The biggest privacy risk facing ad tech isn’t whatever state privacy law passed last month; it’s the ones that passed decades ago.
The Video Privacy Protection Act was written to protect VHS renters in 1988. Another, the California Invasion of Privacy Act, was enacted in 1967 to stop illegal wiretapping, about which there was a lot of paranoia at the time. (Whenever I write about CIPA, I think about that scene from “The Conversation” with Gene Hackman, where his character rips apart his apartment looking for hidden bugs that aren’t there.)
Today’s equivalent is a lot less dramatic: It’s a pixel silently firing in the background on a website.
Over the past few years, plaintiff attorneys have figured out that these vintage statutes are surprisingly malleable, and they’ve been stretching them to target modern tracking technology.
Since 2022, there have been more than 10,000 data privacy cases filed in US courts – 3,414 in 2025 alone – spanning wiretapping, data breaches, web tracking and unauthorized data sharing, according to Müge Fazlioglu, a principal researcher at the IAPP with a focus on privacy law and policy.
And she’d know. She counted.
Fazlioglu co-authored a new IAPP report on the legal trends driving pixel and tracker litigation and what the surge in cases means for companies on the receiving end.
The tab so far? Roughly $7 billion in settlements.
“Privacy litigation is no longer a minor risk,” Fazlioglu said. “It’s now become a major source of legal and financial exposure for organizations.”
Fazlioglu spoke with AdExchanger.
AdExchanger: What’s driving the acceleration in data privacy cases? Is it that plaintiff attorneys are getting more creative?
MÜGE FAZLIOGLU: Plaintiffs are increasingly relying on older statutes in creative ways, particularly around web tracking, video viewing and data sharing with third parties. And the risk is real even for companies that think their practices are commonplace.
Things are moving very quickly, and compliance lessons are emerging from private litigation. Court decisions are becoming an important source of privacy law in their own right, so organizations need to understand not just what legislators or regulators are saying, but also what the courts are interpreting.
What’s the theory of harm in a pixel case?
Harm is one of the trickiest parts of privacy law, because it’s so hard to conceptualize. Sometimes it’s financial, sometimes it’s emotional and sometimes you may not see the harms right away, but they come out later.
That’s part of what makes privacy harms so difficult to prove. But the discomfort of knowing your data was shared without your knowledge is real, even if it’s hard to put a dollar amount on it.
What does “good” consent actually look like for a company running third-party tags on its site? Because just having a cookie banner clearly isn’t enough.
Vague, generalized disclosures definitely aren’t enough. For example, has consent been obtained in a way that’s distinct from other consumer obligations? Is it renewed every two years? Is the ability to opt out clear?
Companies also can’t rely on consent that a third party obtained on their behalf, because it might not be sufficient or meet the VPPA bar, for example.
How exposed are companies because of what their downstream vendors and partners are doing?
The courts are increasingly looking not just at what a company is doing, but at what its analytics providers, advertising partners and session replay providers are doing with consumer data. In some cases, vendors have been treated as extensions of the business. In others, their independent use or potential use of data has created liability exposures.
Organizations need strong contractual controls and a clear understanding of how their vendors collect, process and use data. You are responsible for what the third parties you work with are doing.
What should digital publishers and content platforms understand about their exposure under the Video Privacy Protection Act?
The courts are still grappling with who qualifies as a consumer [under VPPA], what constitutes personally identifiable information and when disclosures to third parties trigger liability. And the potential damages remain significant. [It’s $2,500 per violation.]
The consent requirements are also stricter than most companies realize. Consent needs to be written, informed and separate from other consumer obligations and it expires every two years.
There’s still no federal privacy law, but, as we’ve been talking about, there have been thousands of private cases and billions in settlements. At what point does private litigation become almost like de facto regulation, essentially doing what Congress hasn’t?
I wish I knew the answer to that question. It’s hard to say one approach is better than the others, and even if a federal law passed tomorrow, a lot would depend on what it actually said. There are real disagreements over things like preemption and private rights of action.
What I do know is that court decisions are becoming an important source of privacy law, and companies that understand the legal landscape will be much better positioned to stay ahead of regulatory risk rather than just responding after a complaint is filed.
This interview has been lightly edited and condensed.
🙏 Thanks for reading! As always, feel free to drop me a line at allison@adexchanger.com with any comments or feedback. And guess what I found? Live action lawyer cat!
📣 In non-cat-related news (yes, there is such a thing), you still have time to snag your ticket to Programmatic IO coming up in New York City on September 28 and 29.
We’ve got a great agenda lined up for you, including a panel on AI governance with Yum! Brands, The Brandtech Group and BBDO, and a session hosted by privacy attorney Daniel Rosenzweig of DBR Tech Law on why it’s critical to get AI right from Day One. See you there!
