Court Issues Clearer Guidance for Standing in “Session Replay” Litigation

On December 5, 2023, the U.S. District Court for the Eastern District of Pennsylvania in In Re: BPS Direct, LLC, and Cabela’s, LLC, Wiretapping (No. 2:22-cv-04709) dismissed several proposed class action claims on “session replay” software, limiting the viability of these suits in federal court.

“Session replay” software tracks and records a website visitor’s browsing behavior and activities, providing insight on what content the visitor is viewing, clicking, requesting, and inputting. Online marketers, advertisers, and website designers use this information to create personalized marketing and advertising content for the visitor. Some class action plaintiffs allege this is an unlawful invasion of their privacy and violates anti-wiretapping laws. See, e.g., Farst v. AutoZone, Inc., No. 22-1435 (M.D. Pa.); In re Zillow Grp., Inc. Session Replay Software Litig., No. 22-1282 (W.D. Wash.); Adams v. PSP Grp., LLC, No. 22-1210 (E.D. Mo.); Massie v. Gen. Motors LLC, No. 21-787 (D. Del.); Lightoller v. Jetblue Airways Corp., No. 23-361 (S.D. Cal.); Mikulsky v. Noom, Inc., No. 23-285 (S.D. Cal.); Straubmuller v. Jetblue Airways Corp., No. 23-384 (D. Md.).

In June 2023, the Judicial Panel on Multidistrict Litigation consolidated cases from five federal courts in five states alleging these types of claims against Bass Pro Shops and Cabela’s. In a win for defendants, the Court held that the website users could not plead Article III standing for the privacy and wiretapping claims and granted the Defendants’ motion to dismiss.

The Court referred to the Supreme Court’s analysis in TransUnion v. Ramirez (2021), holding that for a website-user plaintiff to plead they suffered an injury in fact for Article III standing, the Court must first analyze the nature of the information intercepted to determine if it amounts to an invasion of historically protected privacy interests. The Court held that information regarding a website user’s online mouse clicks, keystrokes, and pages and content viewed is not “highly sensitive personal information.” But the court also noted the result would likely have been different if the session replay software at issue had tracked medical diagnoses or financial data. Here, plaintiffs did not allege sensitive information was captured, and the Court held that merely capturing how a plaintiff navigated a website—by itself—cannot create an injury in fact.

This case is one of several actions from website users across the country challenging the use of the session replay software. Companies facing session-replay litigation in federal courts should consider challenging a litigant’s Article III standing to bring such claims, especially where the pages and content tracked by the software do not contain “highly sensitive personal information” such as medical diagnoses or financial data.