How a 1988 Video Rental Statute Became a Website Tracking Problem

The Statute and Why It Exists

The Video Privacy Protection Act, 18 U.S.C. § 2710, was enacted in 1988 after a Washington newspaper obtained and published the video rental records of Judge Robert Bork during his Supreme Court confirmation hearings. Congress responded with a narrow statute aimed squarely at video rental stores.

The operative provision bars a video tape service provider from knowingly disclosing, to any person, personally identifiable information concerning any consumer of that provider. A video tape service provider is a person engaged in the business of rental, sale or delivery of prerecorded video cassette tapes or similar audio visual materials. A consumer is a renter, purchaser or subscriber of goods or services from such a provider. Personally identifiable information includes information identifying a person as having requested or obtained specific video materials or services.

Three phrases carry the statute far beyond 1988: “similar audio visual materials,” which courts have applied to streaming and embedded web video; “subscriber,” which has no definition in the statute; and the open-ended construction of personally identifiable information.

The Mechanism Behind Modern Claims

The typical claim does not involve a video service in the 1988 sense. It involves a website that hosts video content and also embeds a third-party analytics or advertising pixel. When a visitor watches a video, the pixel transmits information to the third party. Where that transmission includes both an identifier associated with the visitor and an indication of what was watched, plaintiffs argue the elements of a VPPA disclosure are met.

The damages provision is what makes the theory economically significant. The statute authorizes actual damages but not less than liquidated damages of $2,500, along with punitive damages, attorneys' fees and costs, and equitable relief. Aggregated across a visitor population, a per-person floor of that size produces exposure disconnected from any demonstrated harm.

The First Fault Line: Who Is a Subscriber

The statute defines consumer to include a subscriber of goods or services from a video tape service provider, but never defines subscriber. The dispute is whether someone who signs up for something other than video, typically an email newsletter, becomes a subscriber for VPPA purposes when the same site also offers video.

One reading treats the term broadly. On this view, subscribing to any goods or services from the provider is enough, and the statute's text does not require the subscription itself to be to video content. The provider is defined by its business; the consumer is defined by the relationship.

The competing reading ties the subscription to the audiovisual goods or services. On this view a newsletter subscriber who happens to watch a video is not a subscriber of video services, and reading the term otherwise would sweep in essentially every website that hosts video and collects an email address.

Appellate courts have divided on this question, and the division is not merely academic: it determines whether a very large category of ordinary websites falls within a criminal-adjacent privacy statute or outside it entirely. Several decisions have also examined whether the relationship must involve payment, and whether access to content behind a signup wall matters.

The Second Fault Line: What Counts as PII

The statute defines personally identifiable information to include information which identifies a person as having requested or obtained specific video materials or services. Courts have taken meaningfully different approaches to what satisfies this.

• An ordinary-person standard. Information is PII if it would readily permit an ordinary person to identify a specific individual's video-watching behavior. On this approach, an anonymized device or cookie identifier transmitted without more may fall outside the definition
• A broader identifiability approach. Information qualifies where it can be used, alone or in combination, to identify the person, taking account of the recipient's own capabilities and data holdings
• Focus on the recipient. Some analyses turn on what the receiving party can actually do with the transmitted values, which matters where the recipient operates a large identity graph

The practical difference is substantial. A pixel that transmits a hashed identifier alongside a video title may be a disclosure of PII under one standard and not under another, on identical facts.

The Consent Provision

The statute permits disclosure with the informed, written consent of the consumer, and sets form requirements for that consent. It must be in a form distinct and separate from any form setting out other legal or financial obligations, and it may be given in advance for a set period or until withdrawn, with a mechanism to withdraw available at any time.

Litigation has addressed whether consent buried in a general privacy policy or terms of service satisfies the distinct-and-separate requirement. The statutory text creates a higher bar than general-purpose acceptance of terms, which is the form most websites rely on.

Why the Split Persists

The disagreement is unusually durable because both readings have textual support. The statute defines consumer in relation to the provider rather than to the content, which favors the broad reading. It also defines the provider by its video business, which supports treating the subscription as video-related. Neither construction requires ignoring statutory language.

Congress amended the VPPA in 2012 to address consent mechanics for sharing on social platforms, and left the definitional terms untouched. That amendment is sometimes read as legislative acquiescence in the statute's application to online services, and sometimes as evidence that Congress addressed the online context narrowly without expanding the definitions.

The Standing Question Runs Alongside

Whether a VPPA plaintiff can sue in federal court at all is governed by Article III rather than by the statute. Under TransUnion LLC v. Ramirez (2021), a statutory violation alone does not automatically establish the concrete injury standing requires; the harm must bear a close relationship to one traditionally recognized as a basis for suit.

Disclosure of viewing history has generally fared better on this analysis than many other statutory privacy claims, because it maps onto the common-law tort of public disclosure of private facts. Courts have nonetheless divided on whether disclosure to a single commercial recipient, rather than to the public, satisfies that analogy. The question interacts with forum selection: a dismissal for lack of standing in federal court does not necessarily end the case, since state courts are not bound by Article III and may hear the claim.

How the Theory Is Contested

Defense arguments have clustered around the statutory elements rather than around policy. The threshold question is whether the defendant is a video tape service provider at all, which turns on whether delivering audiovisual material is part of its business rather than incidental to a site built for another purpose. A second line disputes the knowledge element, since the statute bars knowing disclosure and the operation of a third-party pixel may be configured by default rather than deliberately.

A third line contests whether what was transmitted identifies a person as having requested or obtained specific video materials, which requires linking an identifier to particular content rather than to general site activity. Arbitration clauses and class-action waivers in site terms have also determined the forum in a substantial share of cases, sometimes before any of the definitional questions are reached.

What Would Resolve It

Three paths could settle the question. The Supreme Court could resolve the split on the definition of subscriber. Congress could amend the definitions, which it has not done despite the volume of litigation. Or the practical importance could fade if consent mechanisms conforming to the statutory form requirements become standard, since disclosure with conforming consent is permitted regardless of how the definitional questions resolve.

Until one of those happens, whether the same conduct is lawful depends substantially on where the case is filed.

Frequently Asked Questions