Despite having been enacted decades ago – during the heyday of the neighborhood brick-and-mortar video store – the federal Video Privacy Protection Act (VPPA) remained as relevant as ever in 2025. Companies continued to face VPPA lawsuits over their use of software that gathers and shares consumers’ interactions with websites. In the past year, multiple VPPA cases made their way to the federal courts of appeals, and the resulting decisions offer early signs that the appellate courts are guiding district courts toward narrower readings of the VPPA, though using different elements of the statute. The year concluded with the Supreme Court declining to take up petitions for certiorari that presented several pertinent questions about the VPPA’s interpretation, leaving the lower courts to continue in their dominant role of developing the VPPA case law. As they do, we invite you to stay current by subscribing to the WilmerHale Privacy and Cybersecurity Law Blog.

I. What Is The VPPA?

The VPPA prohibits a “video tape service provider” from “knowingly disclos[ing]” “personally identifiable information” that concerns “any consumer of such provider,” except in several circumstances, like when the consumer has consented.¹ The statute provides a federal right of action allowing aggrieved consumers to seek a minimum amount of $2,500 per violation and possibly punitive damages, attorneys’ fees, and litigation costs.²

The statute’s broad language and generous damages provision have made it popular among the plaintiffs’ bar, particularly for pursuing claims against website operators that use pixels, cookies, and other website tracking technologies. Plaintiffs have been aggressive in bringing VPPA cases on the theory that the use of these tools by businesses that deliver audiovisual content violates the statute by collecting and disclosing users’ viewing histories and other information.

But several 2025 decisions from the federal courts of appeals have limited VPPA liability. Different cases have focused on different elements of the VPPA: (1) the definition of “video tape service provider,” (2) the definition of “consumer,” and (3) the definition of “personally identifiable information.”

II. Circuits Have Clarified That The VPPA Applies Only To Those Engaged In The Business Of Providing Audiovisual Materials, Not Just Audiovisual Experiences 

The VPPA does not cover all companies. Rather, it reaches only disclosures by “video tape service providers,” defined to include those “engaged in the business … of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.”³

This year, two courts of appeals elaborated on what it means for a company to engage in the business of delivering such audiovisual materials. In Osheske v. Silver Cinemas Acquisition Co.⁴ and Christopherson v. Cinema Entertainment Corp.,⁵ the Ninth and Eighth Circuits respectively held that movie theaters are not engaged in the business of conveying video tapes or similar goods: Theatergoers have no control over the movie; they cannot pause, rewind, or fast-forward; and they cannot rewatch it without buying another ticket.⁶ Thus, these circuits held, theaters provide movie-viewing experiences, but they are not video tape service providers covered by the VPPA.⁷

The Eighth Circuit went a step further to explain why running advertisements (in the form of movie trailers) does not itself put movie theaters in the “business” of delivering covered material. The court reasoned that engaging in the business of something commonly means regularly engaging in that thing “for livelihood or gain.”⁸ Applying this principle, the court explained that theaters are not engaged in the business of screening trailers, which are provided for free to entice consumers to buy more tickets and concessions, the theater’s true business.⁹ This reasoning suggests that merely providing audiovisual advertising does not qualify as being “engaged in the business” within the meaning of the VPPA. 

Notwithstanding these decisions, it remains likely that many businesses not primarily focused on delivering video content will remain covered by the VPPA. As the Eighth Circuit acknowledged in Christopherson, “a company can be engaged in multiple businesses at the same time.”¹⁰ And district courts have reaffirmed that delivering video content need not be the “overarching focus or particular field of endeavor” of a company.¹¹ As long as the company “regularly delivers video content to users” and derives some livelihood or gain from doing so, it likely qualifies as a video tape service provider under the VPPA.¹²

III. Circuits Have Split On Whether The VPPA Protects Consumers Of Non-Audiovisual Materials From Video Tape Service Providers

The VPPA protects only the video-viewing information of “consumers.” A “consumer” under the statute is “any renter, purchaser, or subscriber of goods or services from a video tape service provider.”¹³ But the VPPA does not specify whether those consumed goods or services must be audiovisual. Must a consumer rent, purchase, or subscribe to specifically audiovisual goods or services, or may they rent, purchase, or subscribe to any goods or services furnished by someone who also furnishes audiovisual goods or services? 

On that question, a circuit split deepened this year, as explained in more detail in a recent post from this blog. On one side, the Seventh Circuit joined the Second Circuit in holding that the VPPA covers people who rent, purchase, or subscribe to any good or service provided by a video tape service provider, even if the good or service is not itself audiovisual.¹⁴ On the other side, the Sixth Circuit and D.C. Circuit held that a person is a VPPA consumer only if they rent, purchase, or subscribe to goods or services that are audiovisual in nature.¹⁵ The D.C. Circuit went a step further. It ruled that even consuming audiovisual materials is not enough; rather, “the videos for which viewing history is disclosed must be the same video materials or services that the individual purchased, rented, or subscribed to.”¹⁶ In the D.C. Circuit, “[o]nly those who purchase, rent, or subscribe to a video service are protected, and it is only to those same videos that the statute’s privacy protections attach.”¹⁷

In December 2025, the Supreme Court declined to resolve the split, denying the cert petition filed after the Second Circuit’s original decision on this question in Salazar v. NBA. In 2026, we expect the issue to continue to percolate in other circuits, perhaps beginning with the Ninth Circuit, which held oral argument on this exact question on August 12, 2025.¹⁸

IV. Circuits Have Split On Which Web Information The VPPA Shields From Disclosure

The VPPA punishes disclosures only of “personally identifiable information” (PII), which “identifies a person as having requested or obtained specific video materials or services from a video tape service provider.”¹⁹ As explained in our recent blog post, circuits have previously split on the standard. Under the First Circuit’s “reasonable foreseeability” standard, PII includes information that is “reasonably and foreseeably likely to reveal which … video [the plaintiff] has obtained.”²⁰ Meanwhile, under the “ordinary person” standard of the Third and Ninth Circuits, PII includes only “the kind of information that would readily permit an ordinary person to identify a specific individual’s video-watching behavior.”²¹ While the former test looks to the actual recipient, the latter test looks to the ordinary recipient.

This year, the Second Circuit joined the fray. In Solomon v. Flipps Media,²² it backed the “ordinary person” test and applied it to website-interaction data disclosed using pixel technology.²³ More specifically, the complaint in Flipps alleged that when a user would access a video on the defendant’s website, advertising pixels installed on that site would send to a third party (1) a string of characters containing URLs and video titles and (2) a cookie containing the user’s unique social media identification number.²⁴ Applying the “ordinary person” test, the Second Circuit determined that an ordinary person was unlikely to look at the character string and understand it to include a video title.²⁵ The court also found that an ordinary person would be unlikely to identify users through their social media identification numbers, which were not apparently labeled as such and were embedded in other lines of code.²⁶ So, the court held, the pixel did not disclose PII, and it affirmed the district court’s dismissal of the complaint.²⁷ Reaffirming that decision in another pixel case, Hughes v. NFL,²⁸ the Second Circuit confirmed that Flipps “effectively shut the door for Pixel-based VPPA claims” within its jurisdiction.²⁹ But district courts in other circuits have largely continued to hold that sharing a video URL along with a social media identification number counts as sharing PII.³⁰

As with Salazar v. NBA, the Supreme Court declined to take up Flipps in December 2025, leaving it to the federal courts of appeals to determine in the interim when, if ever, pixels and other web tracking technology disclose PII that could trigger VPPA liability.

V. Conclusion 

In short, 2025 saw the involvement of the federal courts of appeals in interpreting the scope of the VPPA. Some courts have begun to develop legal principles as to who can be held liable under the VPPA. Meanwhile, splits have deepened on the questions of who and what are protected under the VPPA. At the end of the year, the Supreme Court declined to weigh in on these issues. So we anticipate they will continue to percolate in the courts of appeals in the year ahead.

Footnotes: 

1. 18 U.S.C. § 2710(b).
2. Id. § 2710(c).
3. Id. § 2710(a)(4).
4. Osheske v. Silver Cinemas Acquisition Co., 132 F.4th 1110 (9th Cir. 2025).
5. Christopherson v. Cinema Ent. Corp., 161 F.4th 525 (8th Cir. 2025).
6. Osheske, 132 F.4th at 1113; Christopherson, 161 F.4th at 528.
7. Osheske, 132 F.4th at 1113; Christopherson, 161 F.4th at 528-529.
8. Christopherson, 161 F.4th at 529. 
9. Id. at 530.  
10. Id. at 529; accord Salazar v. Nat’l Basketball Ass’n, 118 F.4th 533, 548 (2d Cir. 2024).
11. Cole v. LinkedIn Corp., --- F. Supp. 3d ---, 2025 WL 2963221, at *3 (N.D. Cal. Oct. 20, 2025); see also Goodman v. Hillsdale Coll., 2025 WL 2941542, at *5 (W.D. Mich. Oct. 17, 2025); Plotsker v. Envato Pty Ltd., 2025 WL 2481422, at *6 (C.D. Cal. Aug. 26, 2025).
12. Cole, --- F. Supp. 3d ---, 2025 WL 2963221, at *3.
13. 18 U.S.C. § 2710(a)(1).
14. See Salazar v. NBA, 118 F.4th at 550; Gardner v. Me-TV Nat’l Ltd. P’ship, 132 F.4th 1022, 1025 (7th Cir. 2025).
15. See Salazar v. Paramount Glob., 133 F.4th 642, 650-651 (6th Cir. 2025); Pileggi v. Wash. Newspaper Publ’g Co., 146 F.4th 1219 (D.C. Cir. 2025).
16. Id. at 1237.
17. Id.
18. See Heather v. Healthline Media, Inc., No. 24-4168 (9th Cir. Aug. 12, 2025), ECF No. 32.
19. 18 U.S.C. § 2710(a)(3).
20. Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482, 486 (1st Cir. 2016).
21. In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 267 (3d Cir. 2016); Eichenberger v. ESPN, Inc., 876 F.3d 979, 985 (9th Cir. 2017).
22. Solomon v. Flipps Media, Inc., 136 F.4th 41 (2d Cir. 2025).
23. Id. at 54.
24. Id. at 46.
25. Id.
26. Id.
27. Id. at 55.
28. Hughes v. Nat’l Football League, 2025 WL 1720295 (2d Cir. June 20, 2025).
29. Id. at *2.
30. See, e.g., Cochenour v. 360Training.com, Inc., 2025 WL 3251719, at *5 (W.D. Tex. Nov. 3, 2025); Cole v. LinkedIn Corp., --- F. Supp. 3d ---, 2025 WL 2963221, at *5 (N.D. Cal. Oct. 20, 2025); Goodman v. Hillsdale Coll., 2025 WL 2941542, at *8-9 (W.D. Mich. Oct. 17, 2025).