VONBERGEN v. BPS DIRECT, LLCVONBERGEN v. BPS DIRECT, LLC
KEARNEY, J. December 5, 2023
We today address website users’ challenges to retailers secretly tracking consumers’ keystrokes and chosen webpages while browsing the retailers’ websites. We put aside the rhetoric surrounding retailer marketing efforts versus surveillance. We must focus on the legal questions of whether website users suffer concrete injury from hidden tracking depending on what the retailer learns and, if so, whether the retailers’ conduct in tracking their website users’ conduct violates federal and state law.
The website users’ first filed challenge through a Multi-District Litigation is to the use of session replay software embedded into two retailers’ websites by third party vendors who then track the website user’s conduct on the retailers’ webpages as violating federal and several differing state wiretapping acts and a variety of common law torts grounded in privacy concepts. The second challenge arises closer to home with a Pennsylvania Facebook website user purchasing a gun from the same retailer who automatically discloses his purchase to Facebook which he claims
The website users do not plead facts allowing us to find Article III standing. We grant the retailers’ motions to dismiss with prejudice as to website users who cannot plead after two attempts disclosing personal credit card, financial, bank account or medical information possibly arising from a purchase from their websites. We grant the retailers’ motions to dismiss without prejudice as to the two website users challenging session replay software and the Pennsylvania Facebook website user who allege they purchased a product from the websites but do not plead concrete injury through third party access to their highly sensitive personal information such as medical diagnosis information or financial data from banks or credit cards. We also dismiss without prejudice the Facebook website user’s alternative claim of improper disclosure under the Pennsylvania Uniform Firearms Act.
II. Alleged facts
Session replay code’s function and scope.
Third-party vendors including Microsoft, Quantum Metric, and Mouseflow, created session replay code computer software allowing website operators to record and playback an individual website visitor’s browsing session and to view a website visitor’s interactions on their websites in real-time.5 Session replay code provides online marketers, advertisers, and website designers with specific insights into website visitor behavior which they can use to target website visitors with marketing and advertising content.6
Bass and Cabela’s hire third-party vendors, called session replay providers, to create and deploy session replay code on their websites to track and analyze website visitors’ activities.7 The third party session replay providers embed snippets of JavaScript computer code in www.basspro.com and www.cabelas.com.8 The embedded JavaScript computer code, or session replay code, then deploys on each website user’s internet browser.9 When a website visitor interacts with one of these two websites, for example by clicking on a button or scrolling down a web page, their browsers transmit electronic messages in the form of instructions to Cabela’s and Bass’s computer servers operating the website.10 These messages instruct Bass and Cabela’s what content is being viewed, clicked on, requested, and imputed by the user.11 The website user’s browser will “follow the code’s instructions” by contemporaneously sending duplicate messages of the user’s communications to the third party session replay provider.12 This session replay code operates continuously during a user’s visit to the Bass or Cabela’s websites.13
Session replay code is capable of capturing nearly every action taken by a website visitor while they are on the website, including a visitor’s personal or private sensitive data depending on what the visitor does while on the site.20 Visible contents of website communications are transmitted to the third party session replay provider as Bass and Cabela’s do not use masking configuration settings and their websites transmit all captured data to their session replay providers.21
Session replay code may capture information the visitor does not intend to submit to the website (for example, a user enters information in a text field and chooses not to click “submit”) or information they intend to keep private using a private browser such as “Incognito Mode.”22 Session replay code may also permit Bass and Cabela’s to view the interactions of visitors on their websites in real-time.23 The data captured by session replay code will become known and visible to both the session replay provider and Bass and Cabela’s.24 But session replay code is not visible to a user who is navigating a webpage.25
Session replay providers aggregate and store website users’ data under unique identifiers
The session replay Website Users’ allegations.
Eight persons bringing a consolidated class action complaint through the multi-district litigation accessed either the Bass or Cabela’s website. These session replay Website Users Brian Calvert, Heather Cornell, Timothy Durham, Marilyn Hernandez, Peter Montecalvo, Greg Moore, Arlie Tucker, and Brittany Vonbergen did not know Bass and Cabela’s embed session replay code on their websites.31 Session replay Website Users transmitted communications to Bass and Cabela’s website servers, including mouse clicks and movements, keystrokes, search terms, substantive information they inputted, pages they viewed, scroll movements, and copy and paste actions.32 Session replay code automatically and instantaneously captured their acts and sent them to session replay providers.33 Session replay providers created a unique ID and profile for each of the eight website users.34 Bass and Cabela’s did not include a pop-up disclosure, consent form, or privacy policy alerting them of Bass and Cabela’s recording their visits through a third party.35
The eight session replay Website Users from five different states plead different browsing and purchasing experiences. Two session replay Website Users accessed the websites from California. Session replay Website User Durham accessed Cabela’s website while in California.36 Session replay Website User Moore also visited Bass’s website on his computers and/or mobile
Three session replay Website Users accessed the websites in Pennsylvania. Website User Calvert visited Cabela’s website to browse but did not purchase anything.45 Session replay Website User Cornell visited Bass’s website to browse and purchased a chair.46 She informed Bass of the product she was interested in, what color chair she wanted, and where she wanted the chair shipped.47 Session replay Website User Cornell provided her name, address, and unpleaded payment and billing information.48 Session replay Website User Vonbergen visited Cabela’s website on her computer and/or smartphone approximately four times while in Pennsylvania but did not plead purchasing products during the website use.49
The Facebook Website User’s allegations.
Pennsylvanian David Irvin has a Facebook account and purchased a firearm from cabelas.com.50 Bass and Cabela’s disclosed to Facebook information he provided to them in connection with his purchase of the firearm, including his name, address, Facebook ID, and the type of gun he purchased.51 Facebook Website User Irvin does not allege he entered payment or billing information on the Cabela’s website.
Facebook Tracking Pixel uses first- and third-party cookies.57 Cookies are small blocks of data websites store on your computer. A first-party cookie is created by the website the user is visiting.58 A third-party cookie is created by a different website than the one the user is visiting.59 Facebook Tracking Pixel compels a user’s browser to send cookies to Facebook when the user is visiting the Websites.60 These cookies contain, among other things, the visitor’s unencrypted Facebook ID and browser identifier.61 These cookies combine the identifiers with the event data gathered by Facebook Tracking Pixel to determine the webpages visitors are visiting and the products they are purchasing.62 Bass and Cabela’s also use the “Advanced Matching” tool to find information on their websites containing users’ first names, last names, and emails.63 Bass and
II. Analysis
The eight session replay Website Users bring this action individually and on behalf of a nationwide class and various state subclasses of all website users whose communications were intercepted through the use of session replay code embedded on Cabela’s and Bass’s websites.67 Session replay Website Users allege Cabela’s and Bass’s conduct violates the
Facebook Website User Irvin focuses on Facebook’s role and seeks to represent a class of “all persons in Pennsylvania who have a Facebook account and who visited either cabelas.com, basspro.com or both.”70 Facebook Website User Irvin also seeks to represent a subclass defined as “all persons in Pennsylvania who have a Facebook account and who purchased a firearm from either cabelas.com, basspro.com or both.”71
Cabela’s and Bass move to dismiss the session replay Website Users’ consolidated
Bass and Cabela’s separately moved to dismiss Facebook Website User Irvin’s amended Complaint arguing: (1) Facebook Website User Irvin lacks Article III standing because he does not adequately allege he suffered concrete injury; (2) Facebook Website User Irvin does not state a claim under the
We dismiss all claims of session replay Website Users Durham, Calvert, Hernandez, Moore, Tucker, and Vonbergen with prejudice as they do not have standing and amendment would be futile given they have not plead a purchase or disclosure of financial information after two attempts. We dismiss the claims of session replay Website Users Cornell and Montecalvo and Facebook Website User Irvin without prejudice to timely filing amended Complaints if they can allege Bass and Cabela’s intercepted their highly sensitive personal information such as financial data from banks or credit cards consistent with their obligations under
A. Website Users do not plead Article III standing for the statutory and common law privacy and wiretapping claims.
Bass and Cabela’s argue the session replay Website Users and Facebook Website User Irvin do not meet their burden to establish Article III standing because they do not adequately plead they suffered a concrete harm arising from their website visits.74 Website Users counter they suffered harm bearing a close relationship to privacy torts which have been historically recognized as a basis for suit.75
We find session replay Website Users Durham, Calvert, Hernandez, Moore, Tucker, and Vonbergen lack standing because they do not allege they made purchases on the Websites or engaged in activity which would cause their browsers to send highly sensitive personal information such as medical diagnosis information or financial data from banks or credit cards to Bass or Cabela’s. Session replay Website Users Cornell and Montecalvo and Facebook Website User
We must first clarify the law to be applied to our standing analysis. The parties dispute what the Website Users are required to plead to establish standing to sue under a statute protecting against intangible harms. Website Users contend they have standing as long as they allege violations of statutes protecting against the same general types of harms traditionally recognized as the basis for lawsuits at common law.76 Bass and Cabela’s counter we must determine whether Website Users allege facts showing a harm closely related to the harm traditionally forming the basis of lawsuits at common law.77 We find we must compare the nature of the harm alleged to analogous harms which were protected against at common law and determine whether there is a close enough relationship between the two to find concrete harm.
The Supreme Court’s 2016 guidance in Spokeo, Inc. v. Robins instructs Website Users must allege Article III standing by pleading (1) they suffered an injury in fact, (2) fairly traceable to Cabela’s and Bass’s challenged conduct, and (3) likely to be redressed by a favorable judicial decision.78 To establish injury in fact, Website Users must show they suffered “an invasion of a legally protected interest” which is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.”79 “Standing allegations need not be crafted with precise detail, nor must the plaintiff prove his allegations of injury.”80
Concrete does not mean tangible.81 While tangible injuries are often easier to recognize, “[v]arious intangible harms can also be concrete,” including “reputational harms, disclosure of
An alleged violation of a statute is not enough to confer standing.84 In TransUnion v. Ramirez, the Supreme Court emphasized the “important difference” between “(i) a plaintiff‘s statutory cause of action to sue a defendant over the defendant’s violation of federal law, and (ii) a plaintiff’s suffering concrete harm because of the defendant‘s violation of federal law.”85 An injury in law is different than an injury in fact. Congress may “create causes of action for plaintiffs to sue those who violate them,” but “only plaintiffs who have shown that they suffered concrete harm by a defendant’s statutory violation have standing to sue.”86 A risk of future harm, without more, does not establish standing in a suit for damages.87
“In the class action context, our standing inquiry focuses solely on the class representative(s).”88 “That a suit may be a class action ... adds nothing to the question of standing, for even named plaintiffs who represent a class ‘must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong.’”89
The parties interpret the Supreme Court’s 2021 teaching in TransUnion differently. Website Users focus on the section of the TransUnion opinion in which the Court explains Congress may “elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.”90 Website Users read the Court as saying all we must do to find concrete harm is determine whether the harm the statute protects against is of the same general type traditionally recognized as a basis for a lawsuit; if it is, then Congress may elevate the harm to a legally cognizable injury under the statute and we may find standing even if the quantity or
Website Users’ interpretation runs counter to our Supreme Court’s explicit guidance in TransUnion. In TransUnion, consumers alleged TransUnion put alerts on credit reports identifying individuals as potential terrorists based on a comparison of their first and last names to names on a list maintained by the United States Treasury.95 Consumers alleged TransUnion violated the
The Court in TransUnion did not first look to see whether the harm the Act protects against is of the same general type as the harm protected at common law and then find all consumers had standing because they all alleged claims under the Act. The Court instead divided consumers into two groups for analytical purposes: (1) consumers whose information was disseminated to third parties, and (2) consumers whose information was not disseminated to third parties. The Court then independently analyzed the details of each group’s factual allegations to assess whether the group’s alleged harm had a “close relationship” to the harm traditionally recognized as providing a basis for a lawsuit. The mere fact TransUnion did not comply with reasonable procedures under the Act did not confer standing.
We face a similar analysis because the mere fact Website Users allege Cabela’s and Bass intercepted electronic communications does not confer standing. We proceed as the Supreme Court instructs in TransUnion - first by grouping the Website Users based on the details of their alleged harms, and then by independently analyzing the details of their allegations to see whether they have a “close relationship” to a traditional harm.
We are guided by several thoughtful evaluations of similar claims over the past several months including from our colleague Judge Ranjan a little over three months ago in Cook v. GameStop.100 Ms. Cook sued GameStop alleging GameStop’s use of session replay on its website violated the same Pennsylvania wiretapping statute we are reviewing in part and the common law tort of intrusion upon seclusion.101 Ms. Cook argued she had standing and Judge Ranjan need not analyze the sensitivity of the disclosed information because “there has been historical protection against ‘the idea of somebody eavesdropping on you, somebody intruding on your privacy, regardless of what the intrusion yields them.’”102 Ms. Cook contended the mere fact GameStop
Judge Andrews engaged in a similar analysis over eighteen months ago in Massie v. General Motors LLC, where Ms. Massie and Mr. Manglani challenged General Motors’ use of session replay code on its website.106 Like Ms. Cook, Ms. Massie and Mr. Manglani analogized their injuries to an invasion of privacy.107 Judge Andrews granted General Motors’ motion to dismiss finding Ms. Massie and Mr. Manglani lacked standing because they could not plead a “close relationship” between an invasion of privacy claim and “eavesdropping” on communications which do not involve personal information.108
Like Ms. Cook and Ms. Massie, Website Users look past our Supreme Court’s critical directive a plead statutory violation does not relieve us of our duty to decide whether a Website User is harmed under Article III.109 Even if the type of harm a statute is designed to protect resembles a type of harm traditionally protected, we cannot find harm where there is none. Website Users analogize their harms to intrusion upon seclusion and public disclosure of private facts – torts which require the interception or disclosure of private and personal information.110 The protections which existed traditionally at common law existed only as to private information.111
Website Users’ argument we must ignore the sensitivity of the intercepted content when considering standing does not withstand scrutiny. When asked during oral argument whether someone who has cabelas.com as their homepage suffers harm by merely loading their web browser and leaving it open, session replay Website Users’ counsel responded, “I would say yes,
Session replay Website Users contend Judge Ranjan in Cook and Judge Andrews in Massie erred in their standing analyses by requiring website visitors allege a privacy interest identical to the privacy right recognized at common law.115 Session replay Website Users argue this interpretation is not in line with the Supreme Court’s teachings since 2016 in Spokeo and its progeny, which only requires the interest protected by a statute bear a close relationship to a right traditionally recognized at common law.116
We disagree with the session replay Website Users’ suggestion Massie and Cook are wrongly decided. Neither Judge Andrews nor Judge Ranjan required website visitors’ privacy interests be identical to the right of privacy recognized at common law to establish standing. Both judges compared the harm alleged to analogous harms at common law and found there was not a close enough relationship between the two to find concrete harm.117 This thoughtful parsing is precisely what the Supreme Court in TransUnion asks us to do.
We recognize many website visitors across the country are challenging the use of session replay code.118 Most judges to consider the standing issue required website visitors “plead that the defendants’ interception of their information amounts to ‘an invasion of privacy interests that have
Guided by our Supreme Court in TransUnion and our colleagues’ reasoning in session replay decisions across the country, we now consider the sensitivity of the information Bass and Cabela’s allegedly intercepted to determine “whether the interception of that kind of information amounts to an invasion of privacy interests that have been historically protected.”121
While we recognize “standing is not dispensed in gross,” we find Facebook Website User Irvin and session replay Website Users’ alleged harm under the wiretapping statutes is the same as their alleged harm underlying their common law invasion of privacy claims.122 We need not assess standing separately with respect to these claims. We assess Facebook Website User Irvin’s standing under the
1. Session replay Website User Durham lacks standing.
Session replay Website User Durham alleges he accessed www.cabelas.com while in California.123 He does not allege the types of interactions he had with Cabela’s website or the specific information he disclosed on Cabela’s website. He does not allege he browsed the website or even shared any information about himself. Mr. Durham does not even attempt to allege harm, much less harm which closely relates to the harm upon which intrusion upon seclusion or other privacy torts are based. We dismiss session replay Website User Durham’s claims for lack of standing.
Bass and Cabela’s argue session replay Website Users who allege they did not purchase items on their websites lack Article III standing because they do not—and cannot—allege Bass and Cabela’s captured anything other than their browsing activity and browsing activity is not sufficiently private to establish concrete harm.124 Session replay Website Users counter their harm stems from the conduct of the wiretapping itself, regardless of the sensitivity of the content captured. We find session replay Website Users Durham, Calvert, Hernandez, Moore, Tucker, and Vonbergen cannot establish standing because they did not purchase items on the websites or engage in activity prompting their browsers to send sensitive personal information such as banking or credit card information to Bass or Cabela’s.
Session replay Website Users allege Mr. Calvert, Ms. Hernandez, Mr. Moore, Mr. Tucker, and Ms. Vonbergen communicated with Cabela’s and Bass’s servers, which captured “mouse clicks and movements, keystrokes, search terms, substantive information inputted by [Website Users], pages and content viewed by [Website Users], scroll movement, and copy and paste actions.”125
Session replay Website Users argue these allegations are sufficient to establish concrete harm because our Court of Appeals found unlawful tracking of internet activity satisfies Article III’s “concrete harm” requirement in two decisions In re Google and In re Nickelodeon.126 Both of these decisions predated the Supreme Court’s 2021 teachings in TransUnion. Internet users sued internet advertising companies in In re Google under federal and state wiretapping and privacy laws alleging the advertising companies bypassed users’ cookie blockers and placed tracking cookies on their personal computers.127 The advertising companies used the tracking cookies to compile internet histories and create detailed profiles for each internet user.128 The internet users
In In re Nickelodeon, children sued Viacom and Google alleging they used cookies to unlawfully collect their personal information including their gender, birthdate, IP address, operating system, and browser version.131 The children alleged Viacom and Google did this despite explicitly promising not to collect any personal information about children who browsed its websites.132 The children also alleged the companies used “browser fingerprinting” to identify website visitors and link online and offline activity to identify specific users.133 Our Court of Appeals five years before TransUnion reasoned the children’s harm is concrete because it involves “a clear de facto injury, i.e., the unlawful disclosure of legally protected information.”
Cabela’s and Bass counter the allegations in Google and Nickelodeon are distinguishable based on the type of information at issue in those cases.134 Cabela’s and Bass rely primarily on two session replay decisions in which our colleagues distinguished the allegations in Google and Nickelodeon.135 In Cook v. GameStop, Judge Ranjan rejected Ms. Cook’s argument she has standing under Google and Nickelodeon.136 Judge Ranjan reasoned these decisions “might be abrogated by TransUnion” but are also distinguishable because they involved the capture of personal information – “registered account information in Nickelodeon, and tracking cookies embedded within the plaintiffs’ personal computers and browsers in Google.”137 Judge Ranjan found Ms. Cook did not have standing to sue under the wiretapping statute because Ms. Cook did not enter any personally identifying information (e.g., name, address, credit card information)
Cabela’s and Bass also rely on Judge Andrews’s analysis in Massie where Ms. Massie and Mr. Manglani browsed the vehicle sections of the website but did not purchase anything and did not input any of their personal information such as their zip codes, phone numbers, or email addresses.140 Ms. Massie and Mr. Manglani relied on several cases, including Google and Nickelodeon, where judges identified invasion of privacy as an injury sufficient to confer standing.141 Judge Andrews distinguished these authorities as they involved “the collection and disclosure of personal information,” whereas Ms. Massie and Mr. Manglani did not allege the information collected was “personal or private within the common law understanding of a privacy right.”142 Judge Andrews granted the motion to dismiss for lack of standing.143
We find Website Users who did not disclose highly sensitive personal information such as medical diagnosis information or financial data from banks or credit cards cannot establish concrete harm. Both intrusion upon seclusion and public disclosure of private facts involve the interception or disclosure of private personal information in a highly offensive manner.144 Although Website Users provide slightly more detail as to the actions taken by Mr. Calvert, Ms. Hernandez, Mr. Moore, Mr. Tucker, and Ms. Vonbergen, they do not allege these individuals disclosed highly sensitive personal information such as medical diagnosis information or financial data from banks or credit cards. Website Users merely allege session replay code captured “mouse clicks, keystrokes, pages and content viewed.” This is no different than what Bass and Cabela’s employees would have been able to observe if Website Users had gone into a brick-and-mortar
We agree our Court of Appeals’ pre-TransUnion analyses in Nickelodeon and Google are distinguishable.145 Unlike the website visitors in those cases, Website Users Calvert, Hernandez, Moore, Tucker, and Vonbergen do not allege Bass or Cabela’s intercepted private communications or personal information. Although Website Users allege session replay code captured “substantive information inputted,” they do not plead the substantive information after two attempts. Website Users’ vague allegations session replay providers collect their “highly personal information and substantive communications” do nothing to clarify the concreteness of harm.146
Website Users’ allegations regarding the types of information session replay can capture are likewise insufficient. For example, session replay Website Users allege “if a website displays user account information to a logged-in user, that content may be captured by Session Replay Code” and “researchers have found that a variety of highly sensitive information can be captured in event responses from website visitors.”147 We need to know what session replay code actually captured, not what session replay code is capable of capturing.148
We are also guided by Judge White’s reasoning in Adams v. PSP Group.149 Ms. Adams sued Pet Supplies Plus alleging it used session replay code on its website to unlawfully intercept communications.150 Ms. Adams did not make a purchase on the website.151 She did not specify what information she shared on the website.152 Pet Supplies moved to dismiss for lack of Article III standing.153 Ms. Adams’ analogized her harm to intrusion upon seclusion, which involves obtaining private, personal information about a person.154 Judge White reasoned the question is “whether Plaintiff adequately alleges facts showing a harm that is closely related to the harm that forms the basis of the tort of intrusion upon seclusion.”155
We join Judge White and our colleagues in finding website visitors do not have standing to sue under the wiretap statutes where they fail to identify the specific personal information captured by session replay code.158 While we recognize “standing is not dispensed in gross,” we find Facebook Website User Irvin and session replay Website Users’ alleged harm under the wiretapping statutes is the same as their alleged harm underlying their common law invasion of privacy claims.159 We need not assess standing separately with respect to these claims.
We are aware of Judge Chen’s decision four weeks ago in James v. Walt Disney recognizing website visitors’ standing based on browsing. Website users in James alleged the website’s owner violated their privacy rights by embedding a third-party software on its website which captured and collected data as individuals browsed the website.160 The website users alleged the intercepted information was not anonymized and included “specific web pages viewed, search terms entered, and purchase behavior.”161 Judge Chen found standing when they refer “to webpages viewed, searches conducted, purchase behavior, and so forth. That is enough to support standing.”162
We disagree with Judge Chen’s reasoning to the extent it suggests viewing activity, search activity, and purchase behavior is enough to establish concrete harm. Judge Chen relied on
Session replay Website Users Calvert, Hernandez, Moore, Tucker, and Vonbergen lack standing.
3. We grant session replay Website Users Cornell, Montecalvo, and Facebook Website User Irvin leave to amend to allege disclosure of credit card or financial information during their purchases.
Ms. Cornell, Mr. Montecalvo, and Mr. Irvin allege they purchased items on the Websites. But they do not plead what information they shared in the purchase.
Bass and Cabela’s argue session replay Website Users Cornell and Mr. Montecalvo “fare no better” than the other session replay Website Users who did not make purchases because they only allege they entered basic personal information, which is not sufficiently private to confer standing.164 Bass and Cabela’s argue Facebook Website User Irvin cannot show he suffered concrete harm because he also did not disclose medical diagnosis information or financial data from banks or credit cards to Bass or Cabela’s.165 We find session replay Website Users Cornell and Montecalvo and Facebook Website User Irvin may be able to establish standing under the pleaded wiretap and privacy claims if they can truthfully allege Bass and Cabela’s captured their highly sensitive personal information such as medical diagnosis information or financial data from banks or credit cards.
Session replay Website Users Cornell and Montecalvo allege they provided information to Bass and Cabela’s by using their keyboards to enter their names, addresses, payment, and billing information when they made website purchases.166 Ms. Cornell and Mr. Montecalvo also allege their website communications, which included “keystrokes (such as text being entered into an
Unlike the other website users in the multi-district consolidated complaint, session replay Website Users Cornell and Montecalvo and Facebook Website User Irvin plausibly allege they entered personal information. Unlike website users in many of the other session replay cases around the country, session replay Website Users Cornell and Montecalvo and Facebook Website User Irvin allege session replay code captured more than simply their “shopping preferences,” or information which could be revealed during a visit to Bass or Cabela’s brick-and-mortar stores. Session replay Website Users Cornell and Montecalvo and Facebook Website User Irvin plead more than merely allege session replay can capture their personal information—they plausibly allege session replay code did in fact capture their personal information.
We find their allegations still fall short. We are not persuaded concrete injury exists merely because Bass and Cabela’s disclosed Website Users’ names and addresses. We are aware of two decisions in which judges held the disclosure of basic contact information such as names, addresses, and phone numbers inadequate to establish standing.169 But we also note many of our colleagues deciding session replay standing issues have found significant the fact website visitors did not allege disclosure of information including names and addresses.170 Case law is unclear on this point.
But Congress repeatedly advises us credit card data often warrants special protection under federal law.171 Facebook Website User Irvin alleges he made a purchase, but he does not allege he
We grant session replay Website Users Cornell and Montecalvo and Facebook Website User Irvin leave to amend their statutory wiretap and common law privacy claims if they can truthfully allege Bass and Cabela’s captured non-anonymized and unencrypted highly sensitive personal information such as medical diagnosis information or financial data from banks or credit cards.174
4. Session replay Website Users’ fingerprinting allegations do not allow us to plausibly infer they suffered concrete harm.
Session replay Website Users allege session replay providers aggregated and stored their data under unique identifiers, or “fingerprints,” which they can use to identify website users across other websites based on information entered on other websites.175 Session replay Website Users contend these fingerprinting allegations are sufficient to confer standing under In re Google.176 Bass and Cabela’s argue browsing activity is not sufficiently personal or private to confer Article III standing.177 We find session replay Website Users’ fingerprinting allegations do not establish concrete harm.
We agree with session replay Website Users the fingerprinting allegations bear certain similarities to the allegations in Google and Nickelodeon, but we find those cases distinguishable. We are persuaded by Judge Conner’s reasoning in Farst v. Autozone.178 Matthew Farst sued AutoZone challenging its use of session replay code on its website under the Pennsylvania
Unlike the website visitors in Nickelodeon and Google, session replay Website Users before us do not allege Bass or Cabela’s deceived them or disclosed legally protected information. Session replay Website Users admit the Privacy Notices disclose they collect “browsing or search history, website interactions, and advertisement interactions” and then disclose the information “to service providers and others, such as advertising and analytics partners; affiliated companies; law enforcement.”183
We find session replay Website Users’ fingerprinting allegations do not establish concrete harm.
5. Session replay Website Users’ remaining allegations of mental anguish and diminution of value are insufficient to confer standing.
Session replay Website Users claim Article III standing by alleging Bass and Cabela’s caused them “mental anguish and suffering arising from their loss of privacy and confidentiality of their electronic communications.”184 Bass and Cabela’s argue we should dismiss these “threadbare assertions” as conclusory.185 Session replay Website Users counter they need not prove mental anguish or suffering to establish standing.186 Session replay Website Users also
We need not analyze session replay Website Users’ harm separately under the wiretapping statutes and the privacy tort claims because the harm upon which all these claims are based is the same: Bass and Cabela’s unlawful interception of their private information. We will analyze Facebook Website User Irvin’s standing under the Uniform Firearms Act separately because his alleged harm is based on slightly different conduct – the disclosure of protected firearm purchase information.
B. Facebook Website User Irvin lacks standing to sue under the nondisclosure mandates in the Pennsylvania Uniform Firearms Act.
Bass and Cabela’s argue Facebook Website User Irvin cannot show he suffered concrete harm for his Pennsylvania Uniform Firearms Act claim because he does not allege he was affected by disclosure of his data to Facebook and he consented to Facebook’s terms and Cabela’s privacy policies.190 Bass and Cabela’s argue Facebook Website User Irvin lacks standing because he alleges Bass and Cabela’s only disclosed his information to one entity—Facebook—and the tort of public disclosure of private facts requires publicity.191 Facebook Website User Irvin counters he suffered concrete harm because Bass and Cabela’s disclosed protected information about his firearms purchases.192 We find Facebook Website User Irvin does not allege facts allowing us to plausibly infer he suffered concrete harm under Article III.
The Pennsylvania General Assembly, through the Pennsylvania Uniform Firearms Act,
“All information provided by the potential purchaser, transferee or applicant, including, but not limited to, the potential purchaser, transferee or applicant’s name or identity, furnished by a potential purchaser or transferee under this section or any applicant for a license to carry a firearm …shall be confidential and not subject to public disclosure.”193
Facebook Website User Irvin alleges Bass and Cabela’s violated the Uniform Firearms Act by disclosing his “[his] name, address, Facebook ID, [and] gun he purchased” to Facebook without his “knowledge, consent or express written authorization.”194 He analogizes his harm to the torts of public disclosure of private information and intrusion upon seclusion. We must determine whether his alleged harm has a “close relationship” to harms traditionally recognized as the basis for lawsuits at common law.
Bass and Cabela’s rely primarily on Barclift v. Keystone Credit Services in support of their position Facebook Website User Irvin lacks standing.195 Keystone hired a mailing vendor to print and send Ms. Barclift a letter notifying her Keystone intended to collect a debt.196 Ms. Barclift sued Keystone under the Fair Debt Collections Practices Act for sharing her personal information with the mailing vendor.197 Judge Leeson reasoned her alleged harm most closely resembles the common law claim of public disclosure of private facts.198 One of the elements of the tort is publicity of private facts. Judge Leeson reasoned because Ms. Barclift did not allege Keystone shared her information with a larger group of people, her alleged injury does not bear a close relationship to the tort.199
Facebook Website User Irvin counters his claim is analogous to the tort of intrusion upon seclusion which does not require publicity.200 Facebook Website User Irvin relies on case law arising under the federal Video Privacy Protection Act and Michigan’s Preservation of Personal Privacy Act in support of his position.201 Facebook Website User Irvin argues, “[a]s with the
We recognize Facebook Website User Irvin’s argument bears some resemblance to standing arguments arising under cases addressing the Video Privacy Protection Act and Michigan’s Protection of Personal Privacy Act. But the Supreme Court in TransUnion teaches we must analyze the alleged harm—not the statute—to determine whether Facebook Website User Irvin has standing.204 We proceed as the Court instructs us in TransUnion: first by analyzing the details of the alleged harm, and then by determining whether the allegations have a “close relationship” to a traditional harm.
We agree Facebook Website User Irvin cannot establish harm using the analog of public disclosure of private facts because this tort requires publicity. “To recover damages for disclosure of private information a plaintiff must allege the matter publicized is (1) publicity, given to (2) private facts, (3) which would be highly offensive to a reasonable person, and (4) is not of legitimate concern to the public.”205 Facebook Website User Irvin alleges only one party—Facebook—received his information. He does not allege widespread disclosure or disclosure “to so many persons that the matter must be regarded as substantially certain to become one of public knowledge.”206 Public disclosure of private facts is not a proper analog.
Facebook Website User Irvin analogizes his harm to intrusion upon seclusion. We again note the disclosure of basic personal information does not necessarily confer standing. Facebook Website User Irvin also alleges Bass and Cabela’s disclosed his Facebook ID and his gun purchase.
We dismiss Facebook Website User Irvin’s claim under the Pennsylvania Uniform Firearms Act with leave to amend if he can allege Facebook Tracking Pixel captured non-anonymized and unencrypted highly sensitive personal information such as medical diagnosis information or financial data from banks or credit cards.
C. Website Users do not have standing to assert claims for injunctive relief.
Website Users ask us to enjoin Cabela’s and Bass from “continuing the unlawful practices described herein” and prevent the future interceptions of communications.210 Cabela’s and Bass contend Website Users lack standing to pursue a claim for injunctive relief because injunctions protect against future harm and Website Users cannot contend they will suffer the future harm of visiting the websites with session replay running without their knowledge.211 Website Users counter they have standing because Bass and Cabela’s continue to employ session replay code and they suffer continuing adverse effects.212 We find Website Users do not have standing to seek injunctive relief because they do not plausibly allege they are likely to suffer future injury from Bass or Cabela’s conduct.
Bass and Cabela’s rely in part on a decision of our Court of Appeals in McNair v. Synapse Group.217 Former customers of a magazine sued a magazine marketing company for consumer fraud alleging the marketing company sold subscriptions in an unlawfully deceptive way.218 Our Court of Appeals held the magazine customers did not have standing to seek injunctive relief reasoning any future injury is “wholly conjectural” because the former customers were already aware of Synapse’s advertising practices.219 The Court of Appeals explained, “[T]he law accords people the dignity of assuming that they act rationally, in light of the information they possess.”220
Bass and Cabela’s also rely on our Court of Appeals’ decision in In re Johnson & Johnson Talcum Powder Litigation.221 In In re Johnson & Johnson, Ms. Estrada alleged a Johnson & Johnson product increased the risk of developing ovarian cancer. Ms. Estrada asserted she suffered an economic injury by purchasing improperly marketed Baby Powder.222 She sought to enjoin the manufacturer of the baby powder product from continuing to sell baby powder without warning customers of the alleged health risks.223 Our Court of Appeals held Ms. Estrada did not have standing to seek injunctive relief, reasoning, “Because Estrada makes clear in this very lawsuit that she is well aware of health risks associated with using Baby Powder, we readily conclude that she is not likely to suffer future economic injury.”224 The Court of Appeals explained the fact Ms.
Website Users counter the interception, rather than the lack of awareness Bass and Cabela’s are tracking them, is the injury.226 Website Users rely on Brown v. Google in support of their argument they have standing to seek injunctive relief.227 Website visitors sued Google for its “surreptitious interception and collection of personal and sensitive user data while users are in ‘private browsing mode.’”228 Website visitors sought to enjoin Google from intercepting, tracking, or collecting class members’ communications after class members used a browser while in “private browsing mode.”229 Google sought summary judgment on the basis the website visitors could not show the risk of harm is sufficiently imminent and substantial to confer standing. Judge Gonzalez Rogers disagreed and denied summary judgment, reasoning, “Google’s conduct has not stopped. Plaintiffs have demonstrated that absent an injunction, Google will continue to collect users’ private browsing data for its own use without users’ express consent.”230
We note Website Users’ authority is from the Court of Appeals for the Ninth Circuit reviewing a summary judgment analysis of much different facts on a developed record in which website visitors demonstrated Google would continue to collect private browsing data without user consent absent an injunction.231 As Judge Gonzalez Rogers notes in her opinion, “[T]he standing analysis is contextual.”232 This case arises in a different context. As a federal district court sitting in Pennsylvania reviewing a motion to dismiss, we are bound to follow the precedent set forth by the Third Circuit.
We find our Website Users are not likely to suffer future injury from Bass or Cabela’s conduct. Website Users allege Bass and Cabela’s used a third party to track their movements on
We dismiss Website Users’ claims for injunctive relief because Website Users do not allege they are “likely to suffer future injury” from Bass and Cabela’s conduct.236
III. Conclusion
Session replay Website Users Durham, Calvert, Hernandez, Moore, Tucker, and Vonbergen cannot establish concrete harm after two attempts because they did not make purchases on the Websites or engage in any activity prompting their browsers to send highly sensitive personal information such as medical diagnosis information or financial data from banks or credit cards to Bass or Cabela’s. We dismiss their claims with prejudice because they lack standing. We afforded Ms. Vonbergen, Mr. Moore, Jr., Mr. Calvert, Mr. Tucker, Mr. Durham, and Ms. Hernandez two chances to state a claim. Case law in this area, while evolving, recognized the website users must be able to plead facts of sharing highly sensitive personal information such as a medical diagnosis or financial data from banks or credit cards to enjoy Article III standing. We dismiss their statutory and common law claims with prejudice because all named Website Users asserting claims under those laws lack standing.237
Session replay Website Users Cornell and Montecalvo and Facebook Website User Irvin do not establish concrete harm because they do not identify the information Bass and Cabela’s