The U.S. Supreme Court’s decision to take Salazar v. Paramount Global (cert. granted January 26, 2026) is more than a technical exercise in statutory interpretation. It is a live example of what happens when a targeted, decades-old privacy statute collides with modern web tracking and digital media business models.

At the center of the case is the Video Privacy Protection Act (“VPPA”), enacted in 1988 after the disclosure of Supreme Court nominee Robert Bork’s video rental history. The law was built for a Blockbuster-era world, but it has become newly relevant as plaintiffs test whether routine online tracking can qualify as unlawful disclosure of “video-viewing” information.

The VPPA is potent because it combines (i) strict consent rules for disclosing personally identifiable information tied to video consumption, with (ii) a private right of action and (iii) liquidated damages of not less than $2,500 per violation, plus potential punitive damages and attorneys’ fees. That structure makes VPPA claims attractive in class-action litigation. The deceptively simple question: Who is a “consumer”?

The VPPA limits its protections to “consumers,” defined as “any renter, purchaser, or subscriber of goods or services from a video tape service provider.” The fight in Salazar is whether that definition extends to any subscription relationship with a company that offers video content or only subscriptions tied to audiovisual goods or services.

In Salazar, the plaintiff allegedly subscribed to a free, text-based email newsletter from 247Sports (a Paramount property) and later watched video content on the site. He claims that the site’s tracking implementation (described in reporting as involving the Meta Pixel) disclosed information tied to his video viewing to Meta/Facebook without the consent the VPPA requires.

The Sixth Circuit rejected the theory holding that a newsletter subscription, standing alone, did not make the plaintiff a VPPA “consumer” because the subscription relationship was not centered on audiovisual materials. The Supreme Court agreed to take the case, positioning it to resolve a broader dispute over how far the VPPA extends in the digital era.

Why this matters to business leaders

If a free, non-video subscription (like an email newsletter account) can trigger VPPA “consumer” status, the risk calculus changes quickly. Class actions can scale statutory damages in ways that feel untethered from the VPPA’s original purpose especially for brands that publish video content and use common ad-tech and analytics tools.

This is the core “patchwork” problem: narrow laws passed for specific historical moments are now being asked to govern technologies and monetization models that did not exist when Congress drafted the statute.

And this risk exists alongside an equally uncomfortable consumer reality. Research consistently finds Americans are uneasy about data practices and feel they have limited control over how their personal information is used despite the growing web of privacy rules.

What organizations should do now

1. Treat “legacy privacy statutes” as real enterprise risk. Laws like the VPPA may feel niche until they become the next wave of class actions. Include them in risk assessments where you publish video content and use third-party tracking.
2. Inventory video + tracking touchpoints. Map where video is hosted, how users access it (logged-in vs. anonymous), and what data is shared through pixels/SDKs, analytics, and ad-tech. The compliance question is often less about intent and more about what your stack actually transmits.
3. Reassess vendor and tag governance. Tighten controls on tags and pixels (approval workflows, least-privilege access, change management, audit logs). Review contracts and data-sharing restrictions with marketing and analytics vendors.
4. Watch Salazar as a “compliance hinge event.” A ruling that broadens VPPA “consumer” status could change litigation exposure quickly and may warrant updates to consent flows, disclosures, and tracking configurations.

Bottom line

The Supreme Court may narrow the VPPA or confirm that it reaches farther into modern internet practices than many businesses assumed. Either way, Salazar underscores a reality privacy and security leaders already feel: in a system dominated by piecemeal rules, organizations can face outsized liability from statutes that were never designed for today’s tracking ecosystem.

This publication is published by the law firm of Ervin Cohen & Jessup LLP. The publication is intended to present an overview of current legal trends; no article should be construed as representing advice on specific, individual legal matters. Articles may be reprinted with permission and acknowledgment. ECJ is a registered service mark of Ervin Cohen & Jessup LLP. All rights reserved.