A 1988 law written about VHS rentals is now a routine claim against websites that embed a video player next to an ad pixel. If your site does both, the Supreme Court heard a case on Wednesday that could decide how far that claim reaches.
What the Court is deciding
The Video Privacy Protection Act (VPPA, 18 U.S.C. § 2710) bars a "video tape service provider" from knowingly disclosing personally identifiable information about a consumer without consent. A consumer is "any renter, purchaser, or subscriber of goods or services" from that provider. The statute sets liquidated damages per person, which is why class plaintiffs like it.
In Salazar v. Paramount Global (No. 25-459), Michael Salazar says he subscribed to a newsletter on 247Sports.com, then watched videos on the site while logged into Facebook, and that Paramount's tracking pixel sent his viewing information to Facebook. The district court dismissed the case because a newsletter isn't audiovisual content, and the Sixth Circuit affirmed in a divided decision. The Court granted review in January and heard argument on October 14, 2026. The question is whether "consumer" covers someone who bought any goods or services from the provider, or only someone who obtained audiovisual material from it. No decision has issued yet.
What this changes for your site
Nothing yet, and nothing you can safely assume either way. A narrow reading would shrink the pool of plaintiffs for sites whose video is a sideline to a newsletter, a store, or an account. A broad one would leave those sites exposed. Either outcome leaves the underlying question untouched: when a visitor plays a video, which third parties learn about it, and under what circumstances?
That question is separate from the CCPA, but the evidence you need is the same. California's rules already expect you to know what your site shares and to stop sharing when a visitor opts out (§ 7025), and a video pixel is one more tag in that inventory. This post isn't legal advice; whether the VPPA applies to you depends on facts a lawyer should review.
What to check this week
- Open a page with an embedded player, press play, and watch the network tab. Look for requests to ad platforms that carry the video title or URL, and for a Facebook or other advertising identifier traveling with them.
- Ask whoever owns marketing tags whether a pixel was added to video pages specifically, since those are often set up outside the sitewide tag configuration.
- Repeat the test with a Global Privacy Control signal on, and again after declining your banner, to see whether the requests stop.
Our walkthrough of what fires before consent covers the browser-side method, and the CIPA exposure post explains why the same requests matter under California's wiretap law.
Where Privisy fits
Your consent platform shows how it was configured; Privisy loads the live page as a visitor would and reports which trackers actually fire, with and without a GPC signal. Run the audit against a page with video on it and you get an outside record of what that page sends, which is the thing you'd want in hand if a demand letter ever arrived.
See what your site actually does
Privisy audits your trackers and GPC response on the live site.
Get Your Audit