VPPA
18 U.S.C. § 2710Video Privacy Protection Act
In force since November 5, 1988
Who it applies to
- Video tape service providers: anyone engaged in the rental, sale or delivery of prerecorded audio-visual materials
- Read by many courts to reach streaming services and websites embedding video with tracking pixels
Consumer rights
- Access / know — not granted
- Correction — not granted
- Deletion / erasure — not granted
- Portability — not granted
- Opt out of sale / sharing — not granted
- Opt out of targeted advertising — not granted
- Opt out of profiling — not granted
- Limit sensitive data use — not granted
- Human review of automated decisions — not granted
- Non-discrimination — not granted
- Appeal a refusal — not granted
- Private right of action — grantedSue directly, rather than relying on a regulator to enforce on your behalf.
Obligations
- Consent model
- Opt-in
- Universal opt-out signal
- Not required
- Risk assessments
- Not required
- Data protection officer
- Not required
- Records of processing
- Not required
- Processor contract
- Not required
- Right to cure
- None — enforcement may follow immediately
- Data broker registration
- Not required
Breach notification
- To individuals
- Not addressed by this Act
- To the regulator
- Not required by this law
- What triggers it
- Not addressed by this Act
Penalties
- Headline
- Liquidated damages of $2,500 per person, plus punitive damages and fees
- Private right of action
- Yes — individuals can sue directly
- Notes
- A 1988 statute passed after a Supreme Court nominee's video rental history was published, now one of the most active bases for web-tracking class actions.
Amendment history
January 10, 2013
Consent modernisation
Permitted consent to be given electronically and in advance, with a route to withdraw it.