Enacted in 1988, the Video Privacy Protection Act (VPPA) was intended to regulate the then-booming videotape industry by limiting how video rental and sales data is disclosed. The law was enacted in direct response to the publication of a Supreme Court nominee Robert Bork’s video rental history. Though videotapes may be a memory of the past, plaintiffs have revived the VPPA in a more current context: online video subscriptions and pixel tracking tools.

To file a VPPA claim, a plaintiff must show that a videotape service provider knowingly disclosed a consumer’s personally identifiable information. A business is a videotape service provider when it “engage[s] in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual material.” 

While the definition of a videotape service provider may seem antiquated and narrow, courts have broadly applied it. In 2024, a court held that a local newspaper was a videotape service provider because it delivers audio-video materials. Another court held that a video game store was a videotape service provider because its games included noninteractive cutscenes, mini-videos that interrupt gameplay and fill gaps in the game’s storyline or plot. Thus, both types of businesses were considered to fall under the VPPA.

Under the VPPA, a consumer is defined as “any renter, purchaser, or subscriber of goods and services from a video tape service provider.” Although there is inconsistency across circuits on what qualifies as a consumer in relation to video subscriptions, courts have held that subscriptions to a website that offers video content can make a plaintiff a subscriber, and therefore a consumer, under the VPPA.

On April 25, 2025, a plaintiff filed a class action lawsuit against a cinema chain, Tivoli Enterprises, for allegedly installing the Meta tracking pixel on its website to “secretly and surreptitiously” send consumers’ personal information to Meta.

The complaint asserts that Tivoli is a videotape service provider under the VPPA because it is a video streaming platform through which website users access video content. The complaint further alleges that when consumers watch a movie trailer on the Tivoli website, the company uses Meta Pixels to track and disclose various pieces of consumer data to Meta, including the movie title and consumer personal information.

According to the plaintiff, when a user visits the Tivoli website on the same web browser used to log into Facebook, the browser reportedly transmits a Meta-specific cookie called the “c_user” cookie to Meta. The complaint emphasizes that the c_user cookie enables anyone – not just Meta – to identify an individual consumer. If the c_user ID is tacked onto a Facebook URL, it will direct anyone to the Facebook account associated with that c_user cookie. For example, if a c_user ID is 050125, it can be tacked on at the end of a Facebook.com URL to bring anyone to the Facebook account and profile associated with the c_user ID 050125.

The plaintiff notes that while under the VPPA, informed, written consent allows a videotape service provider to disclose consumer personal information to a third party when signing up for a rewards account on the Tivoli website. Users allegedly were not asked to consent to Tivoli sharing their information with third parties.

The VPPA contains a unique consent requirement where written consent must be given in a separate form that is distinct and separate from other legal or financial agreements. This requirement might mean that even if a website’s privacy policy or terms of service obtain user consent for general website use, this consent is not covered under the VPPA’s definition and may not be an adequate defense in responding to such VPPA claims. Therefore, companies providing video content to website subscribers should consider obtaining separate user consent for disclosing consumer information to third parties related to that video content or eliminating tracking technology on such pages altogether.

In 2024, the Second Circuit stated that the VPPA is “no dinosaur statute.” Although Tivoli has yet to respond to the complaint, the prevalence of VPPA lawsuits like this one is a reminder that while videotape technology is obsolete, the VPPA is far from Jurassic. It stays alive with a new roar.