Your Website Got a Video Privacy Protection Act Demand Over a Tracking Pixel: Is the Claim Real?

Last updated: November 2026. Reviewed by Pavel Kolmogorov, California business litigation attorney (State Bar No. 321018).

The statute is real, and so are the lawsuits, but a website claim often turns on definitions written for video stores. The federal Video Privacy Protection Act, 18 U.S.C. section 2710, makes a "video tape service provider" liable for knowingly disclosing information that identifies a consumer's video requests, with liquidated damages of $2,500. Plaintiffs say a tracking pixel makes that disclosure. Whether your site, visitors, and data fit the statute is contested. Kolmogorov Law, P.C. defends website operators in Orange County, Los Angeles, and across California against these claims.

Call (909) 235-6116 or contact us online to discuss a video privacy demand letter or complaint.

What the letter is claiming

The theory is much the same from letter to letter. Your site has pages with video. Those pages also load a social media company's tracking pixel. When a visitor who is logged in to that social network plays a video, the pixel allegedly sends the page address or video title together with an identifier tied to the visitor's account. The plaintiff calls that a knowing disclosure of who watched what.

The letter then asks for a payment per visitor, or announces a class action on behalf of everyone who watched a video on the site.

What the Video Privacy Protection Act covers

Congress wrote the law in the era of video rental stores. The core rule is one sentence: a video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of the provider is liable to the aggrieved person. (18 U.S.C. § 2710(b)(1).)

Three definitions do the work.

A video tape service provider is a person engaged in the business of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials. (18 U.S.C. § 2710(a)(4).)
A consumer is a renter, purchaser, or subscriber of goods or services from such a provider. (18 U.S.C. § 2710(a)(1).)
Personally identifiable information includes information that identifies a person as having requested or obtained specific video materials or services. (18 U.S.C. § 2710(a)(3).)

Every one of those phrases is disputed when the defendant is an ordinary website.

Where website claims are weakest

The provider question. A streaming service is plainly in the business of delivering video. A retailer, a clinic, or a software company that posts marketing clips can argue that it is not, because video is not what it sells.

The consumer question. A casual visitor is not obviously a renter, purchaser, or subscriber. Federal appellate courts outside the Ninth Circuit have split on whether signing up for something other than video, such as an email newsletter, is enough. I treat this issue as unsettled.

The identification question. In the Ninth Circuit, personally identifiable information means only information that would readily permit an ordinary person to identify a specific individual's video-watching behavior. (Eichenberger v. ESPN, Inc. (9th Cir. 2017) 876 F.3d 979, 985.) A string of characters that only the pixel's owner can decode is a different thing from a name next to a title, and the defense presses that difference.

Knowledge and time. The disclosure must be knowing. Suit must be filed within two years from the act complained of or the date of discovery. (18 U.S.C. § 2710(c)(3).)

One defense does not come as easily as owners expect: standing. The Ninth Circuit held that a plaintiff need not allege harm beyond the disclosure itself. (Eichenberger, supra, 876 F.3d at pp. 983-984.) That holding is less secure now. In 2025 the court refused to treat every privacy-statute violation as a concrete injury, said Eichenberger's reasoning finds no support in later Supreme Court precedent, and left open how the Act should now be analyzed. (Popa v. Microsoft Corp. (9th Cir. 2025) 153 F.4th 784, 794-795.) A standing challenge may be worth making on the right facts.

Consent under the statute is not a cookie banner

Disclosure is allowed with the consumer's informed, written consent, which can be given electronically. The statute sets conditions. The consent must be in a form distinct and separate from any form setting out the consumer's other legal or financial obligations. It may be given in advance only for a set period of up to two years. The provider must also give a clear and conspicuous opportunity to withdraw. (18 U.S.C. § 2710(b)(2)(B).)

A general privacy policy or terms page was not built for that test. Whether your terms are enforceable at all, including any arbitration clause, is a separate question covered on our clickwrap and browsewrap page.

What is at stake

A court may award actual damages, but not less than liquidated damages of $2,500, plus punitive damages, reasonable attorneys' fees and costs, and equitable relief. (18 U.S.C. § 2710(c)(2).) The fixed figure is what gives a class complaint its weight. Our page on a business named in a class action explains how that pressure is managed.

The same letter often adds California wiretap theories under the California Invasion of Privacy Act. That statute sits in the Penal Code; our work is the civil defense. Owners who have also received ADA website demand letters will recognize the pattern of volume filings against small sites.

What to do, and what not to do

Document before you change anything. Record which tags fire on which pages, what each one transmits, and when each was installed. Then decide with counsel whether to remove or reconfigure the pixel on video pages.

Do not write back with an explanation of how your tracking works. That reply is evidence. The general steps are on our page about receiving a demand letter.

Send the letter to your insurance broker, because some cyber and general liability policies respond to privacy claims. See whether business insurance covers a lawsuit.

We test the claim against each definition, review the site's actual data flows with your developer, and respond. A federal claim like this one is usually litigated in federal court, which for our clients means the Central District of California in Santa Ana or Los Angeles. Our business litigation practice page describes our other defense work.

What to bring to the first meeting

The demand letter or complaint.
A list of the pixels, tags, and analytics tools on the site, with installation dates if known.
The pages that contain video, and who hosts the video player.
Your privacy policy, terms of use, and any cookie banner, in each version used.
Your business insurance policies.

Frequently asked questions

We got a letter saying the Meta pixel on our video pages violates the Video Privacy Protection Act. Is that a real claim?

It is a real federal statute with $2,500 in liquidated damages, and courts have allowed some pixel cases to proceed. Others have been dismissed, for example because the visitor was not a consumer under the statute. In the Ninth Circuit the data must also identify a person to an ordinary recipient, and whether the site is a video tape service provider at all is a further defense. Have the claim evaluated before you answer.

Our company sells products and only uses videos for marketing. Are we really a video tape service provider under the VPPA?

Possibly not. The Act reaches only a business whose trade is renting, selling, or delivering prerecorded video or similar audio visual materials. A company whose business is something else, and that uses video only to promote it, has an argument that it falls outside the definition. Courts decide the point on the facts of each site.

How much are VPPA damages?

The federal statute sets a floor: liquidated damages of $2,500 if actual damages are lower. A court may add punitive damages, reasonable attorneys' fees and litigation costs, and equitable relief. Plaintiffs in class actions seek the liquidated amount for each class member, which is why even small websites receive large demands under the Video Privacy Protection Act.

Does a cookie banner count as consent under the VPPA?

Usually it will not be enough standing alone. The federal statute requires informed, written consent in a form distinct and separate from other legal or financial terms. Advance consent can last no more than two years, and the consumer must have a clear way to withdraw. A banner or privacy policy written for general purposes rarely meets each condition.

What is the statute of limitations for a VPPA claim?

Two years. Under the federal Video Privacy Protection Act, no action may be brought unless it is begun within two years from the date of the act complained of or the date of discovery. For a website claim, the period usually depends on when the particular plaintiff's viewing was disclosed or discovered.

Talk to a California business litigation attorney

If your business has received a video privacy demand or complaint, call (909) 235-6116 or contact us online. Kolmogorov Law, P.C. is located at 327 Magnet, Irvine, CA 92618, and defends businesses in Orange County, Los Angeles, and throughout California.

This page provides general information about federal and California law and is not legal advice. Outcomes depend on the website, the facts, and the court.