Dapper Labs — the company behind NFT-driven fan sites such as NFL All Day, Disney Pinnacle, UFC Strike, NBA Top Shot and La Liga Golazos — agreed to a $5 million settlement after a putative class action alleged it disclosed subscribers’ personally identifiable information (PII) to third parties without consent. The suit, covering accounts active between June 15, 2020 and Jan. 30, 2025, claims data was shared with firms including Meta, Google, Microsoft, Snapchat, Reddit, X and TikTok in ways that violated the federal Video Privacy Protection Act (VPPA). Under the settlement, class members can file a claim for a pro rata cash payment (up to about $5 each depending on claims filed), Dapper will suspend certain tracking pixels that could capture video titles, and the company says it settled to avoid the cost and uncertainty of continued litigation while denying wrongdoing. This case matters because the VPPA — a federal law that limits disclosure of viewers’ video-related PII — has been adapted for the digital age and has prompted suits against a range of online platforms and publishers over tracking and ad-tech practices. Beyond the headline dollar figure, the settlement highlights broader industry pressures: companies that use tracking pixels, analytics, and ad networks must reconcile those tools with privacy laws like the VPPA and overlapping regimes such as California’s CCPA or the EU’s GDPR, and can expect increased scrutiny from both plaintiffs’ lawyers and regulators. For consumers it underscores why seemingly small website tracking mechanisms can have legal and financial consequences; for the industry it signals a continuing trend toward stricter data governance and audit of third-party integrations.