VPPA: the exposure hiding in a video player.
A pixel on a page with video can send viewing history to an ad platform. Tie that to an identifiable person and you have the fact pattern behind Video Privacy Protection Act claims.
The law in brief.
Video Privacy Protection Act (18 U.S.C. §2710)
Yes
$2,500 per violation in liquidated damages
No
Any site with video and advertising trackers: media, retail, healthcare, education and more
Video pages, flagged on their own.
Report indicators
Risks tied to this law
- Pixel transmission of event-level data
- Pixel transmission of hashed identifiers
- Tracking pixels and beacon technologies
Video viewing data shared with an ad platform
Example finding. Vendor names are withheld.
How to respond.
“Is video-viewing data shared with advertising platforms?”
“Which pages with video carry advertising pixels?”
“Remove advertising pixels from video pages or confirm consent, verified by CyRisk rescan.”
Consider a VPPA-specific sublimit or endorsement.
Keep exploring.
Exposure families behind this law
Other laws
Do we need a “video business” for VPPA to apply?
That question is being litigated. CyRisk flags the fact pattern so you can ask; it doesn’t decide applicability.
Is any video player a problem?
The exposure comes from sharing viewing data with third parties, usually through advertising pixels, not from the video itself.
How should we respond?
Ask whether viewing data is shared and consider a VPPA sublimit or endorsement.
See which submissions share viewing data.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. A detected exposure indicates a fact pattern common to privacy litigation, not a confirmed violation. Litigation theories explain why a finding is tracked; they are not legal advice.