This week, the U.S. Supreme Court granted certiorari in Salazar v. Paramount Global, No. 25-459 (cert. granted Jan. 26, 2026), to resolve a circuit split over the scope of the federal Video Privacy Protection Act (VPPA). Enacted in 1988, the VPPA has helped fuel a wave of class actions in recent years, especially suits aimed at digital media and entertainment companies with embedded video content.

This case stems from allegations that the plaintiff subscribed to a newsletter from a sports entertainment website owned by Paramount Global, watched videos on the site, and that Facebook’s Meta pixel caused the browser to transmit the plaintiff’s Facebook ID and the webpage URL to Facebook—allegedly disclosing viewing habits in violation of the VPPA. The district court dismissed the complaint, and the Sixth Circuit affirmed.

The dispute here centers on who qualifies as a “consumer” entitled to sue under the VPPA, which prohibits a “video tape service provider” from knowingly disclosing personally identifiable information concerning any “consumer.” The statute defines “consumer” as “any renter, purchaser, or subscriber of goods or services from a video tape service provider,” and it defines “video tape service provider” in terms of being in the business of rental, sale, or delivery of “prerecorded video cassette tapes or similar audio visual materials.”

The Sixth Circuit applied a narrower approach, holding a newsletter subscriber was not a “consumer” absent an alleged subscription to video content or other qualifying “audio visual materials,” but other circuits have interpreted the “term” consumer more broadly.

For companies that use embedded video and third-party tracking tools, the Supreme Court’s eventual ruling may help sharpen the VPPA risk picture in the age of digital entertainment.

Photo of Roma Patel Roma Patel

Roma Patel focuses her practice on a broad range of data privacy and cybersecurity matters. She handles comprehensive responses to cybersecurity incidents, including business email compromises, network intrusions, inadvertent disclosures and ransomware attacks. In response to privacy and cybersecurity incidents, Roma guides clients…

Roma Patel focuses her practice on a broad range of data privacy and cybersecurity matters. She handles comprehensive responses to cybersecurity incidents, including business email compromises, network intrusions, inadvertent disclosures and ransomware attacks. In response to privacy and cybersecurity incidents, Roma guides clients through initial response, forensic investigation, and regulatory obligations in a manner that balances legal risks and business or organizational needs. Read her full rc.com bio here.