Meta Pixel and the VPPA: what gets sent from your video pages

We loaded a US publisher's site in a clean browser on October 1, 2026 and recorded the request the Meta Pixel made on the first page. It went to www.facebook.com/tr/ as a POST, so it does not show up in the address of the request: you have to open its body. These are the fields that matter, with the values replaced by examples:

The same visit also set the _fbp cookie on the site and Meta's fr cookie. A visitor who is logged in to Facebook in the same browser carries Meta's own login cookies as well, which is what lets Meta tie the request to a profile.

On a home page, dl and pmd[title] say little. On a page that plays one video, they name it. Put that next to an identifier and the request reads as “this browser watched this video”, which is the disclosure the Video Privacy Protection Act is about: information that identifies a person as having requested or obtained specific video materials.

The statute allows that disclosure only with informed, written consent in a form distinct and separate from other legal or financial terms, sets liquidated damages of $2,500 per person, and gives plaintiffs two years to sue. Multiplied across a class of visitors, that is why these cases get filed.

Two questions decide most pixel cases, and courts disagree on both.

• Is pixel data “personally identifiable”? The Second Circuit said no in Solomon v. Flipps Media (2025), applying an “ordinary person” test: code an ordinary person cannot read does not identify anyone. Other courts have let similar claims go forward.
• Who is a “consumer”? The statute covers renters, purchasers and subscribers. The Second and Seventh Circuits accept a subscription that is not itself for video, such as a newsletter; the Sixth and D.C. Circuits require a link to the video. The Supreme Court took up the question in Salazar v. Paramount Global, hears argument on October 14, 2026, and is expected to rule in 2027.

Until then, what a site can control is the fact pattern: which pages the pixel runs on, what it sends from there, and what the visitor agreed to.

1. Open a page that plays a video in a private window, without accepting any banner.
2. Open the browser's developer tools, go to the Network tab and filter by facebook.com/tr.
3. Reload. Click a request and open its Payload. Look at dl, pmd[title] and fbp.
4. If the title or the address names the video, the pixel is reporting what was watched. Note whether it happened before you touched the banner.
5. Repeat for TikTok (analytics.tiktok.com), LinkedIn (px.ads.linkedin.com) and any other ad pixel on the site.

• Keep advertising pixels off the pages that play video, or load them there only after a consent that covers video viewing.
• Stop sending page titles and full addresses from those pages, and turn off automatic event and advanced matching features that add more detail.
• If you need the data, ask for the VPPA consent the statute describes: separate, written, and specific to sharing what someone watched.
• Keep dated evidence of what your pages send, so the answer to a demand letter is a record, not a guess.

This is practical guidance for an audit, not legal advice; how the VPPA applies to your site is a question for your counsel.