Consent Problem
Your cookie banner solves GDPR and CCPA compliance, but it likely doesn't satisfy VPPA consent requirements—and that's a hidden liability.
Here's why: VPPA consent must be affirmative, prior, and written. That means:
- ✓ User actively clicks "Agree" before data collection starts
- ✓ Consent is obtained before tracking pixels fire (not after)
- ✓ Consent is documented in writing (a record you can prove in court)
Most cookie banners fail the VPPA test because they:
- Fire pixels before consent – Google Analytics and Meta Pixel load on page entry, before the user interacts with your cookie banner
- Don't separate video consent – Your banner asks for "analytics" but doesn't isolate VPPA-specific consent from other tracking
- Use pre-checked boxes – Passive consent ("analytics is on by default") doesn't meet the "affirmative" standard
- Don't date consent records – You can't prove when the user consented or what they consented to
For a Shopify store with embedded product videos, this is critical. If a user watches a 30-second demo video on your homepage and then your pixel fires to Facebook before they've clicked your cookie banner, you've technically violated the VPPA under the broad reading (since they're now a "consumer" and you collected their data without affirmative consent).
The fix isn't just adding a banner—it's restructuring how your pixels load. You need a consent management system that blocks third-party pixels entirely until consent is given, then documents that consent with a timestamp.
Regional Compliance Strategy: Different Rules for Different Courts
Until the Supreme Court rules, you're operating under four different standards depending on where your customers live and where plaintiffs might sue.
2nd & 7th Circuits (Broad View): Treat all users as VPPA consumers. Require affirmative consent before any tracking. Assume email subscribers are consumers.
6th & D.C. Circuits (Narrow View): Only users who engage with video content need VPPA-specific consent. General tracking of non-video users is lower risk.
For most DTC eCommerce brands, this means:
- You can't pick a single compliance posture and expect to be safe everywhere
- Your most conservative option is to follow the broad view nationally (assume all users are consumers)
- If you only ship to certain states or target specific regions, you could potentially risk-segment—but this creates operational complexity
- The cost of implementing broad-view compliance (consent before tracking) is usually lower than the cost of litigation
Many brands now treat VPPA the way they treat GDPR: a global standard applied to everyone, regardless of geography. It's simpler than maintaining regional consent rules, and it reduces litigation exposure.