US
Video Privacy Protection Act (VPPA)
Overview
The Video Privacy Protection Act (VPPA) is a United States federal privacy law that protects individuals from the unauthorized disclosure of information about the videos they watch or request.
The law was enacted in 1988 and is codified in 18 U.S.C. §2710.
VPPA was introduced after concerns that video rental records could reveal sensitive personal information about individuals. The law prohibits video service providers from knowingly disclosing personally identifiable information about consumers without consent from the consumer, unless exceptions apply.
Originally designed to regulate video rental stores, the law is now frequently applied to modern digital services, including websites and streaming platforms that provide video content.
Today, VPPA claims often involve technologies that share information about video viewing activity with third‑party services such as advertising platforms or analytics providers.
Examples include:
- Video streaming platforms
- Embedded video players
- Video analytics tools
- Advertising pixels connected to video content
When these tools disclose information about a person's video viewing behavior without consent, businesses may face claims under the VPPA.
Regulation Summary
- 1988: The United States Congress enacts the Video Privacy Protection Act.
- 1988–2000s: The law primarily applies to video rental stores and similar services.
- 2010s: Courts begin applying the VPPA to online video services and streaming platforms.
- 2012: The VPPA is amended to allow electronic consent and advance consent for disclosures, including through online interfaces.
- 2020–Present: An increase in lawsuits targets websites that embed video players and transmit viewing data to advertising or analytics providers.
- Many of these claims involve the disclosure of viewing activity through third‑party technologies such as tracking pixels.
VPPA may apply to businesses that provide video content to users in the United States.
This includes companies operating:
- Video streaming platforms
- Media websites with video content
- Online education platforms
- News and entertainment websites
- Mobile applications offering video services
Businesses may be affected when they use technologies that share information about users and the videos they watch.
Examples include:
- Advertising pixels connected to video players
- Video analytics tools
- Marketing or tracking technologies integrated with video platforms
If these technologies transmit viewing data that identifies a user and the video they watched, the disclosure may fall within the scope of the VPPA.
The VPPA includes several exceptions that allow certain disclosures of information.
Examples include disclosures:
- With the informed written or electronic consent of the consumer
- In the ordinary course of business, such as order processing
- Pursuant to a court order
- To law enforcement under specific conditions
Consent may be obtained in advance for a defined period of time, and consumers must be able to withdraw consent.
However, disclosures to advertising or analytics providers generally require consumer consent.
Businesses that provide video content should review their practices under the VPPA.
Key concepts include:
- Video Tape Service Provider (VTSP): A business engaged in delivering prerecorded video content or similar audiovisual materials to consumers.
- Personally Identifiable Information (PII): Includes information that identifies a person as having requested or obtained specific video materials or services.
Under the law, video service providers should consider the following actions:
- Avoid disclosing viewing data linked to identifiable users
- Obtain consumer consent (including through electronic or online mechanisms) before sharing video viewing information
- Review third‑party technologies integrated with video players
- Maintain transparency regarding how viewing data is used or shared
Website owners that publish video content should review technologies embedded on pages containing video players.
Technologies commonly involved in VPPA claims include:
- Advertising pixels integrated with video players
- Video analytics and engagement tools
- Marketing and tracking scripts connected to video pages
- Embedded third‑party video platforms
These technologies may transmit data that identifies the user and the video they watch.
To address these risks, website operators often implement mechanisms that:
- Inform users when video viewing data may be shared
- Request consent before activating tracking technologies
- Prevent tracking pixels from loading until consent is provided
- Provide transparency in privacy disclosures
Businesses should review transparency practices related to video viewing data.
This may include:
- Providing disclosures within privacy policies
- Explaining how video viewing data may be shared
- Identifying third‑party technologies integrated with video players
- Maintaining records of consumer consent where required
- Under the Video Privacy Protection Act, individuals have the right to pursue legal remedies when their video viewing information is disclosed without authorization.
- Consumers may bring civil actions against video service providers that violate the statute.
- Many recent claims involve allegations that websites disclosed viewing information to third‑party services without consent.
- Individuals bringing claims may seek statutory damages and other remedies provided under the law.
The VPPA is primarily enforced through civil litigation.
Individuals whose video viewing information has been disclosed without authorization may bring private lawsuits.
Under 18 U.S.C. §2710(c), individuals may seek:
- Statutory damages of at least $2,500 per violation
- Punitive damages where appropriate
- Reasonable attorney's fees and litigation costs
Because websites may transmit data for large numbers of users, potential exposure can increase quickly when viewing data is shared without consent.