The Supreme Court just agreed to hear a case about a 1988 law written for VHS rental stores. If you run a website with video content, this could determine whether you're facing a class action lawsuit.

Welcome to the Video Privacy Protection Act—the sleeper legal issue that's been quietly generating lawsuits against startups for years.

The Backstory

In 1988, a reporter obtained Robert Bork's video rental history during his Supreme Court nomination. Congress was outraged (because Congress) and passed the Video Privacy Protection Act (VPPA), making it illegal for "video tape service providers" to disclose "personally identifiable information" about their customers' viewing habits.

The law was written for Blockbuster. It now applies to your React app.

The Legal Mess

Here's what's happening in the courts. Plaintiffs' attorneys have figured out that modern websites technically qualify as "video tape service providers" if they host video content. Every time your site uses tracking pixels, cookies, or analytics that capture what videos users watch and shares that with third parties (hello, Meta Pixel), you may be violating a law written when "streaming" meant a creek behind your house.

The circuit courts are split on a key question: who qualifies as a "consumer" protected by the VPPA? The law says consumers must "rent, purchase, or subscribe to goods or services." But what counts?

The Sixth Circuit (now before the Supreme Court) says you have to subscribe to audiovisual content specifically. Just signing up for a newsletter doesn't make you a VPPA-protected consumer, even if you then watch videos on the site.

The Second and Seventh Circuits disagree. They say subscribing to any service from a video provider makes you a consumer—newsletter, free account, whatever. Under that interpretation, basically every website visitor with an account is protected.

Why This Matters for Startups

The VPPA has a private right of action with statutory damages of $2,500 per violation. Per violation means per user whose data was disclosed. Do the math on your user base.

Class action attorneys have been filing these suits aggressively. Targets include major media companies (Paramount, NBA), but also smaller companies that happen to have video content and use standard analytics tools.

If the Supreme Court rules broadly—that any website subscriber who watches videos is a protected consumer—the litigation floodgates open further. If they rule narrowly, it becomes much harder to bring these suits.

The Tracking Pixel Problem

Here's the technical issue: most websites use tracking pixels from Meta, Google, or other ad platforms. These pixels fire on page views, including video page views. They transmit identifiers that can be linked to individuals. That transmission—pixel fire to ad platform—is arguably a "disclosure" of viewing information under the VPPA.

You probably have this on your site. Your marketing team probably added it. They probably didn't check with legal, because why would cookie pixels be a federal privacy violation?

But they might be. And at $2,500 per user, "might be" is a problem.

What Founders Should Do

Audit your video content and tracking. Do you host videos? Do you use tracking pixels that fire on video pages? If yes to both, you have exposure.

Check your consent flows. The VPPA allows disclosure with consumer consent. But the consent has to be specific—users need to know their video viewing information will be shared. A generic privacy policy probably doesn't cut it.

Consider whether you need those pixels on video pages. You can exclude video content from tracking pixel fires. You lose some analytics granularity but eliminate the legal risk.

Watch the Supreme Court case. Salazar v. Paramount Global will be argued this term. The decision will clarify who counts as a consumer and therefore who can sue. A narrow ruling reduces your risk; a broad ruling increases it.

The Bigger Picture

The VPPA is a symptom of a larger problem: American privacy law is a patchwork of old statutes applied to new technologies. We don't have comprehensive federal privacy legislation, so courts stretch laws like the VPPA to fill gaps.

For founders, this creates uncertainty. You can build a product that's totally normal by industry standards—using common analytics tools, implementing standard tracking—and still face federal liability under a law written before the internet existed.

The solution isn't to stop using analytics. It's to build with legal risk in mind. That means:

1. Actually read your privacy policy and make sure it covers what you're doing
2. Implement consent mechanisms that are specific, not generic
3. Be thoughtful about what data you share with third parties, especially viewing data
4. Have a lawyer who understands tech privacy review your setup

The VPPA has been generating lawsuits for years. The Supreme Court taking the case suggests they want to resolve the circuit split. One way or another, we'll have more clarity soon. But until then, the risk is real.

The Irony

Robert Bork was nominated to the Supreme Court. His video rental records were exposed. Congress passed a law. Now the Supreme Court will interpret that law.

Meanwhile, every website in America shares more data about users than Bork's rental store ever could. The law hasn't kept up. It probably never will. Build accordingly.