CIPA & Wiretap Litigation

What is VPPA (Video Privacy Protection Act)?

The Video Privacy Protection Act (VPPA) is a 1988 federal law, 18 U.S.C. section 2710, that prohibits video tape service providers from disclosing personally identifiable information about a consumer's video viewing without consent — now applied to websites that share video-watching data with advertising pixels.

Congress passed the VPPA after a newspaper obtained and published Supreme Court nominee Robert Bork's video rental history. The statute bars a 'video tape service provider' from knowingly disclosing personally identifiable information that links a consumer to specific video materials they requested or obtained, and it gives consumers a private right of action with liquidated damages of $2,500 per violation, plus punitive damages and attorney's fees.

Courts have read 'video tape service provider' to cover modern businesses engaged in delivering video content — streaming services, and in many cases websites and apps that host video. The modern litigation wave targets a specific fact pattern: a site embeds the Meta Pixel (or a similar tracker) on pages where users watch video, and the pixel transmits both the video title and an identifier (like the Facebook ID cookie) to the ad platform. Plaintiffs allege that transmission is a disclosure of the user's video viewing to a third party without valid consent.

VPPA consent is demanding: it must be obtained in a form 'distinct and separate' from other legal or financial notices, and it can be given in advance for a period of up to two years. A generic cookie banner or privacy-policy acceptance does not satisfy it. Courts differ on threshold questions — who counts as a 'consumer' (some decisions require a subscription or similar relationship) and what counts as PII — so outcomes vary by circuit.

Because damages are per person and video pages draw large audiences, class exposure escalates fast. The practical mitigations are to keep advertising pixels off video pages, strip video titles from event payloads, or obtain VPPA-grade standalone consent before any video-linked data flows to third parties.

Why it matters for eCommerce

eCommerce brands increasingly publish video — product demos, tutorials, shoppable video — and many fire the Meta Pixel sitewide, including on those pages. If the pixel sends the video title alongside a user identifier, the brand can face VPPA class claims at $2,500 per class member. Audit which events fire on video pages and what their payloads contain.

Frequently asked questions

What are the penalties under the VPPA?
The statute provides liquidated damages of $2,500 per violation through a private right of action, and courts may award punitive damages and attorney's fees. Aggregated across a class of video viewers, settlements regularly reach seven and eight figures.
Does the VPPA apply to websites that are not streaming services?
Often, yes. Courts have applied it to news sites, sports sites, and brand websites that deliver video content, though decisions differ on whether the plaintiff must be a 'subscriber' rather than a casual visitor. The safest assumption is that pages delivering video are in scope.

Related terms

Wondering how this applies to your own site? Get a free compliance scan — see every tracker that fires before consent, graded against CIPA, GDPR, CCPA/CPRA, and MHMD.

Scan your site's pixel behavior

← Back to all glossary terms