Why the Supreme Court’s VPPA Non-Decision Will Cost Your Company Money…
The Supreme Court had a chance to settle one of digital privacy’s most confusing battlegrounds. Instead, they walked away, leaving companies navigating a 1988 video rental law that’s now being weaponized against modern streaming platforms, sports leagues, and anyone embedding a tracking pixel near video content.
The Court declined to hear appeals in December of 2025 from both the National Basketball Association and TrillerTV, effectively preserving contradictory circuit court rulings about the Video Privacy Protection Act. The result? Legal chaos that will cost businesses millions while plaintiffs’ attorneys race to file hundreds more cases under a statute written when Blockbuster was cutting-edge technology.
Two Cases, Two Opposite Outcomes, Zero Clarity
The Supreme Court’s non-decision leaves a bizarre split between two panels of the same circuit court—the Second Circuit—reaching completely opposite conclusions about nearly identical conduct.
In one corner sits the NBA case, where Circuit Judge Beth Robinson ruled expansively, declaring that Congress didn’t intend for the VPPA “to gather dust next to our VHS tapes.” The court held that Michael Salazar qualified as a “consumer” under the law simply by subscribing to the NBA’s free newsletter, and that sharing his video-viewing data with Meta via tracking pixels violated his privacy rights.
In the other corner is TrillerTV, where a different Second Circuit panel dismissed similar claims from Detrina Solomon. The court ruled that the data transmitted to Meta—Facebook IDs paired with video URLs—didn’t constitute “personally identifiable information” because an “ordinary person” couldn’t use that information to identify someone’s viewing history.
Same circuit. Same tracking technology. Same third-party recipient. Opposite results.
The NBA urged the Supreme Court to intervene, arguing the circuit split “strikes at the core of the targeted advertising model.” TrillerTV countered that the issue has “limited and diminishing significance” because companies are now implementing consent forms in response to litigation. The Court apparently found neither argument compelling enough to take the cases.
The VPPA Lawsuit Gold Rush: When a 1988 Video Rental Law Becomes a Litigation Machine
To understand why the Supreme Court’s punt matters, you need to grasp what’s happening in federal courts nationwide: an unprecedented wave of Video Privacy Protection Act lawsuits that turns everyday website analytics into potential $2,500-per-user violations.
The VPPA emerged from one of Washington’s more embarrassing privacy invasions. When Judge Robert Bork was nominated to the Supreme Court in 1987, a reporter obtained his video rental history from a local store and published it in a newspaper. The titles weren’t scandalous—mostly Hitchcock thrillers and family films—but the ease of accessing this information alarmed Congress enough to pass legislation prohibiting video service providers from disclosing customers’ viewing histories without consent.
Fast forward 37 years, and plaintiffs’ attorneys have transformed this analog-era statute into a digital litigation weapon. The law prohibits “video tape service providers” from knowingly disclosing a “consumer’s” “personally identifiable information” related to video viewing. Those vague terms, written for a world of VHS cassettes, are now being stretched to cover streaming platforms, news websites, sports apps, and anyone using Meta Pixel or similar tracking technology.
The numbers tell the story. After relatively few cases for decades, VPPA litigation exploded:
- Approximately 200 cases filed annually in recent years
- At least 28 new cases filed in just the first quarter of 2025
- $45.89 million in settlements from just six major cases in 2024 alone
- Tracking technologies used by 47% of all websites now in litigation crosshairs
The financial stakes are extraordinary. The VPPA provides statutory damages of $2,500 per violation without requiring plaintiffs to prove actual harm. For a streaming platform with millions of users, a single class action could theoretically generate billions in exposure.
The Tracking Pixel Problem: Routine Analytics or Privacy Violations?
At the heart of most VPPA cases sits a small piece of code that’s become ubiquitous across the internet: the Meta Pixel. This tracking tool, used by an estimated 47% of websites (including 55% of S&P 500 companies, 58% of retail sites, 42% of financial institutions, and 33% of healthcare providers), sends information to Meta about user behavior.
When configured on video-hosting websites, the Pixel can transmit details about which videos users watch, combined with identifiers like Facebook user IDs or hashed email addresses. This data enables targeted advertising—allowing companies to understand campaign effectiveness and deliver more relevant ads to users.
Plaintiffs argue this practice violates the VPPA because it “knowingly discloses” their viewing history to a third party (Meta) without proper consent. Defense attorneys counter that users consent when they agree to privacy policies and that the information transmitted doesn’t rise to the level of “personally identifiable” under the statute.
The result is a litigation tsunami hitting companies across industries:
Sports Organizations: The NBA, NFL, and others face claims about sharing video highlights and game clips viewed by newsletter subscribers.
Streaming Platforms: TrillerTV, Paramount, Hulu, and numerous others defend against allegations about their core business practices.
Publishers and Media: Even satirical sites like The Onion are getting sued. In one notable May 2025 case, the plaintiff reportedly used ChatGPT to analyze The Onion’s developer tools and identify tracking technologies—demonstrating how AI is lowering barriers for plaintiffs to understand technical implementations.
Real Estate and PropTech: As we’ve covered previously, Zillow and Redfin face VPPA claims over video property tours, with plaintiffs alleging that data about which homes users view gets shared with multiple advertising platforms.
The Circuit Split That’s Tearing the Law Apart
While the Supreme Court declined these specific cases, the underlying circuit split continues to deepen, creating impossible compliance challenges for national companies.
The Second Circuit’s Jekyll and Hyde Act: Following the NBA decision favoring plaintiffs, the same circuit then ruled for defendants in both Solomon v. Flipps Media and Hughes v. NFL, adopting the “ordinary person” standard that significantly limits what constitutes “personally identifiable information.” The court stated its Solomon decision “effectively shut the door for Pixel-based VPPA claims” in that circuit—except the earlier NBA ruling already opened it.
The Sixth Circuit Narrows “Consumer” Definition: In Salazar v. Paramount (yes, the same plaintiff from the NBA case), the Sixth Circuit ruled 2-1 that newsletter subscribers aren’t “consumers” under the VPPA unless they subscribe to goods or services “akin to audio-visual material.” This directly contradicts the Second Circuit’s NBA ruling involving the same plaintiff.
The Seventh Circuit Expands Liability: In Gardner v. Me-TV, the court held that users who created free accounts to access personalized video features qualified as “subscribers,” reasoning that “data can be worth more than money” in the digital economy. This broad interpretation pulls even more companies into the VPPA’s scope.
The Ninth Circuit Joins the “Ordinary Person” Camp: Like the Second and Third Circuits in some cases, the Ninth Circuit has adopted standards requiring that disclosed information would allow an ordinary person—not just sophisticated data analysts—to identify viewing histories.
For companies operating nationally, these conflicts are untenable. A website’s tracking practices might violate the VPPA under Second Circuit precedent in New York while complying with Sixth Circuit standards in Ohio. The same plaintiff can file multiple lawsuits against the same company based on identical facts, hoping different circuits will reach different conclusions.
The Consent Band-Aid: Why Companies Are Racing to Add Disclosure Forms
In its brief opposing Supreme Court review, TrillerTV argued that the VPPA issue may “soon moot” because companies are implementing consent forms in response to litigation. This raises a critical question: can proper consent actually solve the problem? If you’re using Captain Compliance then the answer is yes you can be protected against these claims. If not then the answer gets to be a bit more complex.
The answer is complicated because the VPPA explicitly allows disclosure “to any person with the informed, written consent of the consumer.” But what constitutes “informed” consent in the context of complex tracking technologies?
Many companies are now:
- Adding explicit notices about video tracking in privacy policies
- Implementing consent banners specifically addressing video-related data sharing
- Providing opt-out mechanisms for tracking technologies
- Ensuring mobile app disclosures link to enhanced privacy information
- Documenting consent mechanisms to defend against future litigation
Yet consent isn’t a panacea. Courts are scrutinizing whether buried privacy policy language constitutes meaningful “informed” consent, especially when many users don’t read policies or understand technical implementations. Some plaintiffs argue that even with consent, the breadth of data sharing exceeds what users reasonably expect.
Moreover, the VPPA’s two-year statute of limitations means companies face exposure for past conduct even after implementing new consent mechanisms. The litigation wave isn’t stopping just because companies are improving practices prospectively.
Mass Arbitration: The Nuclear Option Plaintiffs Are Deploying
As if class action lawsuits weren’t enough, companies face another threat: mass arbitration campaigns. Plaintiffs’ firms have identified VPPA violations as perfect candidates for the mass arbitration strategy that’s proven devastatingly expensive in other contexts.
Here’s how it works: Many companies include arbitration clauses in their terms of service, requiring individual arbitration rather than class action lawsuits. Plaintiffs respond by recruiting thousands of users to file individual arbitration demands simultaneously—forcing companies to pay filing fees and legal costs for each separate proceeding.
For VPPA claims, this strategy is particularly attractive:
- The $2,500 statutory damages make individual claims economically viable
- No need to prove actual harm or damages
- Companies can’t consolidate claims due to their own arbitration agreements
- Mass filing creates enormous administrative and financial pressure to settle
Several websites are actively recruiting claimants for VPPA mass arbitrations, promising users a share of potential $2,500 recoveries. The American Arbitration Association’s 2024 mass arbitration rules provide some defendant protections, including “process arbitrators” for administrative management and more predictable fee structures, but companies still face substantial costs defending hundreds or thousands of simultaneous proceedings.
What Companies Can Do Right Now
While waiting for Supreme Court clarity that may never arrive, companies hosting video content can take concrete steps to reduce VPPA exposure:
Audit Your Tracking Technologies: Document exactly what tracking tools operate on video-hosting pages. Understand what data each tool collects, where it’s transmitted, and how it’s configured. If you can’t explain your tracking ecosystem in detail, you can’t defend it effectively.
Implement Robust Consent Mechanisms: Generic privacy policies aren’t enough. Provide specific, prominent notice about video-related tracking, explain what data gets shared with third parties, and offer genuine opt-out capabilities. Consider requiring affirmative consent before tracking activates.
Evaluate Your Business Model: Determine whether you actually qualify as a “video tape service provider” under the statute. If video content is incidental to your core business rather than central to it, document this fact and consider whether removal arguments might succeed in litigation.
Review Third-Party Vendor Contracts: Ensure your contracts with analytics providers and advertising platforms allocate risk appropriately. Many companies discover during litigation that their vendor agreements provide inadequate indemnification or data protection commitments.
Consider Geographic Restrictions: Some companies are implementing different tracking practices in different circuits based on prevailing case law. While complicated, this approach recognizes that VPPA interpretation varies dramatically by jurisdiction.
Prepare Arbitration Agreements for Mass Claims: If you use arbitration clauses, implement provisions addressing mass arbitration scenarios. Consider caps on simultaneous filings, bellwether procedures, or other mechanisms the 2024 AAA rules now accommodate.
Monitor Developments Closely: VPPA law evolves rapidly. Salazar alone has multiple pending appeals in different circuits. Companies need real-time monitoring of new rulings, settlements, and enforcement trends.
Assess Your Actual Risk: Not every company faces meaningful VPPA exposure. Consider your user base size, the prominence of video content on your platform, your tracking practices, and whether you’ve already been targeted. Risk-based compliance is more sustainable than panic-driven overreaction.
Privacy Law Without Needing Privacy Regulators
The VPPA litigation explosion illustrates a broader problem in American privacy law: we’re relying on 1980s statutes and plaintiff attorneys to regulate 2020s technology. The result is inconsistent, unpredictable, and often disconnected from actual privacy harms.
Unlike comprehensive privacy regimes in Europe or even California’s CCPA/CPRA framework, the VPPA provides no regulatory oversight, no opportunity for prospective guidance, no administrative enforcement with measured penalties. Instead, we get:
- Statutory damages without proof of harm
- Inconsistent circuit court interpretations of ambiguous language
- Plaintiffs’ firms driving enforcement priorities based on litigation economics
- Companies making compliance decisions in a legal vacuum
The Supreme Court’s decision to stay out of these cases means this system continues indefinitely. Companies will spend millions defending practices that might be perfectly legal in one circuit and catastrophically expensive in another. Plaintiffs will continue filing cases until every circuit weighs in, then appeal any unfavorable decisions hoping the Court eventually intervenes.
Meanwhile, actual privacy concerns—like sophisticated data broker networks, AI-powered surveillance, or cross-device tracking—receive far less litigation attention because they don’t fit into existing statutory frameworks with easy damages formulas.
What Happens Next
The VPPA litigation machine isn’t slowing down. With the Supreme Court declining intervention, expect:
More Aggressive Plaintiffs’ Tactics: The Court’s silence signals that VPPA claims aren’t going away. Plaintiffs’ firms will expand their targets, refine their allegations, and push creative theories about what constitutes violations.
Continued Circuit Splits: Other circuits will issue their own VPPA interpretations, potentially creating even more conflicts that may eventually force Supreme Court review. The Salazar v. Paramount petition is still pending, and new cases are percolating up through other circuits.
Settlement Pressure: Defendants know that even if they ultimately prevail, litigation costs are substantial and outcomes uncertain. Expect continued multi-million dollar settlements as companies decide paying plaintiffs is cheaper than prolonged legal battles.
Legislative Attention—Maybe: Some industry groups advocate for VPPA amendments to clarify its application to modern technologies. But given Congress’s general inability to pass comprehensive privacy legislation, statutory fixes seem unlikely in the near term.
Self-Regulation Acceleration: As with the Zillow DAAP case we covered, industry self-regulatory bodies may step up oversight to help companies navigate these requirements without litigation. But unlike comprehensive privacy frameworks, self-regulation can’t provide safe harbors from statutory liability.
The Bottom Line: The Supreme Court just told companies they’re on their own navigating a 37-year-old video rental law that’s generating hundreds of lawsuits and tens of millions in settlements annually. Without clear guidance from the nation’s highest court, businesses must assume maximum risk, implement comprehensive protections, and hope their circuit’s interpretation favors defendants. You are not on your own however if you’re using Captain Compliance’s VPPA software tools to protect against litigation.
For companies hosting any video content—whether core to their business or incidental—you need to understand that the VPPA isn’t going away, courts are deeply divided on how to interpret it, and every user who watches a video while you’re running tracking pixels is a potential $2,500 lawsuit waiting to happen.
