Compliance · VPPA
VPPA compliance for websites with video
VPPA compliance means a website that serves video doesn't disclose what identifiable people watched to third parties without proper consent, because the Video Privacy Protection Act (18 U.S.C. § 2710) sets statutory damages at $2,500 per person. In practice the violation is an advertising pixel on video pages sending title-level viewing data to an ad platform. Complidar detects exactly that combination: video players and the trackers firing alongside them.
A 1988 statute, revived by the tracking pixel
The VPPA was written for video-store rental records, but its text (a 'video tape service provider' disclosing 'personally identifiable information' about viewing) maps cleanly onto a modern pattern: a site with video content running a Meta Pixel or similar tracker that transmits the video title together with an identifier. Courts have let those claims proceed, and the definition of who counts as a 'consumer' has broadened (the Second Circuit's Salazar decision extended it to newsletter subscribers, widening the plaintiff pool).
The settlements are the proof of life: Markels v. AARP resolved for $12.5M over the Meta Pixel on AARP.org video pages; Tubi paid $19.99M. The per-person $2,500 statutory figure is what makes even mid-sized audiences uninsurable math.
Who should care (it's not just streaming services)
Any site that serves video and runs ad-platform trackers is in the pattern: course creators and membership sites, gyms posting workout libraries, dental practices with procedure-explainer videos, ecommerce stores with product videos, local news and content sites. The claim doesn't require selling video: courts have focused on whether video delivery is a meaningful part of what the site offers, and plaintiff firms read that broadly when the pixel data is clean.
Valid consent under the VPPA is specific: a standalone consent to the disclosure of viewing information, distinct from the general privacy policy. The standard cookie banner does not meet it.
What Complidar checks for VPPA
- Video players detected across up to 120 pages (embedded and native)
- Ad-platform pixels (Meta and peers) firing on pages that serve video
- Whether the tracker payload carries page/video identifiers alongside user identifiers
- Consent flow analysis: is there any VPPA-grade consent, or only a generic banner
- Privacy-policy language about viewing-data disclosure, checked against observed behavior
- Jurisdiction tagging with the comparable settlements (AARP, Tubi and peers) attached
Honest limits: A scan observes what trackers transmit from public video pages. It cannot see server-side conversions APIs or your ad-platform configuration. A clean page-level scan with server-side sharing still configured is a residual risk the report flags as out of scan scope; Complidar's server-side-tracking check covers the observable indicators.
VPPA questions
We just have a few product videos. Can the VPPA really apply?
The exposure question is less about video volume and more about the data: if an ad pixel transmits which video a known person watched, the statutory elements plaintiffs plead are present. Courts are still drawing the 'video tape service provider' line, but at $2,500 per person, defendants rarely choose to be the test case. The scan shows whether the data pattern exists on your pages at all.
Does removing the Meta Pixel from video pages fix it?
Scoping ad pixels off video pages, or stripping title-level data from what they send, removes the core fact pattern for future visitors. Past transmission is a counsel conversation. Either way the first step is knowing which pages currently leak viewing data, which is what the scan maps.
What's the difference between a VPPA claim and a session-replay claim?
Both are privacy theories about website tracking, but the VPPA is about disclosing *what someone watched* to a third party ($2,500 statutory per person), while session-replay claims are wiretap theories about *recording the visit itself*. Sites with video and replay tooling can face both. They're separate checks in a Complidar scan.
VPPA is 1 of the 22 checks in every scan · up to 120 pages · no card
Last updated 2026-06-11 · Informational, not legal advice: how to read this