Editor's note: The IAPP is policy neutral. We publish contributed opinion pieces to enable our members to hear a broad spectrum of views in our domains.
Each year, the U.S. Supreme Court agrees to decide only a few dozen cases, meaning years can go by between legal questions about data privacy reaching the highest court. But this year, we now know, the court will decide two cases with direct privacy implications.
Often Supreme Court privacy cases clarify Fourth Amendment jurisprudence, adapting constitutional privacy protections for new technologies. This is true of one of the 2026 cases, which will give the justices an opportunity to weigh in on the constitutionality of geofence warrants. Chatrie v. United States will build on the Court's interpretation of how much protection from government surveillance is afforded to geolocation data, which was most explicitly spelled out in the 2018 Carpenter decision. The long-pending Chatrie case has already been widely analyzed as it has made its way through the courts. On display is the tension between Google's Location History program, the opt-in nature of which weakens arguments about constitutional protections and the bulk dragnet characteristics of geolocation warrants.
The other case is an even rarer treat — a disagreement on the proper interpretation of a privacy statute making its way to the docket. This case, Salazar v. Paramount Global, will clarify the Video Privacy Protection Act, which has recently become a popular hook for class-action lawsuits.
The VPPA is a narrow but influential privacy law, infamously enacted in 1988 after a newspaper published Supreme Court nominee Robert Bork's video rental history. The law applies to entities that rent, sell or deliver "prerecorded video cassette tapes or similar audio visual materials." The language about similar materials has helped the statute retain relevance even after the end of the Blockbuster era.
In 2013, Congress updated the VPPA to clarify its consent requirements for the digital age, allowing that signed paper records were not necessary. At that time, legislators did not bother to change the language about the scope of the law, which most agree was an implicit acknowledgement that modern video streaming services were already covered.
The existence of the VPPA has helped to establish the relative sensitivity of video data in the context of Federal Trade Commission enforcement. Long before Texas began suing TV manufacturers for allegedly sharing users’ viewing data for advertising purposes, the FTC settled with Vizio alleging similar facts. FTC commissioners concluded that the media a consumer watches is due the heightened privacy protections of sensitive data because Congress had singled out this information for special protections under the VPPA. Under FTC precedent, reasonable privacy practices require opt-in consent for the use and sharing of sensitive data, so though the VPPA did not directly apply, it provided the evidence of legislative concern necessary to treat this data as special.
Fast forward to the patchwork era and, although no state comprehensive privacy law treats data about audiovisual consumption as sensitive, the most recent bipartisan federal proposals, such as the American Privacy Rights Act, would have done so for "information revealing the video content requested or selected by an individual." Some such language has shown up in state bills but has never been passed into law. However, the Protecting Americans' Data from Foreign Adversaries Act, which almost entirely copied APRA's sensitive data definitions, also treats this data as sensitive.
In the Salazar case, the Supreme Court will not be weighing in on the privacy protections that different data elements deserve. Instead, it will be resolving the narrow question of whether a "consumer" under the VPPA must subscribe specifically to a video service in order to be given the protections under the law, or can merely be a customer in any context.
For years, as Westin Fellow William Simpson, AIGP, CIPP/US, explained recently, plaintiff's attorneys have been using the VPPA as a mechanism to assert privacy violations in any situation where a video loads on a user's device and information is shared with third parties about the interaction. The case law is a bit of a mess around these claims, and the Supreme Court now has the opportunity to resolve a circuit split about this consumer definition.
This will determine whether special protections apply to video sharing entities, generally — even if the customer only subscribes, say, to a newsletter — or if the customer must subscribe to the video service itself to fall under the protections of the law. A narrow reading would significantly curtail future VPPA class-action suits.
This will leave plenty of big privacy questions open. In the modern era, is there still something special about video that makes our consumption habits particularly sensitive? Why would we not treat audio the same? What about video games or immersive technologies? Internet browsing history?
Further, what does it mean that we often no longer choose the videos we watch in many contexts? Does our reliance on algorithmic recommendation systems make our video viewing habits less revealing of our private selves — or more so?
These are questions for privacy professionals and scholars to wrestle with, as Congress and the courts will not be turning to them any time soon.
Please send feedback, updates and Blockbuster receipts to cobun@iapp.org.
This article originally appeared in The Daily Dashboard and U.S. Privacy Digest, free weekly IAPP newsletters. Subscriptions to this and other IAPP newsletters can be found here.
