This week, the Supreme Court hears oral argument in Salazar v. Paramount Global. The case asks how far the Video Privacy Protection Act, a law Congress passed in 1988 to keep video stores from disclosing what their customers rented, reaches into the modern web. The specific question is narrow: does someone count as a protected “consumer” if they signed up for anything a video provider offers, or only if they signed up for its video content? The practical question is much bigger. It decides how many businesses with a video player and a Meta Pixel on the same page can be sued for $2,500 per visitor.
Banks and credit unions are not parties to this case, and no banking trade group appears among the amicus filers on the Supreme Court docket. That should not be read as a sign the industry has no stake. Your website almost certainly hosts video (product explainers, financial education, brand spots), almost certainly runs third-party tracking code, and is already a target for a separate wave of privacy litigation built on California law. The VPPA is one more door. The court is deciding how wide to open it.
The Supreme Court Is About to Decide How Much Tracking Your Marketing Team Can Do
The facts are not in dispute in the way the law is. Michael Salazar subscribed to a free email newsletter from 247Sports.com, a Paramount-owned college recruiting site, in 2022. He says he later watched videos on the site while logged into Facebook, and that a Meta Pixel installed on 247Sports sent his Facebook ID and the videos he watched to Meta without his consent, according to SCOTUSblog’s case preview. He sued as a class action in federal court in Nashville, seeking $2,500 per class member plus punitive damages and attorney’s fees.
A district judge and a divided Sixth Circuit panel threw the case out. Their reasoning: a newsletter is not audiovisual content, so subscribing to one doesn’t make Salazar a VPPA “consumer.” The Second and Seventh Circuits went the other way in nearly identical cases, one involving the NBA’s free newsletter and another involving a classic-TV site’s show reminders. That split is why the justices took the case.
Here is what is verified and what is argument. Verified: the question presented, the circuit split, the argument date, and the $2,500 statutory floor, which the statute guarantees whether or not anyone can show actual harm. Argued: everything about consequences. Salazar’s side says the statute’s text covers “goods or services” of any kind from a video provider and the Sixth Circuit added a limit Congress didn’t write. Paramount says that reading turns a video-rental law into what it calls an “unworkable internet-privacy regime,” exposing virtually any company with a website to class liability for routine activity. Meta, the U.S. Chamber of Commerce, the National Retail Federation, and media trade groups filed on Paramount’s side. The Electronic Privacy Information Center filed for Salazar.
Two things the court will not decide. It won’t rule on whether any particular pixel setup is illegal, and it won’t touch the state laws that are generating most of the litigation against financial institutions. A win for Paramount narrows one theory. It does not clean up your tag manager.
The Lawsuits Are Already Here, and California Is Writing Most of Them
Plaintiffs file roughly 200 VPPA suits a year, according to an American Bar Association figure cited in a Stacker-distributed explainer produced by Clym, a privacy-compliance vendor. That number is small next to California. More than 1,000 lawsuits under the California Invasion of Privacy Act were filed in 2025 alone, according to Krieg DeVault, a firm that represents financial institutions. Reuters has counted more than 4,700 digital-wiretapping suits since 2022, per a Clark Hill summary.
These are not only aimed at the giants. Named defendants have included TD Bank, Barclays, and Capital One, but Krieg DeVault reports the theories have moved down-market to community institutions with modest online footprints. In March, a federal court in Wisconsin let nine claims survive a motion to dismiss in Gassman v. Guardian Credit Union. The credit union argued its pixels were common, anonymized, and disclosed in its privacy policy. The court said those were factual disputes for later, which means discovery, which means cost. In Florida, Suncoast Credit Union was hit with a proposed class action in 2025 alleging that trackers on its site disclosed information collected while serving its members.
The geography matters more than most marketing teams realize. Plaintiffs’ firms argue that a state’s wiretap law applies whenever one of its residents loads your website, and they file in all-party-consent states like California, Florida, and Illinois. Krieg DeVault says it is seeing demand letters and suits against institutions with no branches, no operations, and no marketing in the plaintiff’s state. Often the plaintiff isn’t even a customer or member. They visited the site.
If your institution runs digital account opening or a paid social campaign with loose geo-targeting, you already have California visitors. The absence of a branch there is no longer a defense anyone should count on.
The CCPA Didn’t Exempt You, and Complying With It Doesn’t Protect You
Two California laws are doing two different things here, and conflating them leads to bad decisions.
The California Consumer Privacy Act is the compliance burden. Most bank marketers have been told the Gramm-Leach-Bliley Act exempts them. It doesn’t, not fully. The CCPA’s GLBA carve-out covers data, not institutions. Information collected to provide a financial product is generally exempt; IP addresses, browsing history, and ad-interaction data from your public pages and marketing campaigns generally are not, as Davis Wright Tremaine and Hinshaw laid out when the law took effect. So the exact data your pixels collect sits squarely inside the CCPA’s opt-out and disclosure rules. Credit unions should ask counsel separately whether and how the CCPA reaches a member-owned cooperative; don’t assume an answer either way.
CIPA is the litigation engine. It’s a 1967-era wiretap and eavesdropping statute with a private right of action and statutory damages, and plaintiffs have argued that pixels, cookies, and session-replay tools are wiretaps and “pen registers.” The CCPA, by contrast, lets consumers sue only over data breaches.
Here is where the regulatory stack becomes genuinely unreasonable for an institution trying to do the right thing. You can build a CCPA-compliant cookie banner, honor opt-outs, publish a detailed privacy notice, and still face a CIPA claim, because CCPA compliance has never been a defense to CIPA. Spending the compliance budget on one California law buys no safe harbor under the other. For a community bank marketing team of three, that’s the actual cost of overlapping, uncoordinated rules: the work doesn’t stack, the exposure does.
Sacramento Admitted the Problem, Then Fixed About a Third of It
California’s own governor has now said the litigation has gotten out of hand. On September 30, Gov. Gavin Newsom signed SB 690, which, starting January 1, 2027, ends private lawsuits under CIPA’s pen-register provision when the conduct happens on a website or app. Only the attorney general can bring those claims now, and the change applies retroactively to pending cases filed within the prior two years. In his signing message, Newsom described the “vexatious use of CIPA lawsuits and demand letters to extract settlement money” and asked the legislature to come back next year for the rest.
That’s a real win, and it’s narrow. Roughly a third of CIPA website cases alleged only a pen-register claim, according to Captain Compliance. The core wiretap provision, Section 631, is untouched. The original version of the bill, which passed the state Senate unanimously in 2025, would have exempted tracking done for a “commercial business purpose” as the CCPA defines it. That would have tied the two laws together and let CCPA compliance count for something. It was stripped out in July after privacy groups objected that it was too broad.
Our view: a statute written for phone taps should not be the primary rulebook for website analytics, and a business that follows the state’s own consumer-privacy law in good faith should not be a soft target under a different law from the same state. California came close to fixing that and backed off. Until it finishes the job, the burden of reconciling the two falls on marketing and compliance teams at institutions that had nothing to do with writing either law.
What a Bad Ruling Would Cost You
If the Supreme Court sides with Salazar, the “consumer” definition expands to anyone who subscribed to anything from a site that offers video. Think about what your institution asks web visitors to sign up for: rate alerts, an e-newsletter, a financial-literacy email series, a webinar registration, online banking itself. If any of those pages share a domain with a video player that fires a pixel, plaintiffs will test the theory against you.
The math is what makes it dangerous. Take a hypothetical: a credit union with 10,000 email subscribers who also watched a product video while a Meta Pixel was firing. At the $2,500 statutory minimum, that’s a $25 million claim on paper, before attorney’s fees. No court is likely to award that against a community institution, and most of these cases settle for far less. But settlement value is driven by the theoretical exposure, and for a $500 million institution, the theoretical exposure exceeds a decade of marketing budget. The $5 million Dapper Labs VPPA settlement, approved in April with no admission of wrongdoing, shows where these cases land when a company decides litigation risk costs more than writing a check.
If Paramount wins, the VPPA theory shrinks to people who actually subscribed to video. That reduces one category of exposure. It changes nothing about CIPA Section 631, Florida’s wiretap law, or negligence-per-se claims built on the GLBA.
Either way, the pixel stack that drives your campaign attribution is the asset at risk. We wrote in The Measurement Gap about how much bank marketing reporting already depends on third-party tracking. Every pixel you have to pull or gate behind consent widens that gap, which is why the fix has to be done deliberately rather than in a panic after a demand letter arrives.
What to Do Before the Ruling Comes Down
A decision is likely by the end of June 2027. None of the steps below depend on how it comes out.
Map every tag on every page that hosts video. Assign this to whoever owns your tag manager (usually digital marketing or the web vendor) this month. Pull a list of every page with an embedded video, including YouTube and Vimeo embeds, then list every pixel and script that fires on those pages and what each one sends. Look specifically for any event that passes the video title or URL alongside an identifier like a Facebook ID or hashed email. That combination is the VPPA claim.
Take tracking off authenticated and application pages. Online banking, the account-opening flow, and loan applications should run no third-party advertising pixels at all. This is where the GLBA-based claims in cases like Gassman come from, and it’s where the data is most sensitive. If you’re losing applicants mid-flow (we covered how many in Banks Are Spending More to Acquire Customers While Losing Most Digital Applicants), measure that with first-party analytics, not a Meta event.
Test your cookie banner’s “Reject All” button, not just its design. Have someone open your site in a clean browser, reject all cookies, and watch the network tab to see whether any pixel still fires. “Broken banner” cases, where tracking continues after a visitor opts out, are one of the fastest-growing claim types according to Krieg DeVault. A banner that promises something your site doesn’t do is worse than no banner.
Rewrite the privacy notice in plain terms. Generic boilerplate has hurt defendants at the motion-to-dismiss stage. Name the categories of tools you use and the types of companies that receive visitor data. Run the draft past compliance and ask specifically how it squares with your GLBA privacy notice, since mismatches between the two are exactly what plaintiffs quote.
Ask counsel two questions. First, whether your online banking terms and website terms include arbitration and class-waiver language drafted to reach non-customer visitors, which is an open legal question but worth having. Second, whether any pending demand letter rests only on a pen-register theory that SB 690 now bars. Don’t ignore a letter on that assumption; let counsel make the call.
Pull your vendor contracts. Check your agreements with Meta, Google, LinkedIn, your web vendor, chat provider, and any session-replay tool for indemnification and data-use limits. Most marketing teams have never read these terms, and they matter the day a suit names both you and the vendor.
The goal is not to strip your site of measurement. It’s to know exactly what fires, where, and on whose consent, so you can defend it in front of a judge or a board.
Related MarketingBanks Coverage
- The Measurement Gap: Bank Marketing Heading Into 2027
- Google Analytics Will Now Drop Traffic From Domains You Don’t Approve
- Banks Are Spending More to Acquire Customers While Losing Most Digital Applicants
