United StatesVideo Privacy Protection Act
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Consent, Disclosure, Retention
- Audit expectation
- none
What it requires
- Obtain the consumer's informed, written consent before disclosing personally identifiable information about the consumer's video-viewing history to a third party.
These lines are LexLint's reading of the law's text. Also read by: Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Statutory damages
18 U.S.C. 2710(c)(2)(A): liquidated damages of not less than $2,500 per person, a floor rather than a fixed sum since actual damages control if greater, plus punitive damages and reasonable attorneys' fees and litigation costs under subparagraphs (B) and (C). No civil penalty runs to a regulator; the statute's only monetary remedy is this private one.
- As of
- Currency
- USD
- Per person minimum
- 2,500
Who enforces it
Enforcement body
No federal or state regulator enforces the Video Privacy Protection Act; it is enforced exclusively through private civil actions under 18 U.S.C. 2710(c).
Settledness
The Supreme Court heard argument on in Salazar v. Paramount Global, No. 25-459, which asks that question.
- As of
- Case link
- https://www.govinfo.gov/content/pkg/USCOURTS-ca6-23-05748/pdf/USCOURTS-ca6-23-05748-0.pdf
- Case citation
- Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025)
- Open questions
- Does the phrase "goods or services from a video tape service provider" in the definition of "consumer" in 18 U.S.C. 2710(a)(1) refer to all of a provider's goods or services or only to its audiovisual goods or services?
What it makes you log
Logging duty
Section 2710 bars a video tape service provider from knowingly disclosing a consumer's personally identifiable information except as subsection (b) allows. It carries no duty to make, keep or produce a log or record. Subsection (e) requires destruction of personally identifiable information no later than one year after it is no longer necessary for its purpose; that limits how long the personal data is kept and is not a duty to keep a record, so no retention period is recorded. The Act reaches providers engaged in business in or affecting interstate or foreign commerce, which is not a territorial hook.
- Kind
- None
- As of
What this law does
Prohibits a video tape service provider from knowingly disclosing a consumer's personally identifiable information about video-viewing history to a third party without informed, written consent, and arms an aggrieved consumer with a private right of action for statutory damages of at least $2,500, punitive damages, and attorneys' fees.
A 2013 amendment allowed ongoing consent through an electronic means, enabling social-media sharing features; the statute has driven a large wave of litigation since 2022 over website tracking-pixel disclosures of video-viewing activity.
How courts have read itPremium data
Our analysis of this law draws on 13 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app tracks devices or reuses other publishers' content.
Back to the example · Lint your app
Page updated .