VPPA Legislative Risk

• The VPPA applies to any website with video content, not just streaming services. Class action suits are being filed against enterprise websites across dozens of industries when video titles are shared with third-party trackers like Meta Pixel or Google without user consent.
• The violation trigger is specific: passing a video’s title to a third-party tracker. Organizations can reduce risk by auditing which pages contain video players, identifying what trackers are present on those pages, and confirming whether video titles are being transmitted.
• Building a historical compliance record strengthens your defense. Periodically collecting request data across pages with video players creates documented evidence of compliant behavior that can be used to respond to VPPA complaint letters.

I could write a long post about the history of the Video Protection Privacy Act (VPPA) since its enactment in 1988, but why bother when we have people like Tim Peterson at Digiday who are willing to create informative and entertaining versions.

A couple points that I want to add or clarify:

• As Tim Peterson pointed out, risk occurs when title of the video is passed to a 3rd party tracker such as the Meta (Facebook) Pixel or Google.
• The law does not just apply to videos provided by streaming services. A case could be made that there is risk to any site providing any video content – and class action suits are already being filed against enterprise websites in dozens of industries. Cases and settlements are surging.

So how do you protect yourself from complaints? Simple: just don’t allow your vendors to collect title of videos. But getting there might not be quite so simple. Depending on the amount of video content and the prevalence of digital marketing technologies across your site, you may be fighting an uphill battle.

The first step to reducing risk is understanding the issues you might need to tackle. Auditing your site to identify which pages have video players on them and what trackers have been placed on those pages is a bare minimum. Once you have that information you can take out your scalpel and decide whether you really need trackers on pages with videos, and determine whether the title of the video is being made available to trackers.

You may even want to carefully monitor the data transfers on pages with video players, looking for the titles of the videos to ensure they are not being transferred to third parties without your knowledge and explicit permission.

Lastly, you might consider building up a historical record of your good behavior, periodically (perhaps daily) collecting all request data across your pages with video players to show that you are not allowing improper data collection. This record will help in case you do need to respond to a complaint letter accusing your site of VPPA violations.

If you are wondering how to tackle your VPPA concerns, read more on how Vault JS can help here. Or contact us for a complimentary review of your site’s video risk.

Julie Oberweis
COO, Co-Founder, Vault JS

She previously co-founded Ensighten, where she helped create the tag management industry. Julie holds the CFA charter and the CIPP/US certification from the IAPP, bringing a rare combination of financial, operational, and privacy expertise to the governance challenges facing enterprise marketing and compliance teams.