Ad tech's biggest privacy risk is 1960s-era wiretap laws

The most dangerous privacy threat to ad tech is not whatever state law passed last month, it is the statutes written decades ago that plaintiff attorneys are now stretching to cover modern tracking. Since 2022 more than 10,000 data privacy cases have been filed in US courts - 3,414 in 2025 alone - spanning wiretapping, web tracking, data breaches and unauthorized data sharing, per Müge Fazlioglu, principal researcher at the International Association of Privacy Professionals. The tab so far is roughly $7 billion in settlements, and Fazlioglu, who co-authored a new IAPP report on pixel and tracker litigation, is blunt about the shift: "Privacy litigation is no longer a minor risk. It's now become a major source of legal and financial exposure for organizations." The Video Privacy Protection Act, written in 1988 for VHS renters, carries $2,500 per violation and demands written, informed consent that is separate from other obligations and renewed every two years. Crucially, Fazlioglu warns, courts now look at what a company's analytics providers, ad partners and session-replay vendors are doing: "You are responsible for what the third parties you work with are doing."

The crux

Decades-old statutes (the 1967 California Invasion of Privacy Act, the 1988 VPPA) are being stretched to turn every pixel firing on a publisher's page into a class-action exposure, with liability flowing upstream through vendors.

Sell-side read

Every third-party tag, analytics call and session-replay tool on a publisher's site is now a litigation surface. Publishers need distinct, two-year-renewable consent and hard contractual controls over downstream vendors, not just a cookie banner.

Watch

Whether the VPPA "consumer" definition broadens further in 2026 rulings; that would drag more video publishers into the crosshairs.