How the exposure works

The Meta Pixel is a snippet that reports activity from your site back to Meta for advertising. On a page with video, it can include the page or video URL and, from a cookie, the visitor’s Facebook ID. Sent together, those two pieces can reveal that an identifiable person watched a specific video. That is the disclosure the VPPA restricts, and it is the theory behind the wave of pixel VPPA class actions.

Three conditions have to line up: the page has video, the pixel captures what was watched, and an identifier goes with it. Remove any one and the VPPA pattern is not present.

Why the answer is currently unsettled

Courts disagree, so the honest answer is that it depends on where a case is filed and how the facts fall. The Second Circuit held in 2025 (Solomon v. Flipps Media) that video URLs and a Facebook ID sent in code were not personally identifiable information, because an ordinary person could not use them to identify what someone watched. The First Circuit applies a broader test. The Supreme Court agreed in January 2026, in Salazar v. Paramount Global, to decide part of the dispute: who counts as a “consumer” under the law. It hears argument on October 14, 2026, and a decision is expected by mid-2027. Until then, identical pixel behavior can be treated differently in different places.

The practical takeaway does not wait on the Court. The exposure is a payload you can see and control, so the sensible move is to know whether your video pages are sending it.

For specific Meta Pixel VPPA lawsuits and settlements, see our Enforcement Watch tracker.

How to check your video pages

The question that matters for your site is concrete: on pages that play video, is a pixel sending what was watched together with an identifier, and does it fire before consent?

DataTrue answers it by loading your video pages in a real browser and recording what each tag transmits. You can see whether the Meta Pixel is sending a video title or URL alongside a Facebook identifier, and whether it fires before the visitor agrees. Sensitive Data Detection inspects the payloads with fictitious personas, so the check never uses a real visitor. The output is a list of which video pages carry the VPPA pattern.

How to reduce the exposure

Get consent before the pixel fires on video pages. Consent is the VPPA’s clearest exception, and it has to be informed, written consent in a separate form, which a general cookie banner click has not been shown to meet. And limit what the pixel collects on those pages, so it is not sending the video watched. Confirm both with testing rather than assuming, because the exposure lives in the actual payload.