Summary
The Ninth Circuit affirmed the dismissal of Ashley Popa’s putative class action against Microsoft for lack of Article III standing. The court held that alleged session-replay tracking of her interactions with a pet-supplies website did not constitute a concrete injury because the information collected was not sufficiently analogous to harms traditionally actionable under common-law privacy torts. The court rejected the argument that a statutory privacy violation alone established concrete injury under TransUnion LLC v. Ramirez.
Topics
Practice areas
Questions Presented
- Whether Popa alleged a concrete injury sufficient to establish Article III standing for claims based on Microsoft's session-replay technology.
- Whether an alleged violation of Pennsylvania's Wiretapping and Electronic Surveillance Control Act necessarily constitutes a concrete injury for Article III purposes.
- Whether pre-TransUnion Ninth Circuit privacy decisions established a categorical rule that violation of a statute protecting a substantive privacy right automatically confers Article III standing.
Holdings
- Popa failed to allege a concrete injury because the tracking of her interactions with the website did not cause harm closely related to a traditionally actionable common-law injury, such as the highly offensive interference or disclosure protected by intrusion upon seclusion or public disclosure of private facts.
- A statutory violation alone does not establish Article III standing; the plaintiff must also allege a concrete harm resulting from the violation.
- Those Ninth Circuit decisions do not establish a categorical rule that any violation of a statute codifying a substantive privacy right automatically confers Article III standing.
Key quotations
“At base—and all we need to acknowledge to decide this case—is that TransUnion requires a court to assess whether an individual plaintiff has suffered a harm that has traditionally been actionable in our nation’s legal system.” (13)
“In short, there existed no free-roaming privacy right at common law but rather four discrete torts that protected specific kinds of privacy-related harms.” (15)
“For the reasons stated above, she has not. The district court’s ruling on the motions to dismiss is AFFIRMED.” (21)
Factual background
Ashley Popa visited the Pets Supplies Plus website, which was operated by PSP Group LLC and used Microsoft's Clarity session-replay technology. Clarity allegedly recorded and reproduced aspects of her website interactions, including mouse movements, clicks, product views, scrolling, and text input; masking software allegedly omitted her street number and ZIP code from delivery information. Popa alleged that the technology collected her pet-store preferences and street name, and asserted statutory wiretapping and privacy claims.
Procedural history
Popa filed a putative class action alleging violations of Pennsylvania's Wiretapping and Electronic Surveillance Control Act and invasion of privacy based on Microsoft's session-replay technology. The district court transferred the case from the Western District of Pennsylvania to the Western District of Washington, then concluded that Popa lacked Article III standing, dismissed the action without prejudice with leave to amend, and denied Microsoft's Rule 12(b)(6) motion as moot. Popa appealed without further amending the complaint; her appeal as to PSP Group was later dismissed by stipulation, leaving Microsoft as the appellee.