The Video Privacy Protection Act: What the Statute Actually Requires

A Statute Written for Video Stores

The Video Privacy Protection Act was signed on November 5, 1988 as Public Law 100-618, 102 Stat. 3195, originating as S. 2361. Its full title states the purpose plainly: to amend title 18 of the United States Code “to preserve personal privacy with respect to the rental, purchase, or delivery of video tapes or similar audio visual materials.”

The enacting text did two mechanical things. It redesignated the existing section 2710 of title 18 as section 2711, and inserted a new section 2710 immediately after section 2709. That placement matters more than it looks: it seats the video privacy rules inside chapter 121, the same chapter that houses the stored communications provisions, rather than in a consumer protection title administered by an agency.

The consequence is structural. There is no rulemaking authority under the Act, no agency guidance interpreting it, and no administrative enforcement track. Everything the statute means has been worked out by federal courts deciding private suits, which is why its interpretive record is a patchwork of district and appellate decisions rather than a body of regulation.

The Four Definitions That Set the Perimeter

Section 2710(a) defines four terms, and every dispute about the Act's reach is a dispute about one of them.

• Consumer — “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” The word subscriber is used but never itself defined.
• Ordinary course of business — “only debt collection activities, order fulfillment, request processing, and the transfer of ownership.” The word only is in the statute; this is a closed list, not an illustration.
• Personally identifiable information — “includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider.” The verb is includes, which makes the definition a floor rather than a ceiling.
• Video tape service provider — “any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials,” plus any recipient of a disclosure made under subparagraph (D) or (E), but only as to the information in that disclosure.

That last clause is easy to miss. A marketing vendor that receives a permitted names-and-addresses disclosure becomes a video tape service provider itself, bounded to the data it received. The Act follows the record rather than staying with the original business.

What 'Engaged in the Business' Excludes

The Ninth Circuit took up the outer edge of the provider definition in Osheske v. Silver Cinemas Acquisition Co., No. 23-3882, decided March 27, 2025. A patron bought a ticket on the website of the Landmark Theaters chain; the site transmitted the film's name, the location of the showing, and the patron's Facebook identification number to Facebook. The question was whether selling tickets to an in-person screening put the theater inside the Act.

Writing for the panel, Judge McKeown held it did not. The reasoning turned on grammar rather than on privacy policy: the words “rental, sale, or delivery” all attach to the same object, “prerecorded video cassette tapes or similar audio visual materials,” so the broad dictionary senses of deliver are narrowed by the company the word keeps. The panel invoked noscitur a sociis as stated in Gustafson v. Alloyd Co., 513 U.S. 561, 575 (1995), to avoid reading one word so broadly that it becomes inconsistent with its neighbours.

Simply put, there has not been a transaction involving an exchange of video materials that qualifies as a “rental, sale, or delivery.”

Osheske v. Silver Cinemas Acquisition Co., No. 23-3882 (9th Cir. Mar. 27, 2025)

The opinion added a historical check. Quoting S. Rep. No. 100-599, at 5–7 (1988), it observed that the senators' concern ran to the “home,” the “living room,” and settings of “quiet[] and reflection” — and that theatres, plainly a going concern in 1988, were left out of both the Act and the report. A footnote expressly reserved the digital question, citing Mollett v. Netflix, Inc., 795 F.3d 1062, 1066–67 (9th Cir. 2015) and Eichenberger v. ESPN, Inc., 876 F.3d 979, 984–86 (9th Cir. 2017) as decisions leaving open whether temporary or permanent exchange of digital audio visual materials falls inside the Act.

The Prohibition, and the Six Ways Around It

Subsection (b)(1) is the operative bar: a video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of that provider is liable for the relief in the civil action subsection. Knowledge is an element, not a presumption.

Subsection (b)(2) then permits six disclosures. They are worth reading as a set, because five of them are rarely litigated and the sixth carries almost the entire modern docket.

Subparagraph (C) carries its own procedural apparatus in subsection (b)(3). A court order authorising a law enforcement disclosure issues only with prior notice to the consumer and only on a showing of probable cause that the records are relevant to a legitimate law enforcement inquiry. Where a state authority seeks the order, it may not issue if the law of that state prohibits it. The provider may move promptly to quash or modify where the request is unreasonably voluminous or compliance would be an unreasonable burden. Where an order issues under (C) or (F), the court is directed to impose appropriate safeguards against unauthorised disclosure.

The Consent Form Congress Rewrote in 2013

The original 1988 text permitted disclosure “to any person with the informed, written consent of the consumer given at the time the disclosure is sought” — a one-transaction, one-signature model built for a shop counter. Public Law 112-258, the Video Privacy Protection Act Amendments Act of 2012, struck that subparagraph outright and replaced it. The bill was H.R. 6671, passed the House on December 18 and the Senate on December 20, 2012, and was approved January 10, 2013 at 126 Stat. 2414.

The replacement permits disclosure with informed, written consent “(including through an electronic means using the Internet)” that satisfies three conditions simultaneously:

1. It is in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer.
2. At the consumer's election, it is given either at the time the disclosure is sought, or in advance for a set period not to exceed two years or until withdrawn, whichever is sooner.
3. The provider has furnished an opportunity, in a clear and conspicuous manner, to withdraw on a case-by-case basis or from ongoing disclosures, at the consumer's election.

Two features of that structure are frequently understated. The election between one-time and standing consent belongs to the consumer by the statute's terms, not to the provider. And the two-year ceiling is absolute rather than a default — standing consent expires by operation of the text whether or not anyone withdraws it.

The Destruction Duty and Why Nobody Sues on It

Subsection (e) requires a person subject to the section to destroy personally identifiable information “as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected,” provided no requests or orders for access are pending. It is the only affirmative data-handling obligation the Act imposes, and it is essentially absent from the case reports.

Sterk v. Redbox Automated Retail, LLC, No. 12-8002 (7th Cir. Mar. 6, 2012), explains why. Judge Posner, taking an interlocutory appeal under 28 U.S.C. 1292(b) from the Northern District of Illinois, held that the civil action created by subsection (c) reaches only the disclosure prohibition in subsection (b), not the destruction duty in (e) or the evidentiary rule in (d). Placement was the first clue — subsection (c) follows the disclosure prohibition rather than all of them — and subsection (b)(1) is the only prohibition that expressly says a violator “shall be liable… for the relief provided.”

The opinion is unusually candid that the drafting is poor. It notes that subsection (b)(1) as enacted cross-references subsection (d), which provides no relief at all, and concludes this “must be an error.” On the merits it reasoned that damages for late destruction would be odd where nothing was ever disclosed, since liquidated damages are meant as an estimate of actual damages and the estimate here would be zero. The panel agreed with the Sixth Circuit's earlier reading in Daniel v. Cantrell, 375 F.3d 377, 384–85 (6th Cir. 2004).

So the destruction duty stands in the statute with no private damages remedy attached to it, and no agency positioned to enforce it either.

Remedies, Timing, and the Evidentiary Bar

Subsection (c) permits any aggrieved person to sue in a United States district court. The court may award actual damages but not less than liquidated damages of $2,500; punitive damages; reasonable attorneys' fees and litigation costs; and such preliminary and equitable relief as it determines appropriate. The action must begin within two years from the date of the act complained of or the date of discovery — a discovery formulation that matters where transmissions were invisible to the consumer. Subsection (c)(4) states that no liability results from a lawful disclosure permitted by the section.

Subsection (d) is a distinct rule that gets far less attention. Personally identifiable information obtained in any manner other than as the section provides “shall not be received in evidence” in any trial, hearing, arbitration, or proceeding before any court, grand jury, department, officer, agency, regulatory body, legislative committee, or other authority of the United States, a state, or a political subdivision. It is an exclusionary rule reaching well beyond criminal proceedings, and it operates whether or not anyone brings a civil claim.

Preemption Runs Only One Way

Subsection (f) is a single sentence and an unusual one: the section's provisions “preempt only the provisions of State or local law that require disclosure prohibited by this section.” A state law that compels a disclosure the VPPA forbids gives way. A state law that goes further than the VPPA — more categories of protected record, a different consent standard, a longer limitations period — is untouched by this text.

The practical effect is that state video-privacy statutes operate alongside the federal Act rather than beneath it, and a single transmission can support claims under both. Any given state analogue turns on its own text, and this guide does not chart them; the statutes vary in what they cover and in whether they create a private action at all.

What the Act Does Not Do

Reading section 2710 for what is absent is as informative as reading it for what is present. The Act regulates one verb — disclose — and almost nothing else about the handling of the records it protects.

• No limit on collection. Nothing in the text restricts what viewing information a provider may gather about a consumer, how granular it may be, or how long it may be held while it remains necessary for its purpose.
• No data security standard. There is no requirement to encrypt, restrict access to, or otherwise safeguard the records, and no counterpart to the administrative, physical, and technical safeguards found in sectoral security rules.
• No breach notification duty. A provider whose viewing records are exfiltrated by a third party has disclosed nothing knowingly, and the Act imposes no obligation to tell anyone.
• No consumer access, correction, or deletion rights. The consumer's only affirmative levers are the withdrawal mechanism attached to consent and the opportunity to prohibit a names-and-addresses disclosure.
• No exemption for de-identified or aggregate data, and equally no definition of it — the perimeter is drawn entirely by whether information identifies a person as having requested or obtained specific video materials.

The names-and-addresses provision in subparagraph (D) is the clearest illustration of how narrowly Congress drew the permissions. A provider may release names and addresses without consent, but only after giving the consumer a clear and conspicuous opportunity to prohibit it, and only if the release does not identify the title, description, or subject matter of any material. Subject matter alone may be included, and then only where the disclosure is for the exclusive use of marketing goods and services directly to that consumer. The 1988 drafters were legislating about mailing lists, and the text still reads that way.

Because subsection (a)(4) sweeps a recipient of a (D) or (E) disclosure into the provider definition as to the information received, the restriction travels with the data. A list broker who receives names and addresses under subparagraph (D) becomes subject to the same prohibition for that list, which is a chain-of-custody design rarely found in statutes of this vintage.

Where the Statute Sits Among Tracking Claims

The VPPA now appears in complaints that have nothing to do with video rental, because three of its features combine unusually well: a per-violation liquidated damages floor that does not require proof of loss, a definition of protected information that is expressly non-exhaustive, and a provider definition keyed to a line of business rather than to a technology. What it does not have is an agency, a safe harbour for good-faith compliance, or a cure period.

Two questions that recur in this litigation are treated separately on this site rather than here, because both are genuinely unsettled rather than merely technical: what makes someone a subscriber when the subscription is to something other than video, and what identifiers satisfy the personally-identifiable-information definition. Those fault lines are covered in our analysis of the pixel litigation split.

Frequently Asked Questions