The Video Privacy Protection Act (VPPA), passed by the United States Congress in 1988 as Pub. L. 100–618 and signed by President Ronald Reagan, was enacted to prevent the wrongful disclosure of video rental and sale records, including video games. The law gained attention after Robert Bork's video rental history was made public during his Supreme Court nomination, earning it the nickname “Bork bill.” The VPPA imposes liability on video service providers for unauthorized disclosures unless consent is given or legally compelled. Amended in 2013, it now allows electronic consent lasting up to two years. The VPPA remains relevant amid growing digital media and alongside newer laws like the California Consumer Privacy Act.
Computer-based VPPA litigation
Toward the end of the 2010's and beginning of the 2020's, the 1988 law experienced a resurgence in consumer class action lawsuits. The numerous lawsuits filed as part of this trend alleged that companies violated the VPPA by collecting and disclosing consumers' video viewing history through their websites, mobile apps, and other smart devices.
While the language of the VPPA focuses on "video tape service providers," consumers have argued that the law also protects the privacy of their personal information that is collected while they watch audiovisual content online. Cookies and other website behavior tracking technologies commonly found on popular websites allow the website operators to connect visitors' browsers with third parties who collect information from their website visit. This information can be shared with the third parties for various purposes including website functionality, language preferences and other personalization, and third party advertising.5 The recent resurgence of VPPA lawsuits is premised on the idea that data collected through the various tracking technologies may include personal information protected by the VPPA. Consumer plaintiffs assert that if that information is shared with third parties for analytics, advertising, or any other purpose that falls outside the exceptions in the VPPA, it is unlawful.
Prior to 2007, VPPA had not been cited by privacy attorneys as a cause of action involving electronic computing devices. Early lawsuits raising the VPPA in the context of data shared through the internet included a 2008 lawsuit against Facebook and thirty-three companies, including Blockbuster, Zappos, and Overstock.com, as well as the Lane v. Facebook, Inc. class action lawsuit, involving alleged privacy violations caused by the Facebook Beacon program.67
The online advertising industry, in association with analytic companies, increasingly used video-based ads and at the same time gathered data from webpages and smart TV's showing digital video. By tracking web traffic online, consumers and their attorneys gather evidence of the data being collected by third parties through cookies and other tracking technologies when a person visits a website. Consumers use that traffic analysis to determine whether their protected personal information has been shared with third parties when they visited a particular website. For example, attorneys use software applications to log HTTP/HTTPS traffic between a computer's web browser and the Internet to produce evidence of tracking activities. This approach led to a $9.5 million settlement in the Lane v. Facebook, Inc. case.89
VPPA rulings rarely survive appeal, so the Pharmatrak case (2003) remains the most significant precedent.10
2013 Amendments
Following VPPA litigation against Netflix11 and other digital media industry giants, in January 2013, President Barack Obama signed Public Law 112-258, the Video Privacy Protection Act Amendments Act of 2012, allowing video rental companies to share rental information on social networking sites after obtaining customer permission.
Netflix, which had expressed concerns about violating the VPPA with its increasingly social video viewing services, reportedly lobbied for the change.12 Netflix cited the VPPA in 2011 following the announcement of its global integration with Facebook. The company noted that the VPPA was the sole reason why the new feature was not immediately available in the United States, and encouraged its customers to contact their representatives in support of legislation that would clarify the language of the law.13 In 2012, Netflix changed its privacy rules so that it no longer retained records for people who have left the site, a change that was reported to have been inspired by VPPA litigation.14
Further results of VPPA litigation after the passage of these amendments were initially mixed. In 2015, the United States Court of Appeals for the Eleventh Circuit found that the law's protections do not reach the users of a free Android app, even when the app assigns each user a unique identification number and shares user behavior with a third party data analytics company.1516
References
18 U.S.C. § 2710: Wrongful disclosure of video tape rental or sale records /wiki/Title_18_of_the_United_States_Code ↩
"EPIC Video Privacy Protection Act Page". Electronic Privacy Information Center. Retrieved March 3, 2005. https://www.epic.org/privacy/vppa/ ↩
"Dodging the Thought Police: Privacy of Online Video and Other Content Under the "Bork Bill"". Harvard Journal of Law & Technology. August 14, 2012. Retrieved September 7, 2023. https://jolt.law.harvard.edu/digest/dodging-the-thought-police-privacy-of-online-video-and-other-content-under-the-bork-bill ↩
"PUBLIC LAW 112–249—JAN. 10, 2013" (PDF). Congress.gov. Retrieved April 12, 2024. https://www.congress.gov/112/statute/STATUTE-126/STATUTE-126-Pg2414.pdf ↩
Kesan, Jey; Shah, Rajiv (August 19, 2018). "Deconstructing Code". Yale Journal of Law and Technology. 6: 277–389. SSRN 597543. /wiki/SSRN_(identifier) ↩
Vijayan, Jaikumar (April 18, 2008). "Blockbuster sued over Facebook Beacon information sharing". Computerworld. https://www.computerworld.com/article/2536627/blockbuster-sued-over-facebook-beacon-information-sharing.html ↩
Lane v. Facebook, Inc., 696 F.3d 811 (9th Cir. 2012). /wiki/Lane_v._Facebook,_Inc. ↩
Lane v. Facebook, Inc., 696 F.3d 811 (9th Cir. 2012). /wiki/Lane_v._Facebook,_Inc. ↩
Sarah Mirando (November 4, 2013). "Supreme Court Won't Review Facebook Beacon Class Action Settlement". https://topclassactions.com/lawsuit-settlements/lawsuit-news/supreme-court-won-t-review-facebook-beacon-class-action-settlement/ ↩
Goldman, Eric (May 5, 2025). "Meta Pixels Case Dismissed by Second Circuit-Solomon v. Triller". Technology & Marketing Law Blog. Retrieved May 6, 2025. https://blog.ericgoldman.org/archives/2025/05/meta-pixels-case-dismissed-by-second-circuit-solomon-v-triller.htm ↩
Singel, Ryan (December 17, 2009). "Netflix Spilled Your Brokeback Mountain Secret, Lawsuit Claims". Wired Magazine. https://www.wired.com/2009/12/netflix-privacy-lawsuit/ ↩
Musil, Steven (January 10, 2013). "Obama signs Netflix-backed amendment to video privacy law". CNET. Retrieved June 18, 2015. https://www.cnet.com/news/obama-signs-netflix-backed-amendment-to-video-privacy-law/ ↩
"Help Us Bring Facebook Sharing to Netflix USA". Netflix Blog. Archived from the original on September 23, 2011. Retrieved September 22, 2011. https://web.archive.org/web/20110923181836/http://blog.netflix.com/2011/09/help-us-bring-facebook-sharing-to.html ↩
"Class-action lawsuit settlement forces Netflix privacy changes". Ars Technica. July 31, 2012. https://arstechnica.com/tech-policy/2012/07/class-action-lawsuit-settlement-forces-netflix-privacy-changes/ ↩
Ellis v. Cartoon Network, Inc., 803 F.3d 1251 (11th Cir. 2015). https://www.courtlistener.com/opinion/3009101/mark-ellis-v-the-cartoon-network-inc/ ↩
"Ellis v. Cartoon Network, Inc.: Eleventh Circuit Limits the Scope of "Subscriber" for VPPA Protections". Harvard Law Review. 129: 2011. May 10, 2016. https://harvardlawreview.org/2016/05/ellis-v-cartoon-network-inc/ ↩