In recent years, websites have faced a slew of proposed class action lawsuits over their tracking technologies.  To improve user experiences and to tailor marketing, some websites use pixels, strings of code used to gather and share information about how users interact with websites.  Many lawsuits challenging the sharing of that information have focused on a federal law called the Video Privacy Protection Act (VPPA).  Recent decisions from the Second Circuit and the D.C. Circuit have narrowly construed different elements of that statute.  Those decisions offer early signs that judicial consensus may be shifting toward reading the VPPA more narrowly than the district courts have done to date.

Still, meaningful risk remains in this area, especially when it comes to targeted advertising.  In addition to the VPPA, companies should monitor developments in pixel-related litigation (under the California Invasion of Privacy Act and other wiretapping laws) and from regulators.  You can follow the WilmerHale Privacy and Cybersecurity Blog for the latest.

I. Statutory Background

Congress enacted the VPPA in 1988 after a newspaper published a list of films that Supreme Court nominee Judge Robert Bork and his family had rented from a brick-and-mortar video store.  The newspaper had published the list without the Bork family’s consent, prompting Congress to prohibit similar disclosures in the future through the VPPA.  Since the law’s enactment, however, the internet has revolutionized how we access audiovisual content.  At work, at home, and on the go, video clips are constantly at our fingertips.  Yet the statute’s text has remained largely the same.

The VPPA prohibits a “video tape service provider” from “knowingly disclos[ing]” “personally identifiable information” that concerns “any consumer of such provider,” except in several circumstances, like when the consumer has consented.¹  Aggrieved consumers can sue under the statute and obtain a minimum amount of $2,500 per violation, and possibly punitive damages, attorneys’ fees, and litigation costs.² 

The statute’s broad language and generous damages provision have made it popular among the plaintiffs’ bar in recent years.  The law has proven particularly popular in recent litigation involving pixels and trackers.  Plaintiffs have been aggressive in bringing VPPA cases on the theory that an entity’s use of pixels in videos and video advertisements violates the statute by tracking an individual’s viewing history and collecting other personal information.

But two recent decisions from the federal courts of appeals have limited VPPA liability in their respective circuits.  In the process, these decisions have deepened circuit splits on two elements of the VPPA.  The Second Circuit has limited what counts as “personally identifiable information” sufficient to trigger VPPA liability.³  Meanwhile, the D.C. Circuit has narrowed who may count as a “consumer” covered by the VPPA.⁴

II. Personally Identifiable Information

The Second Circuit narrowly interpreted the term “personally identifiable information” (PII) as used by the VPPA in Solomon v. Flipps Media.⁵  On behalf of a putative class, Detrina Solomon sued Flipps Media, a digital video streaming service, alleging Flipps’s use of pixel technology violated the VPPA.⁶  When a user accessed a video on the Flipps website, Solomon alleged, the advertising pixels installed on the site would send to a third party (1) a string of characters containing URLs and video titles and (2) a cookie containing the user’s unique social media identification number.⁷  The Second Circuit panel unanimously held that these data do not fall within the scope of the VPPA.⁸

To reach that decision, the Second Circuit had to articulate a test for what counts as PII covered by the VPPA.  The VPPA itself offers limited color, explaining only that PII “includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.”⁹  To fill out that definition, circuits have split on the standard.

On one side, the First Circuit has adopted a “reasonable foreseeability” standard.  By that standard, PII includes information that is “reasonably and foreseeably likely to reveal which … video [the plaintiff] has obtained.”¹⁰  In Yershov v. Gannett Satellite Information Network, the complaint alleged that USA Today sent Adobe the titles of videos viewed on its website and the GPS coordinates and unique identifiers of the devices used to view those videos.¹¹  Since Adobe, given its sophistication, allegedly could link these datapoints to particular consumers, the First Circuit held the information constituted PII under the VPPA.¹²

In contrast, the Third and Ninth Circuits have articulated the “ordinary person” standard.  Under this test, PII includes only “the kind of information that would readily permit an ordinary person to identify a specific individual’s video-watching behavior.”¹³  Much like Yershov, Eichenberger v. ESPN involved the disclosure of device serial numbers to Adobe along with the names of videos watched on those devices.¹⁴  But unlike the First Circuit in Yershov, the Ninth Circuit in Eichenberger held that the disclosed data did not qualify as PII; while Adobe could stitch together the information and trace it to individuals, an ordinary person could not.¹⁵  The ordinary recipient rather than the actual recipient controlled the degree to which the court considered the information personally identifying.

The Second Circuit in Solomon backed the “ordinary person” test and applied it to the data disclosed using the pixel.¹⁶ The Second Circuit determined that an ordinary person was unlikely to look at the convoluted string of characters, numbers, and letters and understand it to include a video title.¹⁷ The court also found it unlikely that an ordinary person would identify users through their social media identification numbers, which were not apparently labeled as such and were embedded in other lines of code.¹⁸  Consequently, the Second Circuit held that the pixel did not disclose PII, and it affirmed the district court’s dismissal of the complaint.¹⁹

In the months since Solomon, the Second Circuit has begun to apply it, starting with Hughes v. NFL.²⁰  Like Solomon, Hughes sued a website under the VPPA for using a pixel that shared character strings containing video titles and social media identification numbers.²¹  And as in Solomon, the Second Circuit held that the shared information did not qualify as PII since it was not plausible that an ordinary person would piece together the information contained in the character strings.²²  Thus, Hughes confirms that the Second Circuit has “effectively shut the door for Pixel-based VPPA claims.”²³

The Second Circuit’s decisions mark a shift.  Across the split circuits, district courts have largely held that pixels track and share PII, including where the shared video-viewing information is associated only with social media identification numbers.²⁴

III. Consumer

More recently, the D.C. Circuit narrowed who counts as a “consumer” protected by the VPPA in Pileggi v. Washington Newspaper Publishing.²⁵  Nicole Pileggi sued the owner of the Washington Examiner under the VPPA, alleging the Washington Examiner used a tracking pixel to transmit information without her consent to a third party about the videos Pileggi viewed on the Washington Examiner’s website.²⁶  Pileggi argued she was covered by the VPPA since she had previously subscribed to the Washington Examiner’s email newsletter.²⁷  But she did not access the website’s videos through links in the newsletter.²⁸  Rather, Pileggi independently navigated to the website where she watched the videos, where they were freely available.²⁹  The court held that simply subscribing to the email newsletter did not make Pileggi a VPPA consumer of the videos viewed on the website.³⁰

The VPPA protects only certain people’s information.  Specifically, it protects the video-viewing information of a “consumer” of a video tape service provider.³¹  The statute defines such a consumer to mean “any renter, purchaser, or subscriber of goods or services from a video tape service provider.”³²  But the statute does not specify whether those consumed goods or services must be audiovisual.  On that point, the circuits have split.  Must a consumer rent, purchase, or subscribe to specifically audiovisual goods or services, or may they rent, purchase, or subscribe to any goods or services furnished by someone who also furnishes audiovisual goods or services?

On one side, the Second and Seventh Circuits have held that the VPPA covers people who rent, purchase, or subscribe to any good or service provided by a video tape service provider, even if the good or service is not itself audiovisual.³³  In Salazar v. NBA, for instance, the plaintiff, Michael Salazar, had signed up for an online email newsletter from the NBA.³⁴  He separately visited the NBA’s website, where he watched freely available videos.³⁵  The Second Circuit allowed Salazar’s VPPA claim to proceed even though the product to which he had subscribed—the newsletter—was not audiovisual.³⁶  To the court, any rental, purchase, or subscription from a video tape service provider makes someone a VPPA consumer, even if the thing purchased is as unrelated as a hammer, an article of clothing, or a newsletter.³⁷

On the other side, the Sixth Circuit has held that a person is a VPPA consumer only if they rent, purchase, or subscribe to goods or services that are audiovisual in nature.³⁸  In Salazar v. Paramount Global, the same Salazar sued Paramount under the VPPA, arguing he became a subscriber of a video tape service provider by signing up for a Paramount newsletter.³⁹  Since the newsletter was not audiovisual, however, the Sixth Circuit held that Salazar did not qualify as a consumer under the VPPA.⁴⁰  The VPPA’s most natural and contextual reading, said the Sixth Circuit, “shows that a person is a ‘consumer’ only when he subscribes to ‘goods or services’ in the nature of ‘video cassette tapes or similar audio visual materials.’”⁴¹

The D.C. Circuit agreed in Pileggi.  The court provided “five reasons why it is not enough … just to obtain some other good or service furnished by a person who also happens to provide videos or audio-visual materials.”⁴² 

• First, the court used the definition of “video tape service provider” to infer that when a consumer rents, purchases, or subscribes to “goods or services” from such a provider, they are renting, purchasing, or subscribing to “video cassette tapes or similar audio visual materials.”⁴³
• Second, the court determined that the statute’s title and subheadings indicated a focus on consumers of audiovisual materials.⁴⁴
• Third, the court found that the statute’s per-violation penalties weighed in favor of “enforcing the textual linkage between a consumer and a video.”⁴⁵
• Fourth, the court deemed that the statute’s authorization of punitive damages required it to construe the statute to avoid expansive liability.⁴⁶
• And fifth, the court wrote that failing to link consumers to videos would lead to “haphazard and unreasoned” consequences.⁴⁷ For instance, “a plaintiff could purchase a single ticket at a baseball game and then sue the baseball team’s owner after watching a free video on the team’s website years later,” while “those who just visit the website without first buying a ticket or another good or service would not enjoy the Video Privacy Act’s protections, even though their video-viewing history would be tracked in the exact same manner as that of the ticket purchaser.”⁴⁸

The D.C. Circuit went a step further.  It ruled that even consuming audiovisual materials is not enough; rather, “the videos for which viewing history is disclosed must be the same video materials or services that the individual purchased, rented, or subscribed to.”⁴⁹  This nuance mattered since Pileggi had subscribed to a newsletter containing embedded videos and video links, but Pileggi’s VPPA claim rested on videos she watched on the Washington Examiner website.⁵⁰  In short, “[o]nly those who purchase, rent, or subscribe to a video service are protected, and it is only to those same videos that the statute’s privacy protections attach.”⁵¹

With the D.C. Circuit joining the fray, the circuit split has deepened on the question of who counts as a VPPA consumer.  After the Second Circuit’s Salazar decision, the NBA has petitioned the Supreme Court to resolve the question.  The Supreme Court has yet to decide whether to weigh in.

IV. Conclusion

These different decisions indicate the uncertain scope of the VPPA.  They also demonstrate how different circuits have found different floodgates to modulate the VPPA’s reach.  The Second Circuit has focused on the nature of the information shared (i.e., the personally identifiable information), while the D.C. Circuit has focused on the person whose information is shared—the consumer.  On both elements, the circuit splits have deepened.  It remains to be seen whether the Supreme Court will resolve the conflict.

Footnotes:

1. 18 U.S.C. § 2710(b).
2. Id. § 2710(c).
3. See infra Part II.
4. See infra Part III.
5. Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025). 
6. Id. at 46-47. 
7. Id. at 46. 
8. Id. at 55. 
9. 18 U.S.C. § 2710(a)(3). 
10. Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482, 486 (1st Cir. 2016). 
11. Id. at 484. 
12. Id. at 484-486. 
13. In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 267 (3d Cir. 2016); Eichenberger v. ESPN, Inc., 876 F.3d 979, 985 (9th Cir. 2017). 
14. Eichenberger, 876 F.3d at 985-986. 
15. Id. at 986. 
16. Solomon, 136 F.4th at 54. 
17. Id.
18. Id.
19. Id. at 55. 
20. Hughes v. Nat’l Football League, 2025 WL 1720295 (2d Cir. June 20, 2025). 
21. Id. at *2. 
22. Id. at *3. 
23. Id. at *2. 
24. See, e.g., Belozerov v. Gannett Co., Inc., 646 F. Supp. 3d 310, 314-315 (D. Mass. 2022); Stark v. Patreon, Inc., 635 F. Supp. 3d 841, 853 (N.D. Cal. 2022); Feldman v. Star Trib. Media Co. LLC, 659 F. Supp. 3d 1006, 1020-1021 (D. Minn. 2023); Lebakken v. WebMD, LLC, 640 F. Supp. 3d 1335, 1341-1342 (N.D. Ga. 2022). 
25. Pileggi v. Washington Newspaper Publishing Co., 146 F.4th 1219 (D.C. Cir. 2025). 
26. Id. at 1223. 
27. Id. at 1223-1224. 
28. Id. at 1225. 
29. Id.  
30. Id. at 1232. 
31. 18 U.S.C. § 2710(b). 
32. Id. § 2710(a)(1). 
33. See Salazar v. Nat’l Basketball Ass’n, 118 F.4th 533, 550 (2d Cir. 2024); Gardner v. Me-TV Nat’l Ltd. P’ship, 132 F.4th 1022, 1025 (7th Cir. 2025). 
34. Salazar v. NBA, 118 F.4th at 536. 
35. Id. 
36. Id. at 550. 
37. Id.; see also Gardner, 132 F.4th at 1025. 
38. See Salazar v. Paramount Glob., 133 F.4th 642, 650-651 (6th Cir. 2025). 
39. Id. at 645. 
40. See id. at 652-653. 
41. Id. at 650-651. 
42. Pileggi, 146 F.4th at 1232. 
43. Id. 
44. Id. at 1232-1233. 
45. Id. at 1233. 
46. Id. 
47. Id. at 1233-1234. 
48. Id. 
49. Id. at 1237. 
50. Id. 
51. Id.