Can You Sue a Website for Sharing Your Viewing History? Inside the Federal Video Privacy Law

Every day, millions of Americans stream videos on news sites, sports platforms, entertainment apps, and subscription services, but as online behavior becomes more complex, so do the ways companies track, store, and share your data. 

Most people assume that what they watch online is private, but that assumption isn’t always true.

As investigations continue into websites like The Athletic allegedly sharing users’ video-viewing history with Facebook, more consumers are beginning to ask an important question: Can I actually sue a website for mishandling my viewing data?

The answer is yes, and the federal law that makes it possible is far more powerful than most users realize.

What Makes the VPPA Unique Among Data Privacy Regulations

The Video Privacy Protection Act (VPPA) is one of the strongest and most consumer-friendly privacy laws in the country. Unlike other data laws that focus on broad categories of information, the VPPA is extremely specific: it protects your video-viewing history from being shared without your permission.

What sets the VPPA apart?

1. It applies to modern websites, not just video rental stores

Although passed in 1988, courts have repeatedly ruled that the VPPA applies to today’s digital publishers, streaming sites, and media platforms that offer video content.

2. It bans unauthorized sharing of personally identifiable information (PII)

Companies cannot share what you watched and data that identifies you, such as a Facebook ID, email address, or device information, without your consent.

3. It requires explicit, written permission

Buried privacy policies, vague disclosures, or general cookie consent do not meet VPPA standards.

4. It gives users direct power to hold companies accountable

The VPPA allows individuals, not just government agencies, to take legal action against companies that violate their privacy.

Because of these strict protections, the VPPA has become one of the most important tools consumers have for demanding transparency in the digital age.

How the VPPA Gives Users the Right to Sue for Unauthorized Sharing

Most federal privacy laws don’t allow individuals to sue companies directly, but the VPPA is different. Congress specifically wrote the law to give consumers the right to take action if their video-viewing history is shared without permission.

Under the VPPA, you can sue a website or media platform if:

• You watched video content
• The site knowingly disclosed your viewing history
• Your personal identifiers were shared along with the videos you watched
• You did not provide informed, written consent

Importantly, you do not need to show financial loss or identity theft. The wrongful sharing itself counts as harm under the law.

This means thousands or even millions of users can pursue claims if a website used tools like tracking pixels, cookies, or embedded scripts that transmitted their viewing history to third parties like Facebook or Google.

Steps to Filing a VPPA Claim: Eligibility, Documentation, and the Process

Filing a VPPA claim is simpler than many people expect. In cases like the one involving The Athletic, law firms are taking on the burden of investigating the technical side. Users just need to provide basic details.

1. Confirm basic eligibility

You may qualify if:

• You watched videos on a website through a web browser
• You were logged into Facebook at the time (or had tracking enabled)
• The website used tracking tools that could transmit viewing data
• You used a device where cookies were active

You do not need to be a paid subscriber.
 Even casual viewers can qualify.

2. Provide basic information to the law firm

This might include:

• Your name and contact information
• The type of device you used
• Whether you were logged into Facebook
• An estimated timeframe for when you watched videos

You do not need screenshots, browser logs, or proof that your data was shared. Law firms have technical experts who evaluate that.

3. The firm investigates your claim

They will determine whether the website:

• Offered video content
• Used tracking tools known to share data
• Fell within the timeframe of alleged violations
   

4. Your case is filed through arbitration (for The Athletic)

Because of The Athletic’s terms of service, individual arbitration is used instead of traditional lawsuits.

5. You may be entitled to compensation

If a violation occurred, the VPPA allows for statutory damages of up to $2,500 per user.

The entire process requires minimal time from consumers but can lead to meaningful compensation.

Why Individual Arbitration Is Being Used for The Athletic Case

Many digital platforms include arbitration clauses in their Terms of Service. These clauses require disputes to be handled through individual arbitration instead of class-action lawsuits.

The Athletic is one of those companies.

What does arbitration mean for users?

• Each claim is filed individually
• You can pursue compensation without joining a class action
• The process is typically faster and more streamlined
• It may increase the chances of recovering the full statutory damages

Arbitration also means your claim is handled privately rather than through a public court system. While some consumers worry that arbitration limits their rights, the VPPA’s statutory damages help ensure meaningful recovery remains possible.

What VPPA Compensation Looks Like ($2,500 per Violation)

The VPPA is one of the few federal privacy laws that guarantees statutory damages:

Up to $2,500 per violation

You do not need to prove financial loss or emotional harm. The unlawful sharing of your data alone qualifies.

Potential for additional relief

Depending on the case, consumers may also seek:

• Injunctive relief (forcing the website to stop sharing data)
• Attorneys’ fees
• Technical remedies or policy changes
  
   

No out-of-pocket costs

Consumers do not pay for filing, investigation, or arbitration. Law firms only receive fees if they successfully secure a recovery.

For many users, this makes VPPA claims a rare opportunity to enforce privacy rights that are too often ignored online.

Your Data Is Worth Protecting

You may not think twice about the videos you watch online: analysis clips, player interviews, news recaps, or entertainment content, but companies can learn a lot about you just by tracking your viewing behavior. When that data is shared without your knowledge, it crosses a line.

The VPPA was written to stop exactly that kind of privacy violation. Today, it gives consumers the power to hold websites accountable and demand compensation when companies misuse their information.

If you watched videos on a website like The Athletic while logged into Facebook, you may have a right to take action. Your privacy matters. Your data has value. And the law is on your side.

Do I need proof my data was shared to file a VPPA claim?

No. You do not need personal logs, screenshots, browser history, or technical evidence. The law firm handling your claim will investigate whether the website used tracking tools known to share data with third parties.

How can I confirm whether I’m affected by this case?

You might qualify if:

• You watched videos on The Athletic using a web browser
• You were logged into Facebook at the time
• You used a device where cookies were active

Even if you’re not sure, you can submit your information, the firm will determine eligibility.

What happens after I submit my information to the law firm?

The firm will:

1. Review your answers
2. Determine whether you fall within the affected group
3. File an individual arbitration claim on your behalf
4. Keep you updated as your case moves forward
    

You won’t need to gather evidence or investigate anything yourself.

How long does arbitration take to resolve?

Timelines vary. Some VPPA arbitration claims may resolve in a few months, while others take longer depending on scheduling, responses, and the volume of claims.

Can multiple claims be filed if multiple videos were shared?

Typically, VPPA claims treat each user, not each video, as a single violation. However, certain cases may evaluate repeated conduct or extended patterns of data sharing. The law firm will assess your specific situation.

Is there a time limit to take action?

Yes. VPPA claims are subject to a statute of limitations. If you wait too long, you could lose your right to seek compensation. Acting quickly ensures your claim is preserved.

What are my options if I live outside the U.S.?

The VPPA generally applies to U.S.-based users. If you lived in the U.S. when the data sharing occurred, you may still qualify even if you now reside abroad. Eligibility is evaluated on a case-by-case basis.

Does this law apply to mobile apps too?

Yes, if the mobile app delivers video content and shares Personally Identifiable Information with third parties. However, some investigations focus specifically on browser-based tracking, depending on the company’s technology.

Are VPPA settlements public?

Some are public, especially in class actions. Arbitration results, however, are often private. You will be informed of the outcome of your own claim even if it is not publicly posted.

What kinds of damages can users recover?

You may be entitled to:

• Up to $2,500 per violation
• Attorneys’ fees
• Injunctive relief
• Other court-ordered remedies
   

The VPPA is one of the rare federal laws that gives consumers strong financial rights when companies misuse their data. To learn more, contact Morgan & Morgan for a free case evaluation.