Summary
This Third Circuit opinion addresses whether a plaintiff has Article III standing to sue a retailer for using session replay code to track her website browsing activity under Pennsylvania’s wiretapping statute and common-law privacy torts. The court held that the plaintiff failed to allege a concrete injury because the captured data was not sensitive or personal, and the tracking did not constitute a highly offensive intrusion into her solitude. Consequently, the court affirmed the district court’s dismissal for lack of subject matter jurisdiction but modified the order to dismiss without prejudice.
Topics
Practice areas
Questions Presented
- Whether Cook alleged a concrete injury in fact sufficient to establish Article III standing based on GameStop's alleged interception and tracking of her website activity under WESCA.
- Whether Cook's alleged injury was closely related to the traditional intangible harms of disclosure of private information or intrusion upon seclusion.
- Whether the District Court abused its discretion by dismissing the complaint with prejudice after finding that Cook lacked Article III standing.
Holdings
- Cook did not allege a concrete injury in fact because the capture of her ordinary website activity, without disclosure of sensitive or personal information, public dissemination, or intrusion into her private affairs or solitude, was not closely related to a traditionally recognized harm.
- A violation of WESCA does not automatically establish Article III injury; the plaintiff must allege concrete harm resulting from the violation, and a legislature may not create a federal injury merely by declaring nonharmful conduct unlawful.
- A dismissal for lack of Article III standing must generally be without prejudice, even when the district court believes amendment would be futile.
Key quotations
“An alleged statutory violation is not necessarily an injury in fact; “a concrete injury” is still required.” (p. 6)
“So “while [a plaintiff] does not need to exactly duplicate a traditionally recognized harm, [he or she] must still analogize to a harm of the same character of previously existing legally cognizable injuries.”” (p. 7)
“Critically, TransUnion tells us to consider the plaintiff’s concrete harm alleged, not the harm the statutory cause of action typically protects against.” (p. 13)
“Because the absence of standing leaves the court without subject matter jurisdiction to reach a decision on the merits, dismissals ‘with prejudice’ for lack of standing are generally improper.” (p. 16)
Factual background
GameStop used Microsoft's Clarity session-replay code on its retail website to capture users' mouse movements, clicks, scrolling, window resizing, keystrokes, search terms, and other interactions, and to transmit event data to a third-party server. Amber Cook visited the website in Pennsylvania, browsed products, used the search bar, and added a product to her cart, but did not provide her name, contact information, address, billing information, or other sensitive personal information. Cook alleged that GameStop and Microsoft intercepted her website communications without prior consent and sued under WESCA and for intrusion upon seclusion.
Procedural history
Cook alleged that GameStop used Microsoft Clarity session-replay code to capture her website interactions and asserted claims under the Pennsylvania Wiretapping and Electronic Surveillance Control Act and for intrusion upon seclusion. The Western District of Pennsylvania held that she had not alleged a concrete injury sufficient for Article III standing and dismissed the amended complaint with prejudice. The Third Circuit affirmed the dismissal for lack of standing but modified the judgment to make the dismissal without prejudice.
Remand instructions
The District Court's order is modified to dismiss the amended complaint without prejudice rather than with prejudice. The order is affirmed as modified.