By Steve Levine · Updated June 1, 2026 · 7 min read
Quick Answer
The Video Privacy Protection Act (VPPA), 18 U.S.C. § 2710, is a 1988 federal law that bars a “video tape service provider” from knowingly disclosing a consumer’s personally identifiable information — including the specific videos they requested or obtained, tied to information that identifies that person — to a third party without informed, written consent. It gives consumers a private right of action with liquidated damages of $2,500 per violation, plus attorney’s fees, and it is the engine behind a large wave of class actions against websites and apps that allegedly shared users’ video-viewing data with Meta and other ad/analytics partners through tracking tools like the Meta Pixel.
What the VPPA Is and Why It Exists
The Video Privacy Protection Act is one of the oldest federal digital-privacy statutes still in heavy use. Congress passed it in 1988 after a newspaper obtained and published the video-rental history of Supreme Court nominee Robert Bork during his confirmation fight. The disclosure caused a bipartisan uproar, and the resulting law — sometimes nicknamed the “Bork bill” — reflects a simple judgment: what you choose to watch is sensitive, and it should not be handed to third parties without your say-so.The statute was written in the era of video-cassette rental stores, but its language (“similar audio visual materials”) has let courts apply it to modern streaming services, apps, and websites that deliver video. That is why a 37-year-old law now drives some of the most active privacy litigation on the internet.
What the Law Actually Prohibits
At its core, the VPPA forbids a covered provider from knowingly disclosing a consumer’s video-viewing information to a third party without consent. Breaking the rule down into its working parts:- A video tape service provider. A person or business engaged in the rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials — read by many courts to include online and streaming video.
- A consumer. A renter, purchaser, or subscriber of the provider’s goods or services (see the next section — this is the most-litigated element).
- A knowing disclosure to a third party. The provider must have knowingly shared the information; an accidental or unknowing transmission is harder to pin down.
- Personally identifiable information. What was shared has to identify a specific person as having watched or requested specific video content.
- Without valid consent. Consent has to meet the statute’s specific form requirements; a buried line in a general privacy policy usually does not count.
Who Is a “Consumer” or “Subscriber”
The statute protects a “consumer,” defined as any renter, purchaser, or subscriber of goods or services from a video tape service provider. In the streaming era, the fight is almost always about the word subscriber: does signing up for a free account, a mobile app, or an email newsletter from a company that also offers video make you a subscriber of its video service?Courts have split on this. Some have read “subscriber” broadly — for example, treating a free newsletter sign-up as enough to make someone a consumer — while others require a tighter link to the audiovisual goods or services themselves. The outcome can hinge on the specific facts (what the person signed up for, what they got in return, and whether video was part of the relationship) and on which circuit’s law applies. Because there is no single nationwide answer, this element is where many VPPA cases are won or lost.
What Counts as Personally Identifiable Information
The VPPA defines personally identifiable information (PII) as information that identifies a person as having requested or obtained specific video materials or services. The modern question is whether a digital identifier — such as a Facebook account ID transmitted alongside the title of a video — is enough to identify a real person.Courts have taken different approaches. A common test asks whether the disclosed data would let an “ordinary person” identify the individual and what they watched; under that view, a bare, anonymized device identifier may not qualify. Other courts focus on whether the recipient (like a large advertising platform) can readily tie the identifier back to a named human being. Whether a Facebook ID plus a video title is “PII” is a recurring, unsettled battleground in the current wave of cases.
The Meta Pixel Wave — How Modern VPPA Cases Work
Most VPPA cases filed today involve the Meta Pixel (or similar third-party tracking tags). The Pixel is a small piece of code a website embeds. On a page that hosts video, the Pixel can fire when a visitor plays or views content and transmit data about what was watched — often together with an identifier linked to the visitor’s Facebook account — back to Meta, which uses it for ad targeting and analytics.Plaintiffs allege that media outlets, sports leagues and teams, streaming platforms, and retailers with video on their sites disclosed viewing data this way without the consent the VPPA requires. These cases rise or fall on the same elements above: was the visitor a “consumer/subscriber,” was the transmitted data “PII,” and was the disclosure “knowing.” This is closely related to the broader Meta Pixel website-tracking class actions brought under state wiretap laws — the VPPA simply adds a video-specific theory with its own $2,500 statutory damages.
As always: being named in a complaint is not a finding of wrongdoing. At the pleading stage there is no settlement and no claim form — allegations must be proven, a class must be certified, and any recovery is typically years away if a case advances at all.
Damages, Consent, and Your Rights
The VPPA provides a private right of action, and a prevailing plaintiff may recover liquidated (statutory) damages of $2,500 per violation, punitive damages, reasonable attorney’s fees and costs, and equitable relief such as an injunction. Statutory damages matter because they set a floor — a plaintiff generally does not have to prove a specific dollar loss to recover the fixed amount. These are amounts a court may award if a violation is proven; they are not guaranteed and not money that exists simply because a case was filed.On consent, the statute is strict. A valid VPPA consent generally must be given in a form distinct and separate from any other legal or financial terms, and a 2012 amendment lets providers obtain consent electronically and in advance for a defined period. A single sentence buried in a general privacy policy usually does not satisfy these requirements — which is exactly what many of the current lawsuits are about.
Frequently Asked Questions
What is the Video Privacy Protection Act?
The Video Privacy Protection Act (VPPA), 18 U.S.C. § 2710, is a 1988 federal law that prohibits a video tape service provider from knowingly disclosing personally identifiable information about a consumer — including the specific videos the consumer requested or obtained — without the consumer's informed, written consent. It gives consumers a private right of action and sets liquidated damages of $2,500 per violation.
Why was the VPPA passed?
Congress passed the VPPA in 1988 after a newspaper obtained and published the video rental history of Supreme Court nominee Robert Bork during his confirmation hearings. The episode is why the statute is sometimes called the "Bork bill." Lawmakers decided that what people watch is sensitive personal information that deserves federal protection from disclosure.
Who can sue under the VPPA?
A "consumer," which the statute defines as any renter, purchaser, or subscriber of goods or services from a video tape service provider. A major fight in modern cases is whether someone who signed up for a free account, app, or newsletter — but did not pay specifically for video — counts as a "subscriber." Courts have split, and the answer often depends on the facts and the circuit.
How much can you recover under the VPPA?
The VPPA sets liquidated (statutory) damages of $2,500 per violation, and also allows for punitive damages, reasonable attorney's fees and costs, and equitable relief such as an injunction. Statutory damages mean a plaintiff who proves a violation does not have to show a specific dollar loss to recover the fixed amount. These are amounts a court may award if liability is established, not a guaranteed payout.
What is the Meta Pixel and how does it relate to the VPPA?
The Meta Pixel is a snippet of tracking code that many websites embed. On a site with video content, the Pixel can transmit what a visitor watched along with an identifier tied to that visitor's Facebook account to Meta for advertising and analytics. A large wave of VPPA class actions alleges that media, sports, streaming, and retail sites disclosed video-viewing data this way without proper consent. The cases turn on whether the visitor was a "consumer," whether the transmitted data was "personally identifiable information," and whether the disclosure was "knowing."
Does watching free videos on a website make me a subscriber under the VPPA?
Not automatically. Courts disagree on this point. Some have held that signing up for a free newsletter or account from a company that also provides video can make a person a "subscriber," while others require a closer tie to the audiovisual goods or services themselves. Because there is a split among courts, whether a particular free user qualifies is one of the most heavily litigated questions in current VPPA cases.
