Certified Information Privacy Professional (CIPP): US - Cable Communications Policy Act and Video Privacy Protection Act, VPPA

What This Is

The Cable Communications Policy Act (CCPA) of 1984 and the Video Privacy Protection Act (VPPA) of 1988 are two U.S. sector?specific privacy statutes. The Cable Act governs how cable operators (and later, broadband providers) may collect, use, and disclose subscriber information, while the VPPA protects the “video?rental” records of consumers (including modern streaming?service viewing histories). Both laws create consumer?focused rights of notice, consent, and limited disclosure that are critical for any company that offers cable, broadband, or video?on?demand services—especially when those services are bundled with other digital products.

Real?world scenario: A national telecom company launches a new “TV?plus?Internet” bundle. To market add?on services it wants to share subscriber viewing data with a third?party ad network. The company must first determine whether the Cable Act’s “customer proprietary network information” (CPNI) rules and the VPPA’s “video?record” protections apply, and then obtain the proper consumer consents before any disclosure.

Key Terms & Provisions

• Customer Proprietary Network Information (CPNI): Information about the quantity, type, destination, or technical configuration of a subscriber’s communications that a cable operator collects in the ordinary course of business. Covered under the Cable Act; must be protected and disclosed only with consumer consent (or as otherwise permitted).

• Cable Communications Policy Act (CCPA) – 47?U.S.C. §§?531?537: Federal statute that pre?empts state privacy laws for cable services, establishes the CPNI rules, and requires “reasonable safeguards” for protecting subscriber data.

• Video Privacy Protection Act (VPPA) – 18?U.S.C. §§?2710?2711: Prohibits disclosure of a consumer’s video?rental or viewing history without prior written consent, and creates a private right of action for damages.

• Written Consent (VPPA): A signed, dated, and specific authorization from the consumer that must describe the exact purpose for which the video?record information will be used or disclosed. Electronic signatures are acceptable if they meet the E?Sign Act requirements.

• Opt?Out Disclosure (Cable Act): Cable operators must provide a clear, conspicuous notice (often called a “privacy notice”) that explains how CPNI will be used and gives subscribers the opportunity to opt out of non?essential disclosures.

• “Video?Record” (VPPA): Any information about a consumer’s video?rental, purchase, or viewing activity, including streaming?service watch history, DVD rentals, and pay?per?view purchases.

• “Covered Entity” (HIPAA) vs. “Cable Operator” (CCPA): Unlike HIPAA, the Cable Act does not require a “covered entity” definition; any provider of cable or broadband service is automatically subject to CPNI rules.

• Data?Sharing Exception (Cable Act): CPNI may be disclosed without consent for law?enforcement requests, emergency services, or to protect the safety of the subscriber or the public.

• Statute of Limitations (VPPA): A consumer must bring a VPPA claim within three years of the alleged violation; the statute of limitations is toll?ing while the claim is pending.

• Civil Penalties (VPPA): Each violation can result in $2,500 per consumer per incident (up to $10,000 for willful violations) and may be multiplied by the number of affected consumers.

• Pre?emption (Cable Act): The CCPA pre?empts state privacy statutes that are “substantially similar” to its CPNI provisions, but it does not pre?empt state consumer?protection laws that are broader (e.g., California Consumer Privacy Act).

Step?by?Step / Process Flow

1. Identify the Service Scope – Determine whether your product is a “cable service” (including broadband, satellite, or IPTV) and whether it collects video?record data (streaming history, rentals, etc.).
2. Map Data Flows – Catalog all CPNI and video?record elements, noting where they are stored, processed, and transmitted (e.g., internal analytics, third?party ad platforms).
3. Provide Required Notices – Draft a privacy notice that meets Cable Act opt?out requirements and a separate VPPA notice that explains the purpose of any video?record sharing. Publish both at account?creation and in the billing portal.
4. Obtain Written Consent – For any non?essential disclosure of CPNI or video?record data, capture a signed (or e?signed) consent that specifies the recipient, purpose, and duration. Store the consent record securely.
5. Implement Safeguards – Deploy technical controls (encryption, access controls, audit logs) that satisfy the “reasonable safeguards” standard of the Cable Act and the VPPA’s data?security expectations.
6. Monitor & Respond – Set up a compliance dashboard to track opt?out requests, consent revocations, and VPPA?related complaints; respond to any consumer request within the statutory timeframes (30?days for opt?out, 45?days for VPPA breach notice).

Common Mistakes

• Mistake: Assuming the Cable Act’s CPNI rules apply only to “telephone?style” cable lines and not to modern fiber?to?the?home broadband.
  Correction: CPNI covers all information about a subscriber’s use of the cable network, including broadband usage data.

• Mistake: Treating a click?through “I agree” checkbox as sufficient VPPA consent.
  Correction: VPPA requires written, specific, and dated consent; a generic click?through is not enough unless it meets E?Sign standards and clearly states the purpose.

• Mistake: Believing that a state privacy law automatically overrides the Cable Act.
  Correction: The Cable Act pre?empts state statutes that are “substantially similar” to its CPNI provisions; only broader consumer?protection statutes survive.

• Mistake: Forgetting to honor a subscriber’s opt?out for CPNI while still sharing the data with a marketing partner.
  Correction: Once a subscriber opts out, the operator must cease all non?essential disclosures of CPNI, and must delete or segregate the data from any third?party pipelines.

• Mistake: Assuming that anonymized viewing data is exempt from the VPPA.
  Correction: Even de?identified or aggregated data can be considered a “video?record” if it can be reasonably re?identified; the safest approach is to obtain consent before any sharing.

CIPP Exam Insights

1. Scope Distinction: The exam often asks you to differentiate Cable Act CPNI (telecommunications?network data) from VPPA video?record (content?consumption data). Remember: CPNI = “how” the network is used; VPPA = “what” video content was accessed.
2. Consent Mechanics: Expect a question on the form of consent required by the VPPA (written, specific, dated) versus the opt?out notice required by the Cable Act.
3. Pre?emption Nuance: A classic trap is the statement “State privacy laws always supersede the Cable Act.” The correct answer is that the Cable Act pre?empts only those state laws that are “substantially similar” to its CPNI provisions.
4. Penalty Calculations: Be ready to calculate potential civil damages under the VPPA (e.g., $2,500 per consumer per violation, up to $10,000 for willful violations).

Quick Check Questions

1. Scenario: A streaming service bundled with a broadband plan wants to share a subscriber’s watch history with a third?party ad network for targeted ads.
   Answer: The service must obtain written VPPA consent that specifically authorizes the disclosure of the subscriber’s video?record information to the ad network. A simple privacy?policy notice is insufficient.

2. Scenario: A cable operator receives a subpoena for a subscriber’s CPNI related to a civil lawsuit. The operator has already obtained the subscriber’s opt?out for marketing disclosures.
   Answer: The operator may disclose the CPNI without consent because a subpoena is a lawful request that falls under the Cable Act’s data?sharing exception.

3. Scenario: A state passes a privacy law requiring “opt?in” consent before any sharing of subscriber data. The cable operator already provides an “opt?out” notice per the Cable Act.
   Answer: The Cable Act pre?empts the state law if the state provision is “substantially similar” to the CPNI rules; the operator can continue to rely on the federal opt?out framework.

Last?Minute Cram Sheet

1. Cable Act CPNI Definition – 47?U.S.C. §?531(b).
2. VPPA “Video?Record” Scope – 18?U.S.C. §?2710(2).
3. Written Consent Required – VPPA §?2710(4).
4. Opt?Out Notice Required – Cable Act §?531(c).
5. Civil Penalty per VPPA Violation – $2,500 (up to $10,000 for willful).
6. Statute of Limitations – 3?years (VPPA).
7. Pre?emption Trigger – State law “substantially similar” to CPNI rules (Cable Act).
8. Reasonable Safeguards – Encryption & access logs (Cable Act).
9. VPPA Private Right of Action – Consumers can sue for damages (18?U.S.C. §?2711).
10. Exam Trap: “The Cable Act applies only to cable TV, not broadband.” – False; it covers all cable?service providers, including broadband and IPTV.

Use this guide to cement the core obligations, consent mechanics, and exam?ready distinctions for the Cable Communications Policy Act and the Video Privacy Protection Act. Good luck!