VPPA and Health Websites: Video Pages, Pixels and Salazar

The VPPA can apply to a health website when the site counts as a "video tape service provider" and knowingly discloses which videos an identified person watched, for example to an ad platform through a pixel, and the Supreme Court is now deciding who counts as a protected "consumer" in a case argued October 14, 2026 (statute; docket). That case is Salazar v. Paramount Global, and the docket lists no decision yet. Curve Compliance helps health sites control what video pages send to ad platforms: it replaces browser ad pixels with one script, sends each platform a fixed list of fields with neutral event names, and signs a BAA on every plan.

Book a call. Not sure which pixels fire on your video pages? Curve's free website scan lists them, and Curve Compliance's team can review what your site sends to Meta, Google and TikTok with you. Book a call with Curve.

What the VPPA says

The Video Privacy Protection Act is 18 U.S.C. 2710, enacted in 1988 (Pub. L. 100-618) and amended in 2013 (govinfo). Its key terms:

Term	What 18 U.S.C. 2710 says
Consumer	"any renter, purchaser, or subscriber of goods or services from a video tape service provider" ((a)(1))
Personally identifiable information	"includes information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider" ((a)(3))
Video tape service provider	"any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials" ((a)(4))
Liability	A provider "who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person" ((b)(1))
Ordinary course of business	An exception, defined as "only debt collection activities, order fulfillment, request processing, and the transfer of ownership" ((a)(2))
Damages	"actual damages but not less than liquidated damages in an amount of $2,500," plus "punitive damages" and "reasonable attorneys' fees" ((c)(2))

Suits must be "begun within 2 years from the date of the act complained of or the date of discovery" ((c)(3)). The VPPA is separate from HIPAA. A clinic's video page can raise both, and each has its own rules.

What Salazar v. Paramount Global asks

The case came from the Sixth Circuit, which decided it on April 3, 2025. The Supreme Court granted review on January 26, 2026 and heard argument on October 14, 2026 (docket). The question presented asks whether "goods or services from a video tape service provider," in the definition of consumer, "refers to all of a video tape service provider's goods or services or only to its audiovisual goods or services" (question presented).

The question presented, as posted on the docket, describes the facts this way: "Michael Salazar subscribed to Paramount's online newsletter, which he used to view videos. Paramount then disclosed Mr. Salazar's Facebook ID and his video-watching history to Facebook." It also says Paramount is a video tape service provider and "Both courts below assumed as much," so that question is not the one before the Court (question presented).

What happened at argument

For Salazar, Joshua Hammack said "Paramount Global systematically discloses personally identifiable information to Facebook without obtaining consent," and that the disclosures "happen constantly, instantly, every time someone, including a consumer, watches a video on the website." For Paramount, Paul Clement said "the plaintiffs' class action bar discovered the VPPA and its statutory and punitive damages," and that the relevant goods or services "are the prerecorded video cassette tapes or similar audiovisual materials that one could rent, purchase, subscribe to" (transcript). The transcript is marked "Official - Subject to Final Review." Meta Platforms filed an amicus brief in the case (docket).

Justice Kavanaugh raised the reach of these suits. He referred to concerns about "every business in America that has video on its website being targeted," and said amicus briefs point out that suits have been "brought against every sector of the economy," listing "health and fitness websites" among them (transcript).

Why health and wellness sites come up

If your site hosts procedure videos, patient stories or telehealth explainers, and those pages also load ad pixels, your setup resembles the pattern in the question presented: a platform ID and video-watching history sent to a social platform (question presented). Whether a clinic site is a "video tape service provider" at all is a separate question that the Court is not deciding here. Clinic pages that also collect health details, such as booking or intake steps, raise HIPAA questions apart from the VPPA; see how to remove the Meta pixel from a healthcare website and what YouTube and Google Maps embeds track.

Consent under the VPPA

The statute allows a disclosure "to any person with the informed, written consent (including through an electronic means using the Internet) of the consumer." That consent must be "in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer," given "at the time the disclosure is sought" or "in advance for a set period of time, not to exceed 2 years or until consent is withdrawn by the consumer, whichever is sooner," with a chance to withdraw offered "in a clear and conspicuous manner" ((b)(2)(B)). Whether your consent flow, including any cookie banner, meets this standard is a legal question, so talk to your counsel before relying on it.

What to check on video pages

• Which tags load. Run Curve's free website scan on each page with video, or follow how to check which trackers a site loads.
• What the page tells a platform. Look at page URLs, titles and event names. If one of them names the video, whatever receives it can tell what was watched.
• Embedded players. Treat a third-party video player as another tag on the page; see the embeds guide.
• Where consent is asked and recorded. Compare it with the (b)(2)(B) conditions above.
• Health details on the same page. If the page also has a booking or intake step, HIPAA questions apply on top; see what a tracking pixel is.

When to expect a decision

The docket lists "Argued." on October 14, 2026 and shows no decision or decision date (docket 25-459). For other dated changes, see the 2027 compliance calendar; for California's related wiretap law, see the SB 690 guide.

How Curve Compliance helps

Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, and events can use neutral names, so a conversion event does not need to carry a video title. Curve checks every event for PHI-like patterns, such as condition names or emails in URLs, and strips PHI before data reaches an ad platform. Consent management records every visitor decision.

Curve signs a BAA on every plan and is SOC 2 Type II. Curve's team does the setup, typically live in about a week, and Event Logs show what Curve sent to each platform and what the platform accepted.

Sources, checked October 26, 2026: 18 U.S.C. 2710, United States Code, 2024 Edition (govinfo); Supreme Court docket 25-459; Salazar v. Paramount Global, question presented; oral argument transcript, October 14, 2026.

Frequently Asked Questions

What is the VPPA?

The Video Privacy Protection Act, 18 U.S.C. 2710, makes a video tape service provider liable when it knowingly discloses information that identifies a person as having requested or obtained specific videos (govinfo). It dates from 1988 and was amended in 2013.

Does the VPPA apply to health websites?

It can, when the site counts as a video tape service provider and knowingly discloses which videos an identified person watched (statute). At the Salazar argument, Justice Kavanaugh cited amicus briefs listing "health and fitness websites" among the sectors sued (transcript).

What was Salazar v. Paramount about?

Salazar says Paramount disclosed his "Facebook ID and his video-watching history to Facebook" after he subscribed to its newsletter. The Court is deciding whether the consumer definition covers subscribers to any of a provider's goods or services, or only its audiovisual ones (question presented).

When will the Supreme Court decide Salazar?

The docket gives no date. It lists the case as "Argued." on October 14, 2026, with no decision yet (docket).

Does consent remove VPPA risk?

The statute permits disclosure with "informed, written consent" that is separate from other terms, limited in time when given in advance, and paired with a clear way to withdraw ((b)(2)(B)). Whether a site's consent flow meets those conditions is a legal question.

Is a Meta Pixel on a video page a VPPA issue?

It is the pattern in Salazar, where the question presented describes a "Facebook ID" and "video-watching history" sent to Facebook (question presented). Liability turns on whether the site is a video tape service provider and the viewer a consumer.

How can Curve Compliance help with video pages?

Curve Compliance replaces browser pixels with server-side delivery, sends each ad platform a fixed list of fields with neutral event names, and strips PHI before data reaches an ad platform. Its free website scan lists the pixels on a page, and Curve signs a BAA on every plan.

Talk to Curve Compliance

Book a call. See exactly what your video pages send to Meta, Google and TikTok, and move to server-side conversions with a fixed list of fields. Curve Compliance signs a BAA on every plan, and Curve's team does the setup, typically live in about a week. Book a call with Curve.