Run a free scan

Salazar v. NBA: a free newsletter sign-up can make a video viewer a VPPA consumer

Count newsletter subscribers as possible VPPA "consumers" if they can also watch video on your site. In the Second Circuit, trading an email address for a newsletter is enough. This case also shows the other half: the same plaintiff later lost on what counts as identifying information.

US Court of Appeals for the Second Circuit · Video Privacy Protection Act · Published opinion, 15 October 2024

The problem

Michael Salazar gave the NBA his email address for its free online newsletter, then watched videos on NBA.com while logged into Facebook. He alleged that the Meta Pixel on NBA.com sent Meta the title and URL of each video together with his Facebook ID, without notice or consent (slip op. at 8–10). The district court said a newsletter subscriber is not a VPPA consumer. The Second Circuit disagreed.

Case record

Court
US Court of Appeals for the Second Circuit, on appeal from the Southern District of New York
Case number
No. 23-1147; district court No. 1:22-cv-07935-JLR
Parties
Michael Salazar v. National Basketball Association
Counsel
Salazar: Bailey & Glasser (Hammack argued). NBA: Vinson & Elkins (Etchemendy argued) ([slip op. at 2](https://www.govinfo.gov/content/pkg/USCOURTS-ca2-23-01147/pdf/USCOURTS-ca2-23-01147-0.pdf))
Laws
Video Privacy Protection Act, 18 U.S.C. § 2710
Stage
Vacated and remanded 15 October 2024; dismissed with prejudice on remand 6 October 2025; second appeal filed; cert denied 8 December 2025
Amount
None
Source review
17 October 2026

What was alleged

What was alleged
ClaimWhat the law requiresFacts allegedResult
VPPA, § 2710(b)(1)Knowing disclosure by a video tape service provider of a consumer's personally identifiable informationThe Pixel sent Meta "(1) the title of the NBA.com video a user watched, (2) that video's URL, and (3) the user's 'Facebook ID'" ([slip op. at 8](https://www.govinfo.gov/content/pkg/USCOURTS-ca2-23-01147/pdf/USCOURTS-ca2-23-01147-0.pdf))Consumer and standing: for Salazar on appeal. PII: dismissed on remand

The class was "[a]ll persons in the United States with a digital subscription to an online website owned and/or operated by [the NBA] that had their Personal Viewing Information disclosed to [Meta]" (slip op. at 11). No class was certified.

Technical issue

  • Tools or vendors: the Meta Pixel. The court left the mechanics aside and presumed the allegations true (slip op. at 10 n.3).
  • Where: the Videos section of NBA.com. App claims were abandoned on appeal (slip op. at 7 n.2).
  • What data: on remand the complaint said the Pixel sent "the video content name, the URL of the pre-recorded video that was viewed . . . , [and] the viewer[’s] [FID]" through a "c_user" cookie, with a sample HTTP communication at ¶ 155 (remand op. at 2).
  • When: whenever a newsletter subscriber watched a video while logged into Facebook.
  • How it came to light: the complaint. Salazar says he discovered the disclosure in August 2022 (remand op. at 3).

Inth’s technical interpretation: the "subscription" and the "disclosure" happen on different surfaces. The newsletter form stores an email address; the video page loads the Pixel, and the browser attaches the c_user cookie to the Pixel’s request. Nothing in the code links the two, but the law can: the same person is both a subscriber and a viewer. An inventory that lists only "pages with video" misses half the exposure.

Illustrative pattern, not the defendant’s code.

// Bad: the newsletter form and the video page are unrelated in code,
// but the Pixel on the video page still sends the title for every viewer
export function VideoPage({ video }) {
  useEffect(() => {
    fbq('track', 'ViewContent', { content_name: video.title, content_type: 'video' });
  }, [video.title]);
  return <Player src={video.src} />;
}
// Fixed: no video identifiers in ad events; Pixel waits for consent.
// Generic consent check, not a specific library API.
export function VideoPage({ video }) {
  useEffect(() => {
    if (consent.has('marketing')) fbq('track', 'PageView'); // no title, no slug
  }, []);
  return <Player src={video.src} />;
}

The fixed version still sends the page URL in the dl parameter, so a video slug in the URL can name the video. Keep the Pixel off routes whose URL identifies a video unless your lawyers are satisfied with your consent flow.

Timeline

Timeline
DateEvent
16 September 2022Complaint filed ([remand op. at 3](https://cases.justia.com/federal/district-courts/new-york/nysdce/1:2022cv07935/586473/81/0.pdf))
8 August 2023Judgment dismissing; 685 F. Supp. 3d 232
2 April 2024Argued in the Second Circuit
15 October 2024Vacated and remanded ([opinion](https://www.govinfo.gov/content/pkg/USCOURTS-ca2-23-01147/pdf/USCOURTS-ca2-23-01147-0.pdf))
1 May 2025Second Circuit decides [Solomon v. Flipps](/enforcement/solomon-v-flipps)
6 October 2025Second Amended Complaint dismissed with prejudice ([Dkt. 81](https://cases.justia.com/federal/district-courts/new-york/nysdce/1:2022cv07935/586473/81/0.pdf))
7 October 2025Notice of appeal, 2d Cir. No. 25-2478 ([docket](https://www.courtlistener.com/docket/73485554/salazar-v-national-basketball-association/))
8 December 2025Supreme Court denies the NBA's petition ([No. 24-994](https://www.supremecourt.gov/search.aspx?filename=/docket/docketfiles/html/public/24-994.html))

Outcome

Standing. Disclosure of viewing information to a third party without consent "has a 'close relationship'" to the tort of public disclosure of private facts, so the injury is concrete (slip op. at 5).

Consumer. "The phrase 'goods or services' in the VPPA is not cabined to audiovisual goods or services, but also reaches the NBA’s online newsletter" (slip op. at 23). Giving an email address, IP address and cookies in exchange for the newsletter made Salazar a subscriber. The court expressly left PII for later: "we need not and do not explore that argument in this appeal" (slip op. at 35 n.10). It also left the NBA’s consent-by-privacy-policy argument to the district court (slip op. at 12 n.4).

On remand. Judge Rochon applied Solomon and Hughes, held that "an ordinary person would not plausibly be able to identify Plaintiff’s video-watching habits as a result of the Pixel transmissions", and dismissed with prejudice (remand op. at 11). She rejected the argument that a web search or ChatGPT could decode the Facebook ID (op. at 10).

The consumer holding binds courts in the Second Circuit and is half of the 2-2 split the Supreme Court is resolving in Salazar v. Paramount.

What it cost

What it cost
ItemAmount
Damages or settlementNone; no liability found
Statutory exposure claimedUSD 2,500 liquidated damages per class member ([§ 2710(c)(2)](https://www.law.cornell.edu/uscode/text/18/2710))
Fees and defence costsNot stated in the cited record

Why it matters

  • The broad "consumer" reading was adopted by the Seventh Circuit in Gardner v. Me-TV and rejected by the Sixth Circuit in Salazar v. Paramount. The Supreme Court heard argument on 14 October 2026.
  • In the Second Circuit, a plaintiff who clears "consumer" still has to clear the ordinary-person PII test, which no Pixel complaint in the circuit has passed since Solomon.
  • Elsewhere, a newsletter form plus a Pixel on video pages remains a live combination. Related: VPPA, Identifying video-viewing disclosures.

How Inth catches this

  • Code audit: flags a pull request that adds Meta Pixel events on a video component, and traces the video title from the template into the event; it also shows where the newsletter form sends email addresses.
  • Website audit: records each request to facebook.com/tr on video routes, with the page, time, visitor region and consent state.
  • Consent banner: holds the Meta Pixel until its category is granted under an opt-in policy. Inth’s default California policy is opt-out, so the Pixel runs until the visitor opts out unless you configure an opt-in policy.
  • Evidence: consent records with choice, country and policy; runtime observations with consent state.

None of this shows which of your newsletter subscribers also watch video; that join lives in your own CRM and analytics.

Checks for your own systems

In the repository

  • List every sign-up form (newsletter, account, app) and every component that renders a player or embed.
  • Search for fbq('track' and dataLayer.push calls that read video metadata.
  • Check whether video URLs contain human-readable titles or slugs.

In the browser and network

  • Subscribe to your own newsletter, stay logged into Facebook, play a video and capture the facebook.com/tr request.
  • Check dl for the video slug and the Cookie header for c_user.
  • Confirm what changes after you decline marketing in your banner.

With the people responsible

  • Ask whether newsletter terms or the privacy policy mention sharing viewing activity with ad platforms, in a separate VPPA-style consent.
  • Decide which circuits matter for your audience; the PII test differs between them.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit the NBA’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.