On 14 October 2026 the Supreme Court heard argument in Salazar v. Paramount Global (No. 25-459). The question is whether a person who subscribed to a free email newsletter on 247Sports.com can sue as a "consumer" under the Video Privacy Protection Act of 1988 (VPPA) because the site's Meta Pixel allegedly sent his video-viewing history to Facebook. The case is narrow on its face. Its consequences are not, because it asks how far a statute written for video cassettes can reach into the modern advertising stack.
The strongest case for the plaintiff
The case for Salazar is serious, and it should be stated fairly. The VPPA was Congress's response to a 1987 episode in which a journalist published a list of videos that Judge Robert Bork had rented. Bork's Supreme Court nomination then failed, 58 to 42, according to SCOTUSblog's argument recap. The statute defines a "consumer" as "any renter, purchaser, or subscriber of goods or services from a video tape service provider," as 18 U.S.C. § 2710(a)(1) puts it. Salazar's lawyer, Joshua Hammack, reads that text literally. The goods or services need not be video, so a newsletter subscriber to a video provider qualifies. Congress, he argues, cared about consent and about consumers controlling disclosure of their viewing history.
On this reading the privacy harm is real. Viewing history can reveal a great deal about a person, and sharing it with an ad platform without consent is the kind of conduct the statute names. SCOTUSblog reports that Justice Kagan called the case a paradigmatic example of what the VPPA covers. Justice Jackson said Paramount's approach had a "line-drawing problem." On the day, the Court appeared likely to let the suit proceed, at least for now.
Why the broad reading is a poor way to regulate ad tech
The difficulty is not that privacy matters. It is that the VPPA's remedy was designed for a different world. The statute allows liquidated damages of at least $2,500 per violation under § 2710(c)(2)(A). Salazar seeks that amount for himself and for a class, plus punitive damages and attorney's fees. A fixed, per-person penalty that does not depend on any measured harm turns every tracking-pixel deployment into a potential class action. A site with 100,000 affected users faces exposure on the order of $250 million before anyone proves injury.
That is the logic of the amicus brief from CCIA and SIIA. In its 14 October statement, CCIA says the VPPA was never meant to be a "sweeping internet law." It argues that incidental online video, such as clips shown with requested content, has little in common with renting a tape. CCIA's president, Matt Schruers, also praised the appeals court for rejecting an attempt to use the law for nationwide internet class actions.
The argument transcript suggests some justices share the worry. Justice Alito doubted that streamed video is "similar" to VHS tapes. Justice Thomas asked whether 247Sports.com is really in the business of providing video. Chief Justice Roberts suggested Salazar's reading conflicts with the law's purpose. Justice Barrett questioned the "profit motive" argument with a hypothetical about a shoe retailer's website. Paramount warned that a ruling for Salazar could open the door to suits against many businesses that stream any video.
The floodgates answer is weaker than it sounds
Salazar's side has replies. Justice Kavanaugh noted that companies can avoid liability by obtaining consent, and Kagan said they can also stop selling the data. Trial courts have already screened out defendants such as Chick-fil-A. Paramount could also still win on other statutory questions, including whether it is a "video tape service provider" and what counts as "personally identifiable information."
Those are fair points, but they describe a regime in which compliance depends on litigating undefined terms case by case. Businesses cannot tell in advance whether an embedded clip makes them a video provider, or whether a hashed identifier is personally identifiable. Courts supply the answers after liability has accrued, and statutory damages make settlement the rational choice even for defendants with strong defenses. Large firms absorb that cost. Small publishers and startups are the ones who strip out video or stop experimenting with it.
What proportionate privacy regulation would look like
None of this means ad-tech data sharing should go unregulated. It means the rules should be designed for it. A modern standard would:
- define covered data and covered entities explicitly, rather than by analogy to tape rental
- require clear, standard consent for sharing sensitive viewing data
- scale penalties to demonstrated harm or to regulator-led enforcement, instead of automatic $2,500 awards
- give businesses a safe harbour for good-faith compliance
The Federal Trade Commission already polices unfair and deceptive data practices, and Congress can legislate a consent-based rule for viewing data. Both routes give consumers protection without making a 1988 statute the de facto national privacy law, which is a job it was never drafted to do.
The Court may well side with Salazar, and if it does, Congress should treat the ruling as a prompt rather than a settlement. A decision is expected by the end of the term. Until then, the case shows the cost of leaving privacy law to be rewritten by litigation. Plaintiffs' lawyers find old statutes with generous damages, defendants fight over words like "consumer," and neither side gets the clear, current rules that would protect users and let innovators build.