The month a 1988 video store law reached my demo page at 74K MRR

That was outside counsel, ten minutes into a call I had booked to talk about something else entirely. We were at 74K MRR, thirty-one paying teams, two people on support. The page she was describing was our two minute product demo with an email capture underneath it. The letter on her desk said we were a video tape service provider.

Quick answer (2026). This diary is a composite. The numbers, the people and the sequence are assembled from several companies I have worked in and advised, not from one. The law in it is not composite. The Video Privacy Protection Act is a 1988 federal statute written about video rental shops, and its one sentence of liability reaches anyone in the business of the rental, sale, or delivery of "prerecorded video cassette tapes or similar audio visual materials" who "knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider". If your site has video and a third party advertising pixel, three federal appeal courts have now produced two different answers on whether your logged in reader counts as a consumer at all. The Supreme Court granted certiorari on 26 January 2026 to settle it. Until it does, the statutory floor is 2,500 dollars a head, and the uncertainty is not a defence.

The email that started it

Nobody on my team had ever heard of the statute. That is not a confession of negligence, it is the point. We were not a streaming service. We sold a scheduling tool to clinics. The demo video existed because a support person got tired of answering the same question, and the email capture existed because a growth consultant told us gated video converted better. Neither decision was reviewed by a lawyer, because neither decision looked like a legal decision.

What the letter alleged was mechanical. A reader signed up for our weekly changelog email. Later, logged into a social account in another tab, they watched the demo. Our advertising pixel reported the page, and the page identified the video. The pixel also carried the reader's account identifier. Put those together and you have, on one reading, a disclosure to a third party of information identifying a person as having requested specific video materials.

I want to be precise about what I found when I finally read the statute myself, because almost everything I assumed turned out to be wrong in the same direction.

Three definitions, one missing adjective

Section 2710(a) defines three things, and the whole fight lives in the difference between them.

The definition of personally identifiable information is explicitly about video. It covers "information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider".

The definition of the regulated business is explicitly about video too: "prerecorded video cassette tapes or similar audio visual materials".

Then there is the definition of who can sue. A consumer is "any renter, purchaser, or subscriber of goods or services from a video tape service provider".

Read those three in order. Two of them say video. The third does not. It says goods or services, with no qualifier, and the Supreme Court's own Question Presented in Salazar v. Paramount Global puts the entire case on exactly that gap, noting that the Act "contains a one-sentence liability clause" and that "both courts below assumed as much" about every other element. The only thing in dispute is whether one missing adjective means what it appears to mean.

I had read that definition twice before I noticed. It is four words long.

The number is a floor, not a ceiling

I assumed 2,500 dollars was the exposure. It is the bottom of it. The civil action provision says a court may award "actual damages but not less than liquidated damages in an amount of $2,500", and then adds punitive damages and "reasonable attorneys' fees and other litigation costs reasonably incurred" as separate items.

So the per person figure does not move down. It only moves up. And the multiplier is not set by the statute, it is set by how many people watched, which is the one number a growing company works every day to increase. Our demo page had been live for nineteen months.

I also went looking for the escape hatch. There is none. Across the whole section, the words de minimis, small business, small entity, fewer than, revenue threshold, annual revenue, number of employees and exempt appear zero times between them. Not one of them. The statute is completely blind to the size of the defendant. I have read regimes where the exemption existed but was addressed to somebody else. Here there is simply nothing to be addressed by.

The thing that saved me last time is not in this statute

This is the part I would most want a founder to take away, and it is the part I got most wrong.

I had spent the previous quarter on a different compliance problem, one where the penalty tier turned on state of mind, and where the defence that mattered was that the law had been genuinely unclear. Unclear law was worth money there. It was the difference between a statutory damages band and ordinary actual damages.

So when counsel told me the Supreme Court had taken the case, my first reaction was relief. If the highest court in the country has formally admitted it does not know who can sue under this statute, surely nobody can say I should have known.

That instinct is worth nothing here, and I can show you why in a word count. Across the entire section, willful appears zero times. Negligent, zero. Reckless, zero. Good faith, zero. Safe harbor, zero. There is exactly one mental state word in the whole provision, "knowingly", and it attaches to the act of disclosing, not to any judgement about whether the disclosure was lawful.

One statute prices legal uncertainty as a defence. This one has no tier for it to reduce. Same fact, opposite value, and the only thing that changed was which statute somebody chose to sue me under.

Congress opened this statute in 2013 and left the definitions alone

My second instinct was that this was a relic nobody had revisited. That is checkable, and it is false.

The statute's own amendment notes record that in January 2013 Congress "added subpar. (B) and struck out former subpar. (B)". The version it struck out had allowed disclosure only "to any person with the informed, written consent of the consumer given at the time the disclosure is sought". The replacement permits consent that "is given in advance for a set period of time, not to exceed 2 years or until consent is withdrawn by the consumer".

So Congress reopened this section, read it, and loosened the consent mechanics. It did not touch the 1988 definition of the regulated business. It did not touch the 2,500 dollar figure, which the section contains no mechanism to adjust: inflation, adjust and consumer price all appear zero times. And it did not add a size threshold.

That kills the excuse I was reaching for. The obsolete category survived a deliberate legislative revisit.

Worth noticing what the 2013 text does require, because we failed it plainly. Valid consent must be "in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer". Ours was clause fourteen of the terms of service.

Three circuits, two answers, one pixel

The circuit split is not academic and it is not subtle.

The Seventh Circuit, in a case about a nostalgia television site, held that a free account was enough, because "providing personal data in exchange for service suffices". No payment required. The videos on that site were freely viewable by anyone; the plaintiff had handed over an email address and a postal code for programming alerts.

The Second Circuit reached a similarly broad result about a sports newsletter. The Sixth Circuit went the other way on near identical facts, holding that the goods or services subscribed to must themselves be audio visual.

As the practitioners covering the split put it, "that answer depends entirely on where the case is filed", and the predictable consequence is that "plaintiffs are likely to forum-shop aggressively by seeking clients in favorable Circuits".

Sit with that. My code was identical in all three places. My pixel was identical. My video was identical. The variable that decided whether I had a claim against me was the postal address of the person watching.

The subsection nobody quotes

Two more things I found only because I read to the end.

Subsection (e) is an affirmative duty with a deadline, and I had never seen it mentioned in any of the commentary. A person subject to the section "shall destroy personally identifiable information as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected". Our analytics retention was set to forever, because that was the default. Whether a retention failure standing alone is actionable is a reading rather than a settled holding, but the civil action provision is written broadly, covering "any act of a person in violation of this section".

Subsection (f) then says the statute preempts "only the provisions of State or local law that require disclosure prohibited by this section". One way, and narrow. It does not displace stricter state law. A single pixel firing once can therefore be the basis of a federal claim and a state claim at the same time. They stack.

What I got wrong

Four things, in the order I discovered them.

I assumed a subscriber pays. The Seventh Circuit says data for service is enough, and the videos need not be behind the signup at all.

I assumed 2,500 dollars was the number. It is the floor, with punitive damages and fees on top.

I assumed unclear law would help me. It helps under regimes with a state of mind tier. This one has none.

And I assumed, having checked a lot of penalty figures that turned out to have been quietly replaced upward by regulation, that I would find the same here. I did not. There is no adjustment mechanism at all. A figure set in 1988 has simply stood still for thirty-eight years while the number it gets multiplied by, my traffic, went up every month I did my job well.

What actually happened

Limits

I have not read the underlying appellate opinions in full; I worked from the statute, the Supreme Court's Question Presented, and practitioner and advocacy summaries. One of those sources is an advocacy organisation with a stated position, and I have used it for dates and for the tally of which courts ruled which way, not for its framing. I did not compute what 2,500 dollars in 1988 is worth today, because I could not source a figure I was willing to publish; the direction is all I am claiming. The 1988 enactment details come from the statute's own public law note rather than from the Congress.gov page for S.2361, which refuses our fetcher, so that page is cited in text and not linked. And nothing here is advice about your situation. The case was still undecided when I wrote this.

The one thing I would tell you

Go and look at the definition of who is allowed to sue you, before you look at anything else.

I had read the prohibition. I had read the penalty. I never read the definition of the person on the other side, because it felt like boilerplate. It was the only part in dispute, it turned on four unqualified words, and it was the part that decided whether any of the rest of it applied to me at all.

The prohibition tells you what not to do. The definitions tell you whether the statute is talking to you. Those are different questions, and only one of them is answered by being careful.