If your platform hosts, streams, or embeds video content and collects data from users who watch it, the Video Privacy Protection Act is not an obscure historical statute you can ignore. It is a federal law with statutory damages of $2,500 per violation, a wave of active class action litigation, and a Supreme Court case in 2026 shaping what “consumer” even means under it. Streaming services, news sites with embedded video, fitness apps, and educational platforms have all faced VPPA claims, and many of them lost because their terms of service and privacy disclosures simply did not address what the law requires.
The VPPA was enacted in 1988 after a Washington newspaper published the video rental history of a Supreme Court nominee. Congress responded by making the disclosure of “personally identifiable information” tied to video content a federal cause of action. What courts have made clear over the last several years is that this law applies far beyond the Blockbuster era. If your platform has any video component, your legal exposure under the VPPA needs to be taken seriously before a plaintiff’s attorney finds it for you.
This article breaks down what the VPPA requires, who it applies to in 2026, what disclosures your terms of service and privacy policy must contain, and why getting this wrong is far more costly than getting it right with properly drafted agreements from the start.
1. What the VPPA Actually Covers: The Law’s Modern Reach
Under 18 U.S.C. § 2710, the VPPA prohibits any “video tape service provider” from knowingly disclosing “personally identifiable information” about a consumer to a third party. The term “video tape service provider” covers any person engaged in the business of providing prerecorded video cassette tapes or “similar audio visual materials.” Courts have consistently interpreted “similar audio visual materials” to include streaming video, on-demand video, and online video content.
The FTC has made clear that the VPPA’s scope tracks the practical reality of how video content is delivered today. The statute was written broadly enough that circuit courts have applied it to streaming platforms, news publishers with embedded video, e-commerce sites with product video, and subscription video services. If someone can subscribe to or request video content through your platform, you are likely covered.
“Personally identifiable information” under the VPPA includes information that “identifies a person as having requested or obtained specific video materials or services.” Courts have found that combining a user ID with video viewing data constitutes PII under this definition, even when neither piece of information alone would identify the viewer. This is how companies ended up in litigation over pixel tracking, behavioral advertising, and data-sharing with Meta’s ad platform.
2. The Class Action Wave: What Streaming Platforms Got Wrong
Starting around 2022 and continuing through 2026, plaintiffs’ attorneys have filed hundreds of VPPA class actions against companies whose websites included video content and whose pixel or tracking configurations shared user video-viewing data with third parties like Facebook, Google, or analytics providers. The common denominator: the companies had no valid written consent from users to make those disclosures.
Hulu, ESPN+, The Boston Globe, Patreon, and many others have faced or settled VPPA claims. The pattern is almost always the same: a tracking pixel fires when a user watches a video, sends data including the user’s Facebook ID (or similar persistent identifier) and the video title or category to a third-party ad platform, and the company never obtained written consent specifically authorizing that disclosure.
A 2026 Supreme Court case is addressing what it means to be a “consumer” under the VPPA, potentially expanding or narrowing who can bring claims. What has not changed: the written consent requirement for disclosure to third parties. If your platform is sharing video viewing data with any external service, you need valid VPPA consent or you are at risk.
3. The Written Consent Requirement: What It Actually Means
The VPPA does not just require a privacy policy disclosure. It requires a consumer to provide “informed, written consent” to the disclosure of their video viewing information to third parties. Specifically, the statute requires this consent to be:
In a form “distinct and separate” from any form setting forth other legal or financial obligations of the consumer. This means a buried paragraph inside a multi-page terms of service is not sufficient written consent under the VPPA. The consent must be given in a way that the consumer can clearly understand what they are agreeing to: who will receive their information, what information will be shared, and the nature of the recipient’s use.
The VPPA also allows consumers to give consent that covers multiple disclosures over a period of time, but only if they are given the opportunity to withdraw consent at any point. A checkbox buried in your account settings that has been pre-checked does not meet this standard.
Your privacy policy must separately address VPPA compliance. It is not enough to have a general data-sharing disclosure. You need to specifically identify: (1) the categories of third parties receiving video viewing data; (2) the types of video information being shared; and (3) how users can withdraw consent. If your platform uses any pixel or tag that could match a user’s identity with their video viewing behavior, this disclosure is mandatory.
4. What Your Terms of Service Must Address for VPPA Compliance
Your terms of service cannot handle VPPA compliance on their own, but they play an important role in your overall compliance architecture. Here is what your agreements need to address:
Data Collection and Processing Disclosures
Your terms must clearly identify the types of data your platform collects in connection with video content. This includes: user account information tied to viewing history, device identifiers, IP addresses, video titles or categories accessed, duration of viewing, and any behavioral or preference data derived from viewing activity. If this data is used for recommendations, personalization, or advertising, say so explicitly.
Third-Party Disclosure Restrictions
Your terms should establish clear limits on what data is shared with which categories of third parties. Specifically, your agreements should prohibit the sharing of video viewing information with advertisers or ad tech platforms without separate VPPA-compliant consent. If you work with advertising partners, your vendor agreements must include VPPA restrictions on how those partners can use the data you provide them.
Separate VPPA Consent Mechanism
Ideally, your terms reference a standalone VPPA consent form or disclosure that users complete during registration or when they first access video content. The consent mechanism should be clearly labeled, specific about what data is being shared and with whom, and linked to a clear opt-out or withdrawal mechanism.
Subscriber vs. Non-Subscriber Distinction
The 2026 Supreme Court litigation has focused partly on whether non-paying users who create accounts qualify as “consumers” under the VPPA. Your terms of service can and should address this by clearly defining the relationship between your platform and users who create accounts, subscribe, or access video content without paying. A well-drafted agreement accounts for the legal exposure regardless of which way the Supreme Court rules.
5. Pixel Tracking and Embedded Video: The Highest-Risk Areas
The majority of VPPA litigation in recent years has not been about companies intentionally selling user data. It has been about companies running tracking pixels as part of standard digital marketing operations, not realizing those pixels were capturing video-viewing data and transmitting it to ad platforms in ways that triggered VPPA liability.
If your website or app includes: a Meta Pixel, a Google Analytics configuration that tracks video engagement, a YouTube embedded player with extended tracking enabled, or third-party video hosting with analytics, you may already be sharing video viewing data with third parties in a way the VPPA regulates. A technical audit of your tracking configuration should accompany any VPPA compliance review of your legal documents.
California’s CPRA and state-level equivalents compound this exposure. Many states now require disclosure of data sales or sharing with third parties for advertising purposes, and video viewing data often qualifies under these statutes as sensitive information requiring heightened protection.
6. Vendor Agreements and the VPPA
The VPPA has an exception for disclosure “incident to the ordinary course of business of the video tape service provider.” This exception covers data processors, service providers, and contractors who help you operate your platform. However, this exception requires that you have a proper data processing agreement in place with each vendor, and that the vendor’s use of the data is limited to the specific purpose for which it was shared.
If you share video viewing data with any third party without a properly scoped agreement, the “ordinary course of business” exception may not protect you. Your vendor contracts need to explicitly limit the vendor’s use of video data, prohibit onward sharing, and include VPPA-specific restrictions. A technology attorney who understands digital platforms will structure these agreements in a way that preserves the exception while still allowing your platform to function.
7. What Happens When Your ToS Doesn’t Address VPPA
VPPA class actions carry statutory damages of $2,500 per violation per plaintiff, plus attorneys’ fees. A class of 10,000 users where each is a “violation” creates potential exposure of $25 million before you even get to trial. Courts have certified VPPA classes, which means plaintiffs’ attorneys are highly motivated to bring these cases.
The companies that have settled these cases at significant cost almost universally had one thing in common: their terms of service, privacy policies, and vendor agreements were drafted before the modern VPPA litigation environment and were never updated to address pixel-based data sharing or video-specific consent requirements. The fix for most of them was straightforward, but it came after the lawsuit was filed.
Getting your VPPA compliance documentation in place before litigation is a fraction of the cost of defending a class action after the fact. This is exactly the kind of problem that a properly drafted privacy policy and terms of service is designed to prevent.
Frequently Asked Questions
Does the VPPA apply to my website if I only have a few embedded videos?
Yes, if your site has any video content that users can request or access, and you collect user data in connection with that viewing, the VPPA applies. The number of videos is not the threshold. What matters is whether you collect data about who watches which video content, and whether that data is shared with third parties.
Is a general privacy policy sufficient for VPPA compliance?
No. The VPPA requires written consent that is “distinct and separate” from other legal agreements. A privacy policy that includes a general data-sharing disclosure does not satisfy the VPPA’s consent requirement. You need a standalone consent mechanism that specifically addresses video viewing data disclosure to third parties.
Can users opt out of VPPA protections?
Yes, but only if the consent is given properly. The VPPA allows users to consent to data sharing for marketing or other purposes, but that consent must be knowing, written, and separate from other agreements. Users can also withdraw consent at any time, so your platform must include a clear mechanism to do so.
Does the VPPA apply to B2B platforms with video content?
The VPPA applies to “consumers” who request or obtain video content. Courts have debated whether business subscribers qualify, but the safest approach for any platform, B2B or B2C, is to implement VPPA-compliant consent mechanisms if you share video viewing data with third parties. The litigation risk exists regardless of how you classify your users.
What is the difference between the VPPA and state video privacy laws?
The VPPA is a federal baseline. Some states have additional privacy rules that apply to video content. California’s CPRA, for example, requires disclosure and opt-out rights for the sharing of “sensitive personal information,” which can include video viewing history. Your compliance program needs to address both federal and state requirements.
Do I need a lawyer to handle VPPA compliance for my platform?
Given the active litigation environment and the requirement for specific, legally operative consent language, yes. A generic privacy policy template will not protect you. The consent mechanisms, vendor agreements, and disclosure language need to be drafted with the VPPA’s specific requirements in mind, not adapted from a general-purpose privacy template.
Protect Your Platform Before Litigation Finds You
The VPPA is one of the few federal privacy laws with no cap on class size, a low bar for statutory damages, and an extremely active plaintiffs’ bar looking for companies whose tracking configurations share video data without compliant consent. If your platform has video content, now is the time to audit your agreements, review your pixel configuration, and get your VPPA compliance documentation in place.
Contact Hansen Tong at TOSLawyer.com to get a VPPA compliance review and properly drafted consent agreements that actually protect your platform.