ver the past few years, companies have been hit by a wave of hundreds of putative class actions—and untold numbers of threatened mass arbitrations—alleging that use of pixel tracking tools violates the Video Privacy Protection Act ("VPPA"). In the first few months of 2025, that trend continued due to (among other things) the ever-growing use of pixels and similar technology and the Second Circuit's recent decision in Salazar v. National Basketball Ass'n,1 which gives an expansive reading to the statute. In fact, as of March 1, 2025, at least twenty-eight VPPA cases have already been filed. This trend parallels the filing rates in recent years, during which around two hundred cases were filed annually.
The Sixth Circuit, however, just rejected the Second Circuit's reading in Salazar v. Paramount Global,2 a highly similar case involving the same plaintiff. The second Salazar case (which we refer to as Paramount for clarity) creates a circuit split on who is a "consumer" of "goods and services" under the statute—which is notable because a petition for certiorari has already been filed seeking review of the Second Circuit's decision.
In light of these recent and significant developments, companies with an online presence should be aware of the contours of the VPPA, trends in VPPA litigation, and various defenses and arguments available to them.
The VPPA
Congress enacted the VPPA in 1988 in response to a newspaper's disclosure of VHS tapes that then–Supreme Court nominee Judge Robert Bork rented from a local video rental store. The statute forbids disclosing certain data about consumers' video viewing habits, along with identifying information, without their consent.
Specifically, the VPPA prohibits "video tape service provider[s]" from "knowingly disclos[ing]" consumers' "personally identifiable information" ("PII") to third parties.3 Under the Act, PII is "information which identifies a person as having requested or obtained specific video materials or services."4 The statute defines a "video tape service provider" as any entity "engaged in the business . . . of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials."5 Significantly, the VPPA contains a private right of action and authorizes recovery of "actual damages but not less than liquidated damages in an amount of $2,500" per violation, punitive damages, attorneys' fees and costs, and other equitable relief.6
Pixel Litigation and the Salazar Decisions involving the NBA and Paramount
The recent influx of VPPA lawsuits and mass arbitrations can be attributed to the coalescence of two phenomena: (1) the ever-increasing use of pixel technology and (2) the growing number of courts, such as the Second Circuit in Salazar, giving key terms in the VPPA a broad reading. But time—and perhaps the U.S. Supreme Court—will tell whether the Sixth Circuit's April 2025 decision in Paramount represents a turning of the tide in which courts begin to rein in VPPA claims.
A. The Prevalence of Pixels
VPPA lawsuits initially focused on companies' use of Meta's Pixel tool, a piece of code embedded in a website's HTML. The code sends Meta information about what visitors do on the website, which enables the website operator to understand the effectiveness of its ad campaigns on Meta and other website user behaviors. What information it sends depends on how the website configures the Pixel. The use of Meta's Pixel tool is widespread and spans a number of industries: according to a March 2024 report, about 47 percent of websites use Meta Pixel, including 55 percent of those in the S&P 500, 58 percent in the retail industry, 42 percent in finance, and 33 percent in health care.7 Other social media companies, including X (formerly Twitter), now offer tracking pixels, too.[8]
Plaintiffs contend that VPPA liability can arise when a pixel is set up to share with a third party (1) information about a prerecorded video that a user watches on a company's website (such as the title of the video); and (2) information that could be used to identify that user. This use of pixels has drawn plaintiffs' lawyers like a moth to the flame, in large part because of the VPPA's private right of action and potential for massive statutory damages if a class is certified.
B. The Salazar Decisions
The Second Circuit's decision in Salazar has further accelerated this trend. Plaintiff Michael Salazar brought a lawsuit against an entity one wouldn't naturally think of as a "video tape service provider": the National Basketball Association.9 Salazar had signed up for the NBA's newsletter by providing the company his email address.10 He then visited the NBA's website and watched basketball videos.11 Based on these unexceptional facts, Salazar alleged that the NBA violated the VPPA.12 Why? Because the NBA's website used the Meta Pixel, he alleged, some of his personal information—his Facebook ID and information about the videos he watched—was sent to Meta without his consent.13
Salazar's complaint was initially dismissed.14 The district court held that the VPPA required him to offer plausible allegations that (1) the NBA newsletter was a "good or service" within the meaning of the VPPA and that (2) he was a "consumer" of that good or service. He also needed to allege facts demonstrating that he has standing under Article III of the U.S. Constitution, which, among other things, requires that he allege suffering a "concrete" injury. The district court agreed that Salazar had standing to sue, but it dismissed the claim on the merits because it determined that Salazar was not a "consumer" within the meaning of the VPPA.
The Second Circuit reversed, holding that Salazar was a "consumer" under the statute.15 The VPPA defines "consumer" to mean "any renter, purchaser, or subscriber of goods or services from a video tape service provider."16 The NBA asserted that the online newsletter Salazar signed up for was not a "good or service" within the meaning of the Act, because it was not an audiovisual good or service—a qualifier that the NBA argued was consistent with the statute's requirement that the "goods or services" must come "from a video tape service provider."17 But the Second Circuit rejected this limitation of the statutory language, holding that any consumers—even those who receive non-audiovisual goods from the video tape service provider—are covered by the statute.18 Plaintiffs are already relying on this aspect of Salazar in bringing lawsuits involving "goods and services" provided by a whole host of industries, ranging from education to sports betting.19
The Second Circuit also rejected the NBA's challenge to Salazar's standing. The NBA pointed out that any information about Salazar was not disclosed to the public but instead directed to one private company (Meta), and accordingly the nature of the disclosure was insufficient to count as the kind of "harm 'traditionally recognized as providing a basis for lawsuits in American courts'"—the test under Supreme Court precedent for whether an alleged harm constitutes a "concrete injury" for Article III purposes.20 The court of appeals rejected this argument, holding that Salazar had standing because his "alleged injury stems from the unauthorized disclosure of his personal viewing information, which is closely related to at least one common-law analog . . . [the] public disclosure of private facts."21 In holding that disclosure to one company alone is enough, the court found it significant that Meta is a major company that uses the information for advertising, and that (according to the complaint) did not have any restrictions on its selling, disclosing, or otherwise using the data.22
Despite describing its holding as "narrow," the Second Circuit's decision in Salazar has already had a significant impact in this area.23 In the Ninth Circuit, where the court of appeals has not yet reached the issues presented in Salazar, a district court in the Southern District of California has already denied a motion to dismiss a claim by a plaintiff suing Zillow for its use of pixels, relying on Salazar's reasoning.24 In the Second Circuit, courts have quickly made rulings following Salazar's lead.25 In the Eighth and D.C. Circuits—where appeals concerning interpretation of the VPPA are pending—litigants have cited to Salazar in an effort to persuade those courts.26
On March 14, 2025, the NBA filed a petition for certiorari seeking Supreme Court review of the Second Circuit's decision.27 In its petition, the NBA argues that the Second Circuit's decision created not one but two circuit splits. First, it asserts that the Second Circuit split from the Third, Seventh, Tenth, and Eleventh in holding that a consumer suffers concrete harm when one business discloses the consumer's personal information to another, even if that information is never disclosed to the public. Second, it argues that the Second Circuit's ruling on the VPPA definition of "consumer" creates a circuit split because the Sixth, Seventh, and D.C. Circuits are considering the same issue on appeal and are "likely to reject" the Second Circuit's broad interpretation.28
The NBA's prediction was correct as to the Sixth Circuit: on April 3, 2025, that court issued a ruling in Paramount (its own case involving Salazar), opting for a narrower reading of the statute. In that case, the same plaintiff sued Paramount Global under the VPPA, asserting that a website owned by the defendant disclosed his video viewing history and Facebook ID without his consent.29 As in his case against the NBA, Salazar asserted that he was a "consumer" because he became a "subscriber" to the website when he signed up for its online newsletter.30 A federal court in Tennessee disagreed, holding that the definition of "subscriber" is "cabined by the definition of 'video tape service provider.'"31] Thus, the district court concluded, "to qualify as a 'consumer,' a 'plaintiff must be a subscriber of goods...
