Ashley Popa v. Harriet Carter Gifts Inc.
No. 21-2203
United States Court of Appeals for the Third Circuit
October 18, 2022
2022 Decisions 828
Opinions of the United States Court of Appeals for the Third Circuit
10-18-2022
Ashley Popa v. Harriet Carter Gifts Inc.
Follow this and additional works at: https://digitalcommons.law.villanova.edu/thirdcircuit_2022
Recommended Citation
“Ashley Popa v. Harriet Carter Gifts Inc.” (2022). 2022 Decisions. 828. https://digitalcommons.law.villanova.edu/thirdcircuit_2022/828
This October is brought to you for free and open access by the Opinions of the United States Court of Appeals for the Third Circuit at Villanova University Charles Widger School of Law Digital Repository. It has been accepted for inclusion in 2022 Decisions by an authorized administrator of Villanova University Charles Widger School of Law Digital Repository.
UNITED STATES COURT OF APPEALS FOR THE THIRD CIRCUIT
No. 21-2203
ASHLEY POPA, individually and on behalf of all others similarly situated, Appellant v. HARRIET CARTER GIFTS, INC., a Pennsylvania corporation; NAVISTONE, INC., a Delaware corporation
Appeal from the United States District Court for the Western District of Pennsylvania (D.C. Civil Action No. 2-19-cv-00450) District Judge: Honorable William S. Stickman, IV
Argued on June 8, 2022
Before: CHAGARES, Chief Judge, AMBRO, and FUENTES, Circuit Judges
(Opinion Filed October 18, 2022)
Kelly K. Iverson
Gary F. Lynch (Argued)
Elizabeth Pollock-Avery
Lynch Carpenter
1133 Penn Avenue
5th Floor
Pittsburgh, PA 15222
Counsel for Appellants
Sarah A. Ballard
Paul G. Karlsgodt (Argued)
Baker & Hostetler
1801 California Street
Suite 4400
Denver, CO 80202
Carrie H. Dettmer Slye
Baker & Hostetler
312 Walnut Street
Suite 3200
Cincinnati, OH 45202
Counsel for Appellee Harriet Carter Gifts, Inc.
David W. Bertoni (Argued)
Eamonn R. C. Hart
David Swetnam-Burland
Brann & Isaacson
184 Main Street
4th Floor
P. O. Box 3070
Devin J. Chwastyk
McNees, Wallace & Nurick
100 Pine Street
P. O. Box 1166
Harrisburg, PA 17101
Counsel for Appellee NaviStone, Inc.
OPINION OF THE COURT
AMBRO, Circuit Judge
This case began with a quest for pet stairs. Searching for that item, Ashley Popa browsed the website of Harriet Carter Gifts, added a set of stairs to her cart, but then left the website without making a purchase. That might have been the end of it. But she later discovered that, unbeknownst to her as she was browsing the website, a third-party marketing service Harriet Carter was using, NaviStone, tracked her activities across the site. This, Popa believed, violated Pennsylvania‘s anti-wiretapping law, and she sued both entities (collectively, the “Defendants“) in a Pennsylvania court (though they later removed the case to federal court).
Pennsylvania‘s Wiretapping and Electronic Surveillance Control Act (“WESCA” or “Act“),
I. Background
In 2018, Ashley Popa used her iPhone to view Harriet Carter Gifts’ website. A pop-up window asked for her email address, which she provided. She searched for pet stairs, added a set to her cart, and began (but never completed) the checkout process.
There was more to that online interaction than met the eye. As Popa clicked links, used the search function, and tabbed through form fields on the website, her browser simultaneously communicated with two entities: Harriet Carter (this Popa obviously knew) and a third-party marketing service, NaviStone, that it was using (this Popa did not know). Her communications with Harriet Carter told the website what to display on her screen and what to place in her cart. The messages to NaviStone alerted it to how Popa was interacting with the website (which pages she visited, when she filled in an email address, when she added an item to her cart, and so on).
The testimony and evidence are technical about how these communications were sent, but the important points for our purposes are not. When Popa—or any other user at that time—loaded the Harriet Carter website, her browser sent a
In 2019, Popa sued Harriet Carter and NaviStone over their use of the OneTag software. She brought two counts: a claim for violation of the WESCA and a common law claim for invasion of privacy. The District Court dismissed the common law claim but allowed the WESCA claim to go to summary judgment. As noted, the Court then ruled for the Defendants. Popa now appeals.1
We give a fresh (that is, de novo) review to the District Court‘s grant of summary judgment, viewing the facts and making all reasonable inferences in the non-movant‘s favor. TitleMax of Del., Inc. v. Weissmann, 24 F.4th 230, 236 n.3 (3d Cir. 2022). Summary judgment is appropriate if “there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.”
When asked to interpret provisions of Pennsylvania law, “the decisions of the Pennsylvania Supreme Court are the authoritative source.” Spence v. ESAB Grp., Inc., 623 F.3d 212, 216 (3d Cir. 2010). If there is no controlling decision, our task is to predict how that Court would rule on an issue. Id. That prediction may be informed by “decisions of state intermediate appellate courts, of federal courts interpreting that state‘s law, [] of other state supreme courts that have addressed the issue,” and other sources “tending convincingly to show how the highest court in the state would decide the issue at hand.” Id. at 216–17 (internal quotation marks omitted).
III. Discussion
The WESCA offers a private civil cause of action to “[a]ny person whose wire, electronic or oral communication is intercepted, disclosed or used in violation of [that statute]” against “any person who intercepts, discloses or uses or procures any other person to intercept, disclose or use, such communication.”
Popa, here proceeding only under Pennsylvania‘s Act, contends that NaviStone violated that statute by intercepting her communications with Harriet Carter Gifts’ website. Harriet Carter, in turn, also violated the Act, she asserts, by “procur[ing] any other person [i.e., NaviStone] to intercept” her communications.
A.
NaviStone and Harriet Carter are liable to Popa only if NaviStone “intercepted” Popa‘s communications.
The WESCA‘s use of “intercept” thus reduces to acquiring certain communications using a device. And based on just that definition, anyone could “intercept” communications, including people who “acquire” a text message or chat sent to them. The Defendants, though, argue that Pennsylvania courts have added a gloss to the Act‘s statutory definition, making it so that no interception occurs when a direct recipient is the one acquiring the communications. Because, they claim, NaviStone was a direct party to Popa‘s communications, they are free from all liability.
For years, Pennsylvania courts routinely determined in criminal suppression cases that no interception had occurred under the WESCA when the alleged “interceptor” was the direct recipient of a communication. Two Pennsylvania cases illustrate this.
In the first, Commonwealth v. Proetto, 771 A.2d 823, 826–27 (Pa. Super. Ct. 2001). E.E., the victim, saved her online conversations with the defendant and handed them over to the police. Id. at 826. Later, when a detective entered the chatroom impersonating another 15-year-old girl, he logged messages the defendant sent “her” asking for a nude video in exchange for nude photos of himself. Id. at 827. The
The Pennsylvania Superior Court held the Act was not in play because the communications were not “intercepted.” Id. at 828–29, 831–32. Particularly, the detective‘s use of the chatroom was not an “interception” because he was the “intended recipient of [the defendant‘s] communications,” even if he misrepresented his true identity. Id. at 831. Thus when “a party receives information from a communication as a result of being a direct party to the communication, there is no interception.” Id.
In the second case, Commonwealth v. Cruttenden, the Pennsylvania Supreme Court reaffirmed Proetto‘s holding: when something is communicated to a direct recipient, there is “no eavesdropping or listening in,” so “no interception [could take] place.” 58 A.3d 95, 100 (Pa. 2012). In that case, an officer used the phone of the defendant‘s accomplice to text the defendant about a drug deal. Id. at 96. Posing as the accomplice, the officer answered several questions from the defendant to confirm his identity before the defendant began to confide in him. Id. When those text messages were later used at trial, the defendant tried to suppress them as violations of the WESCA. Id. at 97.
The Pennsylvania Supreme Court, relying at length on Proetto, held that there was no WESCA violation because the officer was the “intended recipient” of the communication. Id. at 100. “That a police officer does not identify him- or herself, or misrepresents his or her identity, does not change the fact that he or she is a direct party to the conversation, and by virtue of being a direct party to the conversation, is deemed the
If these cases stood alone, their expansive language would, as the Defendants argue, suggest Pennsylvania courts have carved out direct recipients from the WESCA‘s reach. But they aren‘t the last word on the issue.
In 2012, a new set of the Pennsylvania General Assembly‘s amendments to the WESCA went into effect, including an expanded definition of “intercept.” That definition now reads (with the added language underlined):
“Intercept.” Aural or other acquisition of the contents of any wire, electronic or oral communication through the use of any electronic, mechanical or other device. The term shall include the point at which the contents of the communication are monitored by investigative or law enforcement officers. The term shall not include the acquisition of the contents of a communication made through any electronic, mechanical or other device or telephone instrument to an investigative or law enforcement officer, or between a person and an investigative or law enforcement officer, where the investigative or law enforcement officer poses as an actual person who is the intended recipient of the communication, provided that the Attorney General, a deputy attorney general designated in writing by the Attorney General, a district attorney or an assistant district attorney designated in writing by a district attorney of the county wherein the investigative or law
enforcement officer is to receive or make the communication has reviewed the facts and is satisfied that the communication involves suspected criminal activities and has given prior approval for the communication.
The third sentence is a key change. In adding it, the specific facts and holdings of Proetto and Cruttenden—exempting a law enforcement officer from liability for acquiring communications when he is an “intended recipient” or is posing as one—are now explicitly included as a carve-out in the definition of “intercept.”
The “inclusion of a specific matter in a statute implies the exclusion of other matters” under the expressio unius est exclusio alterius (the expression of one thing is the exclusion of the other) canon of statutory interpretation. Atcovitz v. Gulph Mills Tennis Club, Inc., 812 A.2d 1218, 1223 (Pa. 2002); see also Andrus v. Glover Constr. Co., 446 U.S. 608, 616–17 (1980) (“Where Congress explicitly enumerates certain exceptions to a general prohibition, additional exceptions are not to be implied, in the absence of evidence of a contrary legislative intent.“). Thus inclusion of one exception implies the deliberate exclusion of another. Here the Pennsylvania legislature decided to codify a specific, narrow intended-recipient exemption for law enforcement, limiting Proetto and Cruttenden to their facts. This implies it chose to reject the broader implications of those cases.
The Pennsylvania legislature had the opportunity to adopt the expansive language from those opinions. And it had
Resisting this outcome, Defendants contend that Commonwealth v. Diego, a criminal suppression case decided by Pennsylvania‘s intermediate appellate court after the 2012 amendments, revived a sweeping direct-party exception to the WESCA. See 119 A.3d 370 (Pa. Super. Ct. 2015). We disagree.
Diego involved a text message conversation between two consenting participants that was later “subsequently relayed” by one of them to the police after “the communication ha[d] ended.” Id. at 381. The Court allowed the text message into evidence, as the recipient (Still) “control[led] the destiny
Considering that the WESCA “is to be strictly construed to protect individual privacy rights,” Com. v. Shreffler, 201 A.3d 757, 764 (Pa. Super. Ct. 2018), we do not hesitate to limit the holding in Diego to the facts of that case. Though it mentions Diego and Still communicating “directly” by text messages and Still “relay[ing]” those messages to the police, that is hardly enough to resurrect a broad direct-party exception. 119 A.3d at 380–81. We therefore discern no principled basis to rule that Diego authorizes, absent consent, the kind of surreptitious tracking that occurred here.
The Pennsylvania Superior Court apparently agrees with us. It has since reframed Diego as a consented intercept case rather than a case not involving an intercept. See Commonwealth v. Byrd, 2018 WL 1465219, at *5 & n.16 (Pa. Super. Ct. Mar. 26, 2018) (citing Diego for the proposition that “[t]he mutual consent exception [in Section 5704(4)] permits interception of conversations in instances where the defendant ‘knew, or should have known, that the conversation was recorded‘“) (emphasis added). This reframing, when paired with our analysis of the WESCA‘s plain language and statutory history, persuades us the Pennsylvania Supreme Court would rule that there is no sweeping direct-party exception to civil liability under the WESCA.5 See Covington v. Cont‘l Gen. Tire, Inc., 381 F.3d 216, 218 (3d Cir. 2004). Thus NaviStone
B.
This leads to our next question: when NaviStone intercepted Popa‘s electronic communications, where did that interception occur? The answer is important because Pennsylvania courts have declined to extend the WESCA to cover conduct occurring wholly outside the Commonwealth—at least in the context of recording telephone conversations. Larrison v. Larrison, 750 A.2d 895, 898 (Pa. Super. Ct. 2000). When a person in New York, for example, tape records a phone call with someone in Pennsylvania, the WESCA does not apply because the Commonwealth has “no power to control the activities that occur within a sister state.” Id.
The WESCA does not demarcate where an interception occurs. Yet we know from the statute‘s definition that an interception involves the “[a]ural or other acquisition of the contents of any wire, electronic or oral communication through the use of any electronic, mechanical or other device.”
Sometimes that place is obvious. Picture the days before wireless communication when police tapped a phone line by cutting the telephone wire that carried the conversation from one line to the other and adding a wire to the officer‘s own phone. There, cutting the wire and attaching another one is clearly an act taken to gain possession of the wire communication, and thus an intercept occurred where that wire
Electronic communications are similarly “intercepted” when software reroutes communications to an interceptor. Take the Sixth Circuit case, Luis v. Zang, 833 F.3d 619 (6th Cir. 2016). A jealous husband installed software, WebWatcher, on his wife‘s computer so he could monitor her online conversations. Id. at 623–24. Once installed, it would “automatically acquire[] and transmit[] communications” such as emails and chat messages to the software manufacturer, Awareness, at its servers in California. Id. at 633. A man with whom the wife was communicating sued Awareness after his online communications were directed to its servers. Id. at 624. Though Awareness tried to argue that the husband, not it, had intercepted the communications by later viewing them, the Sixth Circuit disagreed. Id. at 633. The “intercept of a communication,” it said, “occur[red] at the point where WebWatcher—without any active input from the user—capture[d] the communication and reroute[d] it to Awareness‘s own servers.” Id. As with tapped phones, Awareness
So NaviStone intercepted Popa‘s communications at the point where it routed those communications to its own servers. And that was at Popa‘s browser, not where the signals were received at NaviStone‘s servers. The Defendants’ own evidence details how NaviStone went about obtaining the communications. It provided JavaScript code to Harriet Carter to install on its website. This code would “begin[] to run when the website page, which includes the code, [was] fully rendered and loaded in the visitor‘s web browsing software.” Appx. at 189. Then, when the user interacted with the website in specific ways (such as by adding an item to a cart or tabbing out of a form field), “the code cause[d] certain communications to be sent from the visitor‘s web browser directly to NaviStone.” Id. at 188 (emphasis added); see also id. at 189–91 (detailing which communications triggered messages to NaviStone). Thus when the code—the rerouting device at issue8—told Popa‘s browser to send communications
Notes
The problem, though, is we still don‘t know exactly where Popa‘s browser accessed the Harriet Carter website and where NaviStone‘s JavaScript began telling the browser to communicate with its servers. The parties seem to assume this occurred in Pennsylvania, but they point us to no source in the record confirming this point. We therefore leave it to the
C.
So does this mean websites can never use cookies or third-party marketing companies to analyze customer data? Though the Defendants try to convince us about the certainty of any number of “parade of horribles,” the WESCA is not so unreasonable. It, like the Federal Wiretap Act, includes many exceptions from liability. One is the all-party consent exception, under which it is not unlawful for someone to “intercept a wire, electronic or oral communication, where all parties to the communication have given prior consent to such interception.”
Because the District Court granted summary judgment on other grounds, it never addressed whether Harriet Carter posted a privacy policy and, if so, whether that policy sufficiently alerted Popa that her communications were being sent to a third-party company. The Defendants assert the privacy policy adequately alerted a reasonable person to the interception; hence Popa‘s conduct using the Harriet Carter website demonstrated she consented. Popa disagrees that the policy went far enough and, alternatively, contends there is a genuine issue of material fact about whether this policy even existed at the time she visited the Harriet Carter website.11
These are arguments that should be addressed first by the District Court. We generally decline to resolve issues not decided by a district court, choosing instead to allow it to decide in the first instance. Forestal Guarani S.A. v. Daros Int‘l, Inc., 613 F.3d 395, 401 (3d Cir. 2010). And this is particularly appropriate here because there are unresolved
* * *
The WESCA “emphasizes the protection of privacy.” Spangler, 809 A.2d at 237. Consistent with that emphasis, it applies when anyone intercepts communications—that is, takes an action to acquire them with a device. And it requires all parties—not just a party—to consent to that interception. As we part with the District Court‘s holding that NaviStone is exempt from liability because it was a direct party to Popa‘s communications and that interception only occurred at the site of NaviStone‘s servers in Virginia, we vacate the Court‘s order granting summary judgment and remand for further consideration.
We decline to apply this canon for two reasons. First, before it “may be used, there must exist a doubt as to the meaning of the statute.” United States v. Grier, 475 F.3d 556, 567 n.7 (3d Cir. 2007); see also 1256 Hertel Ave. Assocs., LLC v. Calloway, 761 F.3d 252, 261 (2d Cir. 2014) (“Application of the [constitutional-doubt] canon requires that the statute in question be genuinely susceptible to at least two interpretations . . . .“). And here there is no genuine doubt about the plain meaning of the statute. Second, we need not apply this canon when “a constitutional question, while lacking an obvious answer, does not lead a majority gravely to doubt that the statute is constitutional.” Almendarez-Torres v. United States, 523 U.S. 224, 239 (1998). Though the Defendants raise interesting constitutional issues about the States’ ability to regulate internet communications more generally, we do not have grave doubts as to the constitutionality of the WESCA.