Takeaway: We have written a number of articles dealing with “data interception class actions” alleging claims based on the use of session replay software and other data collection practices by website operators. See, e.g., For Your 2023 Worry List: Anti-Wiretap Class Actions Against Website Operators Surge, But Proper Consent Can Reduce Risk (January 18, 2023); Wiretap class actions: Third Circuit reinstates class claims asserted under Pennsylvania’s broad wiretap act (September 30, 2022); Data interception class actions – S.D. Fla. dismisses claim that use of session replay software violates Florida Security of Communications Act (July 16, 2021); New Class Action Trend: Website Session Replay Tools Alleged to Violate All-Party Consent Recording Requirements (April 5, 2021). These types of putative class actions typically rely on violations of state anti-wiretapping statutes. But as the Third Circuit recently ruled in Cook v. GameStop, Inc., --- F.4th ----, No. 23-2574, 2025 WL 2250261 (3d Cir. Aug. 7, 2025), a mere statutory violation does not an Article III injury-in-fact make. According to the panel in Cook, simply alleging a violation of a state wiretapping statute does not give rise to Article III standing, where the alleged harm does not rise to the level of an intangible harm recognized under the common law.
Session replay software lets a company monitor how a consumer browses and interacts with its website. It records a consumer’s mouse movements, keystrokes, clicks, and other interactions. It then uses that data to create a video replicating the consumer’s visit to a website, generating data that can be used to enhance the consumer experience and website functionality.
Amber Cook was in Pennsylvania when she paid a visit to GameStop’s website, and her activity on the site was recorded by session reply code. But she did not disclose any personally identifiable information or any other sort of sensitive data.
She later filed a putative class action against GameStop in the Western District of Pennsylvania, alleging the common law claim of intrusion on her seclusion as well as violations of the Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA). GameStop moved to dismiss, arguing, among other things, that the case should be dismissed under Federal Rule 12(b)(1) for failure to allege a plausible in injury-in-fact supporting Article III standing. The district court agreed and dismissed her claims with prejudice, holding that any attempt by Ms. Cook to amend her claims would have been futile.
Ms. Cook appealed, and a Third Circuit panel for the most part upheld the dismissal, although the panel converted the district court’s dismissal with prejudice into a dismissal without prejudice.
The primary issue on appeal was whether Ms. Cook plausibly alleged an injury in fact, leading the Third Circuit panel to review decisions such as the United States Supreme Court’s decision in TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), and similar decisions analyzing when an alleged intangible harm qualifies as an injury-in-fact.
TransUnion clarified that, to have Article III standing, plaintiffs alleging intangible harms “must allege harms analogous to those traditionally recognized at common law.” Cook, 2025 WL 2250261, at *2. The “traditional harm comparators” identified by Ms. Cook on appeal consisted of the tort of disclosure of private information, also known as “unreasonable publicity given to another’s private life,” as well as the tort of intrusion upon seclusion (as she originally alleged), which requires an intrusion that “would be highly offensive to a reasonable person.” Id. at *3-*4.
According to the panel, Ms. Cook did not plausibly allege either disclosure of private information or intrusion upon seclusion. As for disclosure of private information, Ms. Cook’s allegations did not give rise to “the humiliation that accompanies the disclosure of sensitive
or scandalizing private information to public scrutiny.” Id. at *4 (citation omitted). Moreover, her web data was only disclosed to the third-party session replay software vendor, meaning “the information was never publicized or even publicly disclosed.” Id.
Ms. Cook’s allegations likewise failed to show the common law tort of intrusion upon seclusion, because “none of the information Cook entered on GameStop’s website was personal or sensitive,” meaning that “Cook cannot plausibly allege that there was an intrusion of her solitude or seclusion as to her person or private affairs.” Id. at *5.
Her WESCA claim did not support Article III standing, either, because according to TransUnion, a legislature “may not simply enact an injury into existence, using its lawmaking power to transform something that is not remotely harmful into something that is.” Id. (citation omitted).
The panel also distinguished two Third Circuit cases cited by Ms. Cook, which involved inapposite fact patterns where website operators collected and used information in violation of clear promises not to do so.
But the panel did reverse the district court’s dismissal with prejudice, observing that “[b]ecause the absence of standing leaves the court without subject matter jurisdiction to reach a decision on the merits, dismissals ‘with prejudice’ for lack of standing are generally improper.” Id. at *7 (citations omitted). That rule applies even where a district court concludes that any effort to allege an injury-in-fact would be futile. Accordingly, the panel affirmed the district court’s ruling but modified the ruling to constitute a dismissal without prejudice.
