Online Video and the VPPA

The federal Video Privacy Protection Act (VPPA) bars a business that provides video from sharing information that identifies what a person watched, unless the person gives a separate, time-limited, revocable consent. Each violation carries at least $2,500 in damages. This guide explains when a website is covered and how to manage analytics tags on video pages.

What the law requires

The VPPA applies to a video tape service provider, defined as a business engaged in the rental, sale, or delivery of prerecorded video cassette tapes or similar audiovisual materials (18 U.S.C. 2710(a)(4)). A provider that knowingly discloses personally identifiable information about a consumer, including the specific video materials the consumer requested or obtained, is liable to that consumer (§2710(b)(1)). A court may award actual damages but not less than $2,500 in liquidated damages, plus punitive damages and attorney's fees (§2710(c)(2)). Because the $2,500 floor applies to each person, class claims over analytics tags can be large.

Recent cases turn on three questions: whether the website is in the business of delivering video, whether the plaintiff is a "consumer," meaning a renter, purchaser, or subscriber of the provider's goods or services, and whether the shared identifier actually identifies a person. Risk rises when an analytics or advertising tag sends a video title or viewing event together with a persistent account, device, or social media identifier.

The Supreme Court agreed on January 26, 2026 to decide the question in Salazar v. Paramount Global (No. 25-459) and set argument for October 14, 2026; no decision has issued.

Consent

A provider may disclose with the consumer's informed, written consent, which may be given electronically, if the consent is in a form distinct and separate from any other legal or financial obligation; is given either when the disclosure is sought or in advance for no more than two years or until withdrawn, whichever is sooner; and comes with a clear and conspicuous opportunity to withdraw (§2710(b)(2)(B)).

Related topics

• Pixels, Session Replay, and Chat: Consent Before Code
• Tracking Technologies, Advertising, and Personalized Pricing
• Tracker: Video Privacy Protection Act

Sources and legal update

• 18 U.S.C. 2710
• Salazar v. Paramount Global, No. 25-459 (U.S., cert. granted January 26, 2026)

Current through October 13, 2026.

This material is for general information and is not legal advice. Law and enforcement practice change. Consult counsel about specific facts.