The VPPA very much applies to online entities. Netflix can collect all the info it wants about you, but is very much limited in what it can share with external parties.

If anything, the law has given cover to shady walled garden business practices that would not have survived otherwise.