Video Privacy Protection Act
Protect video-viewing data before a pixel turns it into a privacy claim.
Identify advertising pixels, analytics tools, embedded players, server-side events and other technologies that may disclose information about the videos people watch. Captain Compliance helps enforce consent, control data sharing, monitor changes and preserve defensible records.
Scan My WebsiteBook a VPPA Review
The VPPA provides a private right of action and liquidated damages of at least $2,500 under the statutory remedy provision, along with potential punitive damages, attorneys’ fees, costs and equitable relief.
A 1988 law with modern consequences
The VPPA did not disappear when video stores did.
Congress enacted the Video Privacy Protection Act in 1988 to protect identifiable video-rental and viewing records. Today, VPPA litigation frequently involves websites, streaming services, mobile applications, advertising pixels, embedded video players, analytics tools and other technologies capable of transmitting video-viewing information.
A website may create risk when a third-party technology receives information connecting an identifiable consumer with specific video materials or services.
// The analysis is highly fact-specific. Not every website containing video is automatically a video tape service provider, not every visitor is necessarily a protected consumer, and not every technical transmission establishes a violation.
What a claim examines
Four questions sit at the center of most VPPA reviews.
Video tape service provider
Is the organization engaged in the business of renting, selling or delivering prerecorded video or similar audiovisual materials?
Consumer
Is the individual a renter, purchaser or subscriber of goods or services from the video provider?
Personally identifiable information
Does the information identify a person as having requested or obtained specific video materials or services?
Knowing disclosure
Did the provider knowingly disclose the relevant information to another person without an applicable exception or valid consent?
// Courts have disagreed about how these definitions apply to newsletters, accounts, free videos, website identifiers and modern advertising technologies. This is an evolving area — no single circuit’s interpretation governs everywhere.
How technology creates exposure
The risk often exists in the data combination.
Individually, these data points may be unremarkable. Transmitted together to a third party, they can connect an identifiable person to specific video content.
Video information
Video titleVideo URLVideo identifierViewing eventPage categoryContent subject matter
Identity or device information
Account identifierEmail-derived identifierFacebook IDAdvertising identifierCookie identifierIP addressDevice identifier
Third-party technologies
Meta PixelGoogle advertising and analyticsTikTok PixelCustomer-data platformsEmbedded video playersMarketing automationServer-side APIsData-management platforms
// The presence of Meta Pixel, Google Analytics, an embedded video or any other vendor does not automatically violate the VPPA. Risk depends on the organization, user relationship, information transmitted, identifiability, consent, configuration and controlling law.
Consent under the VPPA
A generic “Accept Cookies” click may not satisfy the VPPA.
The statute’s consent exception refers to informed, written consent — including electronic consent — that:
- ·Is distinct and separate from other legal or financial obligations
- ·Can be given when the disclosure is sought
- ·Can be given in advance for no longer than two years or until withdrawn, whichever occurs first
- ·Provides a clear and conspicuous opportunity to withdraw
- ·Supports withdrawal on a case-by-case basis or from ongoing disclosures
How Captain Compliance supports an appropriately configured workflow
Video-specific consent languageTechnology-level blockingConsent before disclosureVersioned disclosuresTimestamped receiptsBanner and notice version recordsWithdrawal mechanismsPreference-center integrationGeographic configurationContinuous monitoring
// A standard CMP configuration does not automatically satisfy the VPPA. The appropriate configuration depends on your relationships, disclosures and controlling law.
Private litigation risk
The VPPA gives qualifying consumers a direct path to court.
Private right of action
An aggrieved person may bring a civil action under the statute.
Damages
The statutory remedy provision authorizes actual damages, but not less than liquidated damages of $2,500.
Additional relief
A court may award punitive damages, reasonable attorneys’ fees, litigation costs and appropriate preliminary or equitable relief.
// The availability and calculation of relief depend on the allegations, evidence, procedural posture, controlling precedent and outcome of the case. Statutory damages cannot be multiplied by traffic volume to estimate exposure.
Supreme Court watch
The definition of a VPPA “consumer” is before the Supreme Court.
In January 2026, the United States Supreme Court granted review in Salazar v. Paramount Global. The case concerns whether subscribing to a non-video offering, such as a newsletter, can make someone a VPPA “consumer” when the same business also provides video content. The outcome could materially affect website-based VPPA litigation involving newsletters, registrations, accounts and video content.
// The case is undecided. Nothing on this page should be read as predicting the outcome.
How Captain Compliance helps
Control the technology — not just the policy language.
Video-specific consent
Present distinct disclosures and consent choices for applicable video-data sharing.
Consent receipts
Preserve evidence of the visitor’s choice, applicable language, configuration, timestamp and withdrawal status.
Human-reviewed remediation
Captain Compliance specialists review findings and help prioritize technical and disclosure changes.
Who should review
VPPA exposure is not limited to streaming companies.
Streaming and media platformsPublishers and news organizationsSports and entertainment websitesRetailers with product or editorial videosHealth and fitness platformsEducational websitesMembership organizationsMobile applications with videoNewsletters or accounts alongside videoVideo personalization or advertising
// Not every business in these categories is automatically covered by the VPPA.
Risk-reduction workflow
From video inventory to defensible control.
Compliance Shield
VPPA protection backed by real support.
Qualifying Captain Compliance customers may receive additional protection through Compliance Shield when Captain Compliance technology is properly deployed and maintained under the applicable agreement.
Continuous monitoringApproved configurationsConsent recordsTechnical evidenceClaim-response supportHuman assistance
// Compliance Shield is subject to eligibility requirements, approved configurations, continued use and the terms, limitations and exclusions of the applicable written agreement. Coverage is not automatic and not every allegation qualifies.
Questions
The VPPA, answered plainly.
What is the VPPA?
The Video Privacy Protection Act is a 1988 federal statute restricting how a video tape service provider may knowingly disclose personally identifiable information connecting a consumer to specific video materials or services. It includes a private right of action.
Does the VPPA apply to websites?
It can. Modern VPPA litigation frequently involves websites, apps, advertising pixels, embedded players and analytics tools rather than physical rentals. Whether it applies to a particular website is fact-specific.
Does every website containing video fall under the VPPA?
No. Having video does not automatically make an organization a video tape service provider, and not every visitor is a protected consumer. The analysis depends on the business, the relationship with the individual and what was disclosed.
Who qualifies as a VPPA consumer?
The statute refers to a renter, purchaser or subscriber of goods or services from a video provider. Courts have disagreed about whether subscribing to something other than video — a newsletter, for example — is enough. That question is currently before the Supreme Court in Salazar v. Paramount Global.
What information can qualify as personally identifiable information?
Information that identifies a person as having requested or obtained specific video materials or services. In website cases this often involves a combination — a video title or URL transmitted alongside an account, cookie, device or advertising identifier. Courts have applied differing standards.
Can Meta Pixel create VPPA risk?
A pixel can be relevant where it transmits video-viewing information together with an identifier to a third party. The presence of Meta Pixel does not by itself establish a violation — configuration, consent, disclosure, identifiability and controlling law all matter.
Is a normal cookie banner sufficient?
Not necessarily. The VPPA’s consent exception describes informed, written consent that is distinct and separate from other obligations, with a clear opportunity to withdraw. A general “Accept Cookies” interaction may not meet that standard.
What type of consent does the VPPA describe?
Informed, written consent — which may be electronic — that is separate from other legal or financial obligations, may be obtained when the disclosure is sought or in advance for no more than two years or until withdrawn, and provides a clear and conspicuous means of withdrawal.
What damages are available?
The statutory remedy provision authorizes actual damages but not less than liquidated damages of $2,500, and a court may award punitive damages, reasonable attorneys’ fees, costs and equitable relief. What a court actually awards depends on the case.
What is Salazar v. Paramount Global?
A case in which the Supreme Court granted review in January 2026, concerning whether subscribing to a non-video offering makes someone a VPPA “consumer” where the business also provides video. Argument is scheduled for 14 October 2026 and the case is undecided.
How does Captain Compliance find video-tracking risks?
By scanning pages containing video and observing which pixels, scripts, embedded technologies and third-party requests fire, what they transmit and when relative to consent — then having specialists review the findings.
Can Captain Compliance block pixels on video pages?
Yes. Designated technologies can be prevented from loading or transmitting until the required consent condition is satisfied, based on your configuration.
How does Compliance Shield apply?
Qualifying customers with properly deployed and maintained technology may receive defined support under the applicable written agreement. Eligibility, obligations, limitations and exclusions are governed by that agreement.
Get started
Find out what your video pages are sending.
Scan your website for pixels, analytics tools, embedded technologies and data flows that may create VPPA exposure — and get a practical plan to control them.
Run My Free Privacy AuditTalk to a VPPA Specialist
Last legally reviewed: August 2026. Captain Compliance provides privacy technology, implementation and support. It does not provide legal advice. VPPA applicability, the meaning of “consumer” and “personally identifiable information,” and available remedies are actively litigated and vary by jurisdiction. Organizations should consult qualified counsel.