The U.S. Supreme Court is facing increasing pressure to weigh in on one of the most consequential privacy debates of the digital era. At the heart of the matter is the Video Privacy Protection Act (VPPA) a 1988 statute born from analog concerns over video rental records that has been repurposed by privacy litigants to challenge contemporary online tracking practices.
A coalition of industry groups, including the Interactive Advertising Bureau (IAB) and the National Retail Federation (NRF), has formally petitioned the Court to resolve a deepening judicial split over what qualifies as a “consumer” and what constitutes “personally identifiable information” under the VPPA. Their argument is clear: the Second Circuit’s expansive interpretation of the law threatens to upend digital marketing, content delivery, and data analytics operations across the internet. If you’re a client of Captain Compliance then you already know that litigation is crazy with these video players on a website and the solution of using our privacy software resolves this but if you don’t use it then you’re at risk.
The stakes are high not only for digital advertisers and publishers, but also for the future boundaries of federal privacy litigation as anybody with a video on their website without proper disclosures is at a high risk with the current way the VPPA was written.
A Law Written For The 1980’s – The VPPA’s Origins and Its Legal Stretch Today
Enacted in response to the unauthorized disclosure of Supreme Court nominee Robert Bork’s video rental history in the 1980s, the VPPA was designed to prevent the public dissemination of an individual’s video viewing habits. At the time, the law was narrow in scope and specific to physical video rental records.
Today, however, plaintiffs have seized on its vague statutory language to challenge everything from tracking pixels and analytics cookies to session replay scripts and video-based newsletters. Central to these lawsuits is the claim that sharing video viewing behavior with third parties like Meta or Google without proper disclosure or consent violates the VPPA.
The Salazar v. NBA Decision: A Modern Flashpoint
The Second Circuit’s decision in Salazar v. National Basketball Association triggered a seismic shift in VPPA litigation. In that case, the plaintiff alleged that the NBA violated the VPPA by sharing viewing data from email-linked videos via embedded third-party trackers. Although Salazar never formally “rented” or “purchased” a video, the court found that his provision of personal data in exchange for newsletter access and embedded video links was sufficient to render him a “consumer” under the statute.
The Court’s opinion expanded the scope of the VPPA to include:
- Embedded video content in marketing emails
- Viewing data captured by tracking technologies
- Circumstances where access was free, but still transactional in nature (via data exchange)
This broad definition alarmed industry groups, who contend that the VPPA is now being weaponized to police standard digital marketing practices many of which operate under long-standing, industry-accepted norms for implied consent or data aggregation.
A Fractured Legal Landscape: The Circuit Split
The urgency for Supreme Court review stems in part from a growing circuit split on the VPPA’s scope:
- Second Circuit (Salazar v. NBA): Found newsletter subscribers qualified as consumers under the VPPA.
- Sixth Circuit (In re: Paramount Global): Declined to extend “consumer” status to passive website users who had not affirmatively transacted for video services.
This split has created legal uncertainty for nationwide companies, which must navigate divergent interpretations of the same statute depending on jurisdiction. The IAB and NRF argue that this inconsistency imposes intolerable compliance burdens and chills otherwise lawful online innovation.
The Legal Schism Over VPPA
| Legal Issue | Second Circuit (Salazar) | Sixth Circuit (Paramount) |
|---|---|---|
| Definition of ‘Consumer’ | Broad—includes newsletter recipients with video links | Narrow—excludes users who didn’t subscribe or purchase |
| PII via Third-Party Tracking | Tracking pixels that collect viewing behavior = PII | Viewed skeptically—context matters |
| Relevance to Modern Ad Tech | High exposure for embedded video + pixel setups | Limited exposure if no active transaction occurred |
| Industry Impact | Expansive litigation risk | Greater legal certainty for routine practices |
Industry’s Petition: Why the Supreme Court Should Intervene
In their joint amicus brief, the IAB and NRF stress that while the intent of the VPPA was to protect privacy, its modern application is incompatible with how internet ecosystems operate today. Their key arguments include:
- Retroactive Application of Law: The VPPA wasn’t written with real-time data collection or video auto-play in mind. Applying it to pixels and behavioral analytics is akin to regulating jet engines under horse-and-buggy laws.
- Harm to First Amendment and Commercial Speech: Digital content delivery systems rely on personalized recommendations and targeting. Plaintiffs’ theories could suppress innovation and commercial speech without showing material consumer harm.
- Regulatory Overlap: With new state privacy laws (e.g., CPRA, VCDPA) and federal proposals, the VPPA’s role is redundant and creates confusion.
Their request: for the Supreme Court to establish a limiting principle—either clarifying who is a VPPA “consumer” or redefining what counts as “personally identifiable information” in the age of anonymized tracking.
Broader Implications for Privacy Litigation
This is not merely a case about videos or basketball newsletters. At its core, the legal controversy reflects a broader conflict between:
- Legacy privacy statutes designed for a pre-internet era, and
- Contemporary data ecosystems where consent, personalization, and platform interoperability are deeply intertwined.
The outcome could determine whether other pre-digital statutes, like the Wiretap Act or CIPA, will be reimagined by plaintiffs to apply to modern adtech infrastructures.
At a Crossroads of Privacy, Statutory Interpretation, and Technology
The Supreme Court has not yet granted certiorari in Salazar v. NBA, but mounting pressure from both industry and privacy advocates suggests that resolution is needed. If the Court declines to step in, companies could face a patchwork of conflicting interpretations, chilling the free flow of content and undermining long-standing internet business models.
Regardless of the outcome, one truth remains: the VPPA, like many legacy privacy laws, is being tested under conditions its drafters could never have envisioned. Whether SCOTUS will rewrite the rules—or defer to Congress to modernize them—may determine the next decade of digital privacy law.
