Amber Cook v. GameStop Inc

• Court: Court of Appeals for the Third Circuit
• Decided: August 7, 2025
• Docket: 23-2574
• Status: Published

Opinion

PRECEDENTIAL

UNITED STATES COURT OF APPEALS FOR THE THIRD CIRCUIT ______

No. 23-2574 ______

AMBER COOK, individually and on behalf of all others similarly situated, Appellant

v.

GAMESTOP, INC. ______

On Appeal from the United States District Court for the Western District of Pennsylvania (D.C. Civil No. 2:22-cv-01292) District Judge: Honorable J. Nicholas Ranjan ______

Argued April 9, 2025 Before: HARDIMAN, PORTER, and FISHER, Circuit Judges.

(Filed: August 7, 2025) Jamisen A. Etzel ARGUED Gary F. Lynch Lynch Carpenter 1133 Penn Avenue 5th Floor Pittsburgh, PA 15222 Counsel for Appellant

Jeffrey G. Landis ARGUED ZwillGen 1900 M Street NW Suite 250 Washington, DC 20036

Sheri B. Pan ZwillGen Law 369 Pine Street Suite 506 San Francisco, CA 94104

William J. Wyrick Cafardi Ferguson Wyrick & Weis 2605 Nicholson Road Building II, Suite 2201 Sewickley, PA 15143 Counsel for Appellee

______

OPINION OF THE COURT ______

2 FISHER, Circuit Judge. Session replay code is a script1 of computer code that enables a company to track how internet users browse and interact with its website. It captures a user’s mouse movements, clicks, keystrokes, and more. A session replay code provider then aggregates the data into a video for the company reenacting the user’s visit. This can then be used to improve website functionality and user experience. Amber Cook visited GameStop’s retail website, and her interactions were captured by Clarity, a session replay code provided by Microsoft. She moved her mouse, clicked links, typed in a search bar, and added a product to her “cart.” But she did not input any sensitive or personal information. Cook sued GameStop for intrusion upon seclusion and violations of the Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA). The District Court held that Cook did not allege a concrete injury sufficient for Article III standing and dismissed her suit with prejudice. Cook appeals. We agree with the District Court that dismissal is proper, but we will modify the District Court’s order so that the dismissal will be without prejudice. I. We start by describing the technology as alleged. GameStop installed a type of session replay code from Microsoft called Clarity on its website. When a user visits GameStop’s website, Clarity delivers code to the user’s browser instructing the browser to send “‘event’ data to a designated third-party server.” App. 37 ¶ 24. This allows Clarity to “capture[] a user’s interactions with [the] website, logging every website user’s mouse movements and clicks,

1 A script is a set of instructions or commands written in a programming language that tells a computer what to do.

3 scrolling window resizing, user inputs, and more.” App. 42 ¶ 46. The information captured “can then be used to play back a user’s journey through a website, showing how they interacted with site navigation, calls to action, search features, and other on-page elements.” App. 42–43 ¶ 47. The code also assigns “a specific user ID to each website visitor so their website use and interactions can be monitored over time.” App. 42 ¶ 46. While in Pennsylvania, Cook visited GameStop’s website. She navigated the website by hovering over and clicking on various products, and by typing terms into the search bar. Though Cook never purchased anything during her visit, she added a product to her shopping cart by using her mouse to click “add to cart.” App. 45 ¶ 58. The instant Cook visited the website, the session replay code technology began recording her interactions. There is a privacy policy describing the information collected by session replay code, but it is “buried at the very bottom of the website.” App. 49 ¶ 72. Cook sued GameStop, alleging that it violated WESCA and committed intrusion upon seclusion by using session replay code on its website. Cook brought her claims as a putative class action on behalf of herself and “[a]ll natural persons in Pennsylvania whose Website Communications were captured through the use of Session Replay Code embedded in www.gamestop.com.” App. 49 ¶ 73. GameStop moved to dismiss the first amended complaint under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). It argued that she lacked Article III standing because she failed to allege an injury and, alternatively, that she failed to state a claim. The District Court agreed and granted GameStop’s motion under Rule 12(b)(1). The District Court held that Cook lacked Article III standing to bring her claims because she did not allege a concrete harm. It rejected Cook’s argument that

4 the mere recording of her website activity by GameStop was sufficient to confer standing, citing TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), which clarified that a plaintiff must allege harms analogous to those traditionally recognized at common law. It concluded that Cook’s harms were not analogous to the traditional intangible harms of disclosure of private information and intrusion upon seclusion because nothing “could connect her browsing activity to her.” App. 8. Concluding that amendment would be inequitable and futile, it dismissed with prejudice. In the alternative, it held that she failed to “plead the necessary facts to support her claims for violation of [WESCA] or intrusion upon seclusion.” App. 2. Cook appeals. II.2 “We exercise de novo review of a dismissal for a lack of standing, ‘accepting the facts alleged in the complaint as true and construing the complaint in the light most favorable to the non-moving party.’” Barclift v. Keystone Credit Servs., LLC, 93 F.4th 136, 141 (3d Cir. 2024) (quoting Potter v. Cozen & O’Connor, 46 F.4th 148, 153 (3d Cir. 2022)). “[W]e review the District Court’s dismissal of the complaint with prejudice for an abuse of discretion.” United States ex rel. Zizic v. Q2Administrators, LLC, 728 F.3d 228, 234 (3d Cir. 2013). The District Court has abused its discretion if it based that dismissal “on an erroneous view of the law.” Cooter & Gell v. Hartmarx Corp., 496 U.S. 384, 405 (1990). III.

2 The District Court had jurisdiction under 28 U.S.C. § 1332(d)(2) (diversity in class action lawsuits). We exercise appellate jurisdiction under 28 U.S.C. § 1291 (final decisions of district courts).

5 Under Article III of the United States Constitution, the power of the federal judiciary “extends only to ‘Cases’ and ‘Controversies.’” Spokeo, Inc. v. Robins, 578 U.S. 330, 337 (2016) (quoting U.S. Const. art. III, § 2). Article III standing doctrine ensures that we do not exceed our power by “limit[ing] the category of litigants empowered to maintain a lawsuit in federal court.” Id. at 338. To establish standing under Article III, a “plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Id. “The plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these elements.” Id. This appeal concerns only the first element of the standing analysis. Cook argues that GameStop’s violation of WESCA satisfies the injury-in-fact requirement. WESCA, which supplements its federal counterpart, the Electronic Communications Privacy Act, 18 U.S.C. § 2510, et seq.; Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121, 125–26 (3d Cir. 2022), prohibits the interception of electronic communications without prior consent, see 18 Pa. Cons. Stat.

6 §§ 5704(4), 5725(a).3 She says she suffered an injury in fact due to GameStop’s violation of WESCA because her “privacy was invaded when her communications with . . . GameStop’s website were intercepted” by the session replay code. Appellant’s Br. 11. A. “To establish injury in fact, a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Spokeo, 578 U.S. at 339 (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)). An alleged statutory violation is not necessarily an injury in fact; “a concrete injury” is still required. TransUnion, 594 U.S. at 426 (quoting Spokeo, 578 U.S. at 341). That is because the legislature “may not simply enact an injury into existence, using its lawmaking power to transform something that is not remotely harmful into something that is.” Id. (quoting Hagy v. Demers & Adams, 882 F.3d 616, 622 (6th Cir. 2018)). We must still “independently decide” if the plaintiff has suffered a concrete injury. Id. “An injury in law is not an injury in fact. Only those plaintiffs who have been concretely harmed by a

3 In Popa v. Harriet Carter Gifts, an online shopper sued a retail website alleging that a third-party browser intercepted her data while she shopped online, violating WESCA. 52 F.4th at 124. The shopper, like Cook, “clicked links, used the search function, and . . . added an item to her cart.” Id. The issue on appeal was whether the third party was liable under WESCA. Id. at 126. Although we proceeded to the merits, the issue of Article III standing was never analyzed. And “a summary and unexplained jurisdictional ruling . . . has no precedential effect.” Goldman v. Citigroup Glob. Markets Inc., 834 F.3d 242, 251 (3d Cir. 2016).

7 defendant’s statutory violation may sue that private defendant over that violation in federal court.” Id. at 427 (citation modified). “Traditional tangible harms, such as physical harms and monetary harms,” are considered “[t]he most obvious” concrete injuries. Id. at 425 (citation modified). But certain intangible harms are also concrete. “Chief among them are injuries with a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts.” Id. Disclosure of private information and intrusion upon seclusion are examples. Id. That is not to say all intangible harms must replicate forms of traditional relief. “Congress may ‘elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.’” Id. (quoting Spokeo, 578 U.S. at 341). To determine whether a plaintiff has suffered a concrete injury, we ask “whether the asserted harm has a ‘close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit in American courts—such as physical harm, monetary harm, or various intangible harms including . . . reputational harm.” Barclift, 93 F.4th at 145 (quoting TransUnion, 594 U.S. at 417). So “while [a plaintiff] does not need to exactly duplicate a traditionally recognized harm, [he or she] must still analogize to a harm of the same character of previously existing legally cognizable injuries.” Id. at 146 (citation modified). Bearing this framework in mind, we must consider how “close” the relationship of Cook’s asserted harm must be to a traditional harm comparator. Id. at 142. While some circuits have required a strict “element-based approach, wherein a plaintiff’s alleged harm must not lack any element of the comparator tort that was essential to liability at common law,” our approach is not so rigid. Id. at 144. We “compare the kind

8 of harm a plaintiff alleges with the kind of harm caused by the comparator tort.” Id. at 144–45. B. Cook alleged that GameStop’s WESCA violation caused the intangible harm of invasion of privacy. She says the alleged harm is closely related to harm caused by the privacy torts of disclosure of private information and intrusion upon seclusion. The District Court rejected Cook’s argument that “the mere fact that GameStop recorded any information about [her] visit to GameStop’s website is injury enough to give her standing to sue.” App. 5. We analyze each of Cook’s comparator torts in turn. 1. Disclosure of private information is also known as “unreasonable publicity given to another’s private life.” Barclift, 93 F.4th at 145. “A defendant is liable under this tort when he [or she] ‘gives publicity to a matter concerning the private life of another . . . if the matter publicized is of a kind that (a) would be highly offensive to a reasonable person, and (b) is not of legitimate concern to the public.’” Id. (quoting Restatement (Second) of Torts § 652D (1977)). The harm is “the humiliation that accompanies the disclosure of sensitive or scandalizing private information to public scrutiny.” Id. at 145–46 (quoting Nabozny v. Optio Sols. LLC, 84 F.4th 731, 736 (7th Cir. 2023)). “If there are no grounds to believe that the information will result in humiliation, then there is no comparable harm . . . .” Id. at 147. Additionally, “harm from disclosures that remain functionally internal are not closely related to those stemming from public ones.” Id. at 146. We recently examined this tort as a comparator in Barclift. There, a plaintiff alleged a collection agency violated the Fair Debt Collection Practices Act when, without her

9 consent, it shared her personal information with a third-party mailing vendor, which then mailed her a collection notice regarding her outstanding debt for medical services. Id. at 139– 40. We held “the type of injury [the plaintiff] alleged ‘is not remotely analogous to the harm caused by the tortious public dissemination of sensitive facts about another’s private life.’” Id. at 148 (quoting Nabozny, 84 F.4th at 737–38). We explained that when “communication of personal information only occurs between a debt collector and an intermediary tasked with contacting the consumer, the consumer has not suffered the kind of privacy harm traditionally associated with public disclosure.” Id. at 146. Similarly, the harm Cook alleged is not analogous to “the humiliation that accompanies the disclosure of sensitive or scandalizing private information to public scrutiny.” Id. at 145–46 (citation modified). First, the information captured by the session replay code was not sensitive or personal. Cook alleged that the code intercepted data regarding her “mouse movements, clicks, keystrokes (such as text being entered into an information field or text box), URLs of web pages visited, and/or other electronic communications in real-time.” App. 30 ¶ 1. Cook said that during a visit to GameStop’s website, she “browsed for different products for sale[,]. . . communicated with GameStop’s website by using her mouse to hover and click on certain products and typing search words into the search bar,” and “selected a product to add to her shopping cart by clicking ‘add to cart.’” App. 45 ¶ 58. Cook did not—and could not plausibly—allege that a disclosure of this information resulted in embarrassment or humiliation. Furthermore, she did not share her name, contact information, address, or billing information while on GameStop’s website. Cook alleged that GameStop “obtain[ed] certain information about her device [and] browser” and “create[d] a unique ID and

10 profile for her.” App. 45 ¶ 60. But she did not allege that GameStop identified her through this information. She alleged only that “[w]hen a user eventually identifies themselves”— something Cook never did—“the provider can then . . . back- reference all of that user’s other web browsing.” App. 39 ¶ 35. Second, even assuming the information was the type that could cause Cook humiliation under “public scrutiny,” Barclift, 93 F.4th at 146 (citation modified), the information was never publicized or even publicly disclosed. Cook’s allegations concern disclosure of information to Microsoft, a third-party vendor to GameStop, not the broader public. Cook’s alleged harm is therefore not analogous to the harm associated with the tort of disclosure of private information. 2. Intrusion upon seclusion is an intentional intrusion, “physical[] or otherwise, upon the solitude or seclusion of another or his private affairs or concerns . . . if the intrusion would be highly offensive to a reasonable person.” Kline v. Sec. Guards, Inc., 386 F.3d 246, 260 (3d Cir. 2004) (quoting Harris by Harris v. Easton Pub. Co., 483 A.2d 1377, 1383 (Pa. Super. Ct. 1984)). “The tort may occur by (1) physical intrusion into a place where the plaintiff has secluded himself or herself; (2) use of the defendant’s senses to oversee or overhear the plaintiff’s private affairs; or (3) some other form of investigation or examination into plaintiff’s private concerns.” Borse v. Piece Goods Shop, Inc., 963 F.2d 611, 621 (3d Cir. 1992). Unlike the disclosure of private information, the harm caused by intrusion upon seclusion does not turn on the exposure of personal or sensitive information. That is because the tort “consists solely of an intentional interference with [the plaintiff’s] interest in solitude or seclusion, either as to his person or as to his private affairs or concerns.” Restatement

11 (Second) of Torts § 652B cmt. a (1977). “The intrusion itself makes the defendant subject to liability, even though there is no publication or other use of any kind of the . . . information” acquired. Id. cmt. b. In Susinno v. Work Out World, Inc., we recognized that an unsolicited telemarketing call—even one that does not involve private or sensitive information—disturbs the recipient’s solitude. 862 F.3d 346, 352 (3d Cir. 2017). We held, therefore, that a statute prohibiting such unsolicited calls “protect[s] the same interests implicated in the traditional common law cause of action” of intrusion upon seclusion. Id. Cook conclusorily alleged that session replay code’s capability is the “electronic equivalent of ‘looking over the shoulder’ of each visitor to the GameStop website for the entire duration of their website interaction.” App. 31 ¶ 2. And she says her “electronic communications with GameStop” were presumed private. Appellant’s Br. 39–40. But “[m]ost of us understand that what we do on the Internet is not completely private.” In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 266 (3d Cir. 2016). And, for the same reasons discussed above for the tort of disclosure of private facts, none of the information Cook entered on GameStop’s website was personal or sensitive. So, unlike the recipient of an unsolicited telemarketing call, Cook cannot plausibly allege that there was an intrusion of her solitude or seclusion as to her person or private affairs. Therefore, Cook’s alleged harm is not analogous to the harm associated with intrusion upon seclusion, and she lacks Article III standing to pursue her common law claim as well. C. Cook argues that “WESCA codifies a presumption of privacy in all electronic communications.” Appellant’s Br. 45. She claims, “as a matter of state policy,” that “the interception of electronic communications does not include a precondition

12 that the claimant have a ‘reasonable expectation of privacy.’” Appellant’s Br. 45 (quoting App. 7). She asserts that “the statute’s expansion of protection to a wider range of information than would be protected by the common law is precisely the type of ‘elevation’ of an intangible harm into a concrete injury that Spokeo and TransUnion permit.” Appellant’s Br. 46. This misconstrues the meaning of “elevation” in TransUnion. A legislature may “elevate harms that exist in the real world” to make them legally actionable. TransUnion, 594 U.S. at 426 (quoting Hagy, 882 F.3d at 622) (citation modified). But it “may not simply enact an injury into existence, using its lawmaking power to transform something that is not remotely harmful into something that is.” Id. (quoting Hagy, 882 F.3d at 622). Cook’s theory contradicts this fundamental holding of TransUnion. The harm caused by intrusion upon seclusion necessarily accompanies an intrusion into a person’s solitude or private affairs. Absent that type of intrusion, the harm Cook alleged is not similar. Critically, TransUnion tells us to consider the plaintiff’s concrete harm alleged, not the harm the statutory cause of action typically protects against. See id. at 426–27 (“[A]n important difference exists between (i) a plaintiff’s statutory cause of action to sue a defendant over the defendant’s violation of federal law, and (ii) a plaintiff’s suffering concrete harm because of the defendant’s violation of federal law.”). Cook’s theory starts with GameStop’s alleged violation of WESCA itself. She assumes that “her alleged harm from GameStop’s WESCA violation satisfies the Spokeo test because, by protecting communications from unauthorized eavesdropping, the WESCA statute protects against the same kind of harm—an invasion of privacy—that has long been recognized at common law, not just by wiretapping statutes.”

13 Appellant’s Br. 37. Cook incorrectly implies that wherever there is a statutory violation of WESCA for tracking web browsing information, there also is an invasion of privacy and thus a concrete harm.4 Cook also argues that assessing “whether [she] established a ‘reasonable expectation of privacy’ in her communications with GameStop before deciding the question of standing . . . conflates standing with [the] merits.” Appellant’s Br. 41. She maintains that whether product preferences qualify as personal or sensitive information is a merits issue. But we always independently determine if allegations “affirmatively and plausibly suggest . . . standing to sue.” Knudsen v. MetLife Grp., Inc., 117 F.4th 570, 576–77 (3d Cir. 2024) (quoting Finkelman v. Nat’l Football League, 810 F.3d 187, 194 (3d Cir. 2016)). And we have decided similar issues at the pleading stage. Nickelodeon, 827 F.3d at 295 n.205 (explaining that in an intrusion upon seclusion claim, we “may decide the ‘highly offensive’ issue as a matter of law at the pleading stage when appropriate”). Because Cook does not plausibly allege that she was secluded, in solitude, or that her website activity involved her private affairs, she does not allege a kind of harm sufficient for standing. This conclusion is not a premature merits determination, but an assessment of the plausibility of her alleged injury as it pertains to standing.

4 Of course, that Cook lacks standing does not mean that no plaintiff can proceed in federal court to seek redress of web-browsing tracking under WESCA. See Hunstein v. Preferred Collection & Mgmt. Servs., Inc., 48 F.4th 1236, 1248 (11th Cir. 2022) (“Our standing inquiry centers on whether a given plaintiff has pleaded injury . . . . The fact that one plaintiff . . . has not pleaded injury under this statute does not show that no one else can or will.”).

14 D. Cook also relies on two of our cases—Nickelodeon and Google II—which held plaintiffs suffered a concrete harm from the tracking of their internet browsing activity. For the reasons that follow, these cases are not controlling. In Nickelodeon, we considered whether a concrete injury occurred when a website operator stated it would not collect the personal information of children visiting Nick.com, but did so anyway. Nickelodeon, 827 F.3d at 269. Cook highlights that we said the harm was “clearly particularized, as each plaintiff complains about the disclosure of information relating to his or her online behavior.” Id. at 274. We held the “unlawful disclosure of legally protected information” was a “clear de facto injury.” Id. Cook’s allegations are materially different. Principally, Nick.com promised not to collect information. Nick.com’s registration form included a message for parents of children who wanted to register for an account: “HEY GROWN-UPS: We don’t collect ANY personal information about your kids. Which means we couldn’t share it even if we wanted to!” Id. at 269. By contrast, Cook alleged only that “GameStop [did] not ask website visitors . . . for prior consent before” collecting web browsing activity. App. 48 ¶ 70. In Google II, we considered whether a concrete injury occurred when Google “bypass[ed] Safari and Internet Explorer privacy settings and track[ed] internet-user information” by creating a web browser cookie. In re: Google Inc. Cookie Placement Consumer Priv. Litig., 934 F.3d 316, 321 (3d Cir. 2019) (Google II). We held that the alleged injury was sufficiently concrete. “History and tradition reinforce that a concrete injury for Article III standing purposes occurs when Google, or any other third party, tracks a person’s internet browser activity without authorization. Privacy torts have

15 become ‘well-ensconced in the fabric of American law.’” Id. at 325 (quoting In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 638 (3d Cir. 2017)). Cook says these cases are controlling because “they involved nonconsensual tracking of individuals’ internet browsing.” Appellant’s Br. 30. But the allegations in Google II and Nickelodeon were “indistinguishable” from one another— and distinguishable from this case—because the “plaintiffs alleged that a third party . . . tracked their personal internet browsing information in violation of the third party’s own promises not to do so.” Google II, 934 F.3d at 325. As stated above, GameStop made no promise to refrain from collecting information, and, in fact, disclosed what information it would collect, albeit in an allegedly inconspicuous location on its website. * * * In sum, Cook did not suffer a concrete injury. Her alleged harm is not the kind of harm caused by the privacy torts of disclosure of private information and intrusion upon seclusion. Because Cook has not suffered a concrete injury, she did not adequately allege an injury in fact. We therefore conclude that Cook lacks Article III standing.5 IV. The District Court correctly dismissed Cook’s amended complaint for lack of jurisdiction, but it legally erred in dismissing it with prejudice and consequently abused its

5 Because Cook lacks Article III standing, we are precluded from addressing the merits of her WESCA and intrusion upon seclusion claims. Associated Builders & Contractors W. Pa. v. Cmty. Coll. of Allegheny Cnty., 81 F.4th 279, 291 n.8 (3d Cir. 2023).

16 discretion. Cook does not raise this issue in her brief, but because it implicates our subject matter jurisdiction, it cannot be waived or forfeited, and we must consider it independently. See Vuyanich v. Smithton Borough, 5 F.4th 379, 385 (3d Cir. 2021). The District Court noted that Cook failed to submit a second amended complaint to cure the jurisdictional defect and, in fact, conceded that the defect could not be cured. It therefore concluded that “amendment would be inequitable and futile and [granted] GameStop’s motion to dismiss with prejudice.” App. 12. “Because the absence of standing leaves the court without subject matter jurisdiction to reach a decision on the merits, dismissals ‘with prejudice’ for lack of standing are generally improper.” Barclift, 93 F.4th at 148 (quoting Cottrell v. Alcon Lab’ys, 874 F.3d 154, 164 n.7 (3d Cir. 2017)). Even when a district court determines that granting leave to amend would be futile, id. at 140, the “general rule applies” and a dismissal for lack of Article III standing must be “without prejudice,” id. at 148. So we will modify the District Court’s order to dismiss the amended complaint without prejudice and affirm that order as modified. V. For the foregoing reasons, we will affirm the District Court’s order to dismiss the complaint without prejudice and affirm the order as modified.