DELONG v. PHE, INC.

• Court: District Court, E.D. Pennsylvania
• Decided: August 25, 2025
• Docket: 2:24-cv-05212
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA

SHAWN DELONG : CIVIL ACTION : v. : NO. 24-5212 : PHE, INC. :

MEMORANDUM

MURPHY, J. August 25, 2025

These days, federal courts are inundated with complaints aimed at the ubiquitous practice of tracking the behavior of internet users. No one likes the idea of being watched, and lawyers are creative. The devil, of course, is in the details, like what sort of information are we talking about, how does the tracking work, who gets the information, what state are we in, what causes of action are available, and what did the website say it would do with user information? In this case, the twist is the nature of defendant’s website, Adam & Eve. It sells sex toys and other adult products. According to the plaintiff, shopper tracking data that would be mundane at any other store is of a personal and sensitive nature at defendant’s. So Mr. Delong sued under Pennsylvania’s Wiretapping and Electronic Surveillance Control Act, alleging that the website violated the act by collecting and sharing his shopping behavior and IP address with the tracking service, Google Analytics. But the problem is that Mr. Delong has not established that he had any expectation of privacy in his online browsing, just as Mr. Delong could be freely observed by store clerks or nosy neighbors browsing the shelves at a brick-and-mortar Adam & Eve store. And that problem fatally erodes his Article III standing because he did not establish that he has suffered a concrete injury. We also find, in the alternative, that we lack personal jurisdiction over PHE because its only activities directed to Pennsylvania (product sales through the website) do not relate to the cause of action, which arises from web browsing entirely unspecific to Pennsylvania. Accordingly, we dismiss the complaint without prejudice. I. Background PHE is the owner and operator of Adam & Eve, which sells adult products through an online retail website. DI 8-1 at 1. Mr. Delong was a customer. DI 1 ¶ 4. This purported class action alleges that PHE violated Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (WESCA), 18 Pa. Const. Stat. § 5701 by using Google Analytics to track the activities of visitors to the Adam & Eve website. Id. ¶¶ 1-7. According to the complaint, Google Analytics is a web analytics service that “allows website owners to track visitor actions on their website in order to target them with personalized advertisements.” Id. ¶ 17. When the website uses Google Analytics, a third party (Google) receives customers’ IP addresses and their

actions on the website, which Mr. Delong says is an invasion of privacy. Id. ¶¶ 5-6, 15. Mr. Delong alleges that PHE “immediately,” without notice or consent, shared with Google Analytics the products he searched, selected, viewed, added to cart, and purchased on the website. Id. ¶¶ 5, 23, 25, 27, 28. He further alleges that an IP address “is a number that identifies a specific device connected to the Internet and its geolocation” and that PHE did not enable Google Analytics’ opt-in IP anonymization feature. Id. ¶¶ 14, 15, 18-19. PHE responded to the complaint with a motion to dismiss. DI 8. II. Analysis PHE moves on three grounds: lack of Article III standing, lack of personal jurisdiction,

2 and failure to state a claim. First, PHE moves to dismiss Mr. Delong’s complaint for lack of subject-matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1). DI 8-1 at 3-8. PHE argues Mr. Delong fails to allege injury-in-fact sufficient to support Article III standing. Id. at 8-14. As the party invoking federal jurisdiction, plaintiff bears the burden of establishing injury- in-fact. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 (1992); Hedges v. United States, 404 F.3d 744, 750 (3d Cir. 2005) (“When subject matter jurisdiction is challenged under Rule 12(b)(1), the plaintiff must bear the burden of persuasion.” (quoting Kehr Packages, Inc. v. Fidelcor, Inc., 926 F.2d 1406, 1409 (3d Cir. 1991)). In the alternative, PHE moves to dismiss Mr. Delong’s complaint for lack of personal jurisdiction under Federal Rule of Civil Procedure 12(b)(2). DI 8-1 at 2; DI 13 at 6-9. The plaintiff bears the burden of alleging facts that demonstrate personal jurisdiction over the defendant is proper. Pinker v. Roche Holdings Ltd., 292 F.3d 361, 368 (3d Cir. 2002). When

reviewing a Rule 12(b)(2) motion, we accept the plaintiff’s allegations as true and construe disputed facts in favor of the plaintiff. Id. The analysis below first addresses the issue of standing. Although that issue is dispositive because we find a lack of standing, we also analyze the issue of personal jurisdiction as an alternative basis for dismissal. We do not reach PHE’s argument that Mr. Delong failed to state a claim under WESCA. A. Mr. Delong lacks injury-in-fact sufficient to establish Article III standing Federal courts have limited subject-matter jurisdiction and may adjudicate only claims with Article III standing. TransUnion LLC v. Ramirez, 594 U.S. 413, 422-24 (2021). Article III

3 requires a claimant to demonstrate (1) an injury-in-fact that is (2) traceable to the alleged conduct and (3) can be redressed by a favorable judicial decision. Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). The injury-in-fact requirement helps ensure federal courts resolve only “cases” or “controversies,” in accordance with Article III. Lujan, 504 U.S. at 560. An injury-in- fact requires suffering “an invasion of a legally protected interest” that is “concrete and particularized,” as well as “actual or imminent, not conjectural or hypothetical.” Id. Concrete injuries must be “real” and not “abstract.” Spokeo, 578 U.S. at 339. Congress can create “legal rights,” but a statutory violation alone does not automatically confer Article III standing; claims in federal court must still allege a concrete and particularized injury-in-fact. Lujan, 504 U.S. at 578; Spokeo, 578 U.S. at 341; TransUnion, 594 U.S. at 426- 427 (holding a “bare procedural violation” of the Fair Credit Reporting Act, without concrete harm, does not satisfy injury-in-fact for standing). “An alleged statutory violation is not

necessarily an injury in fact; ‘a concrete injury’ is still required.” Cook v. GameStop, Inc., No. 23-2574, 2025 WL 2250261, at *3 (3d Cir. Aug. 7, 2025) (quoting TransUnion, 594 U.S. at 426). A concrete injury need not be a “tangible” harm, such as monetary loss or physical injury. Spokeo, 578 U.S. at 340. However, affording claimants standing for intangible injuries is not “an open-ended invitation to loosen Article III based on contemporary, evolving beliefs . . . .” TransUnion, 594 U.S. at 424-25. An intangible harm may be sufficiently concrete for injury-in-fact when it “has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in

4 English or American courts.” Spokeo, 578 U.S. at 340-41. The injury should be “of the same character of previously existing ‘legally cognizable injuries.’” Barclift v. Keystone Credit Servs., LLC, 93 F.4th 136, 146 (3d Cir. 2024) (quoting Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 114 (3d Cir. 2019)). An intangible injury should have “a close historical or common-law analogue,” but “an exact duplicate in American history and tradition” is not required. TransUnion, 594 U.S. at 424. Requiring a close relationship to a common-law harm helps prevent federal courts from using “freewheeling power to hold defendants accountable for legal infractions.” Id. at 427 (quoting Casillas v. Madison Ave. Assocs., Inc., 926 F.3d 329, 332 (7th Cir. 2019) (J. Barrett)). Privacy torts are “well-ensconced in the fabric of American law” and can serve as comparator torts for assessing the concreteness of intangible injuries. In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 638 (3d Cir. 2017); see Cook, 2025 WL 2250261, at *3; TransUnion, 594 U.S. at 425; Barclift, 93 F.4th at 146. “At common law, actionable

invasions of privacy are typically categorized into four separate torts: intrusion upon seclusion, appropriation of name or likeness, unreasonable publicity given to another's private life, and false light.” Barclift, 93 F.4th at 145. The Third Circuit assesses a complaint’s relationship to a tort for Article III standing by determining if the alleged injury creates harm that is of the “kind” stemming from a comparator tort; satisfying elements of the comparator tort is not required. Id. (emphasizing TransUnion only discusses harms without ever using the term “element”); Cook, 2025 WL 2250261, at *3; see TransUnion, 594 U.S. at 434 (finding any alleged injury relying on defamation as a common- law analogue had to exhibit the tort’s essential quality of publication). “A close relationship

5 does not require that the newly proscribed conduct would give rise to a cause of action under common law. But it does require that newly established causes of action protect essentially the same interests that traditional causes of action sought to protect.” Susinno v. Work Out World Inc., 862 F.3d 346, 351 (3d Cir. 2017) (citation modified). Mr. Delong’s complaint alleges that PHE violated WESCA by disclosing, without consent, to Google Analytics his non-anonymized IP address and “highly sensitive and private” adult-product search and purchase information on the Adam & Eve website. See DI 1; DI 10 at 5. In its motion to dismiss, PHE argues Mr. Delong’s complaint lacks standing because it alleges only speculative future harm and does not allege Google publicized Mr. Delong’s data, and that this allegedly intercepted data is not the kind of information that privacy laws protect. See DI 8- 1 at 6-8; DI 13 at 3-6. In response, Mr. Delong says the “[d]efendant disclosed to a third party information

about his sexual activities and preferences,” and that this demonstrates injury-in-fact. DI 10 at 4. Mr. Delong contends the injury is particularized because the information disclosed was “his highly sensitive personal information, entirely particular to him.” Id. at 5-6. Mr. Delong argues that this injury is concrete because PHE “shared information about Plaintiff’s sexual interests, activity, and history with a third-party multinational corporation,” and that this conduct “mirrors the traditional tort of intrusion upon seclusion.” Id. at 7 (citing In re: Google Inc. Cookie Placement Consumer Privacy Litig., 934 F.3d 316, 320 (3d Cir. 2019) (Google II)). Mr. Delong maintains that customers have “an expectation of discretion and privacy in a store that sells such intimate items.” Id. at 9. He argues that disclosing such intimate information constitutes a

6 concrete harm, and that his complaint differs from other cases where the electronic disclosure of “far less sensitive personal information” did not constitute a concrete harm. Id. at 7 (citing cases). We agree with PHE that Mr. Delong does not allege a concrete harm sufficient to establish injury-in-fact for Article III standing. The alleged injury is not concrete because it does not have a close relationship to the harm traditionally protected by intrusion upon seclusion, which Mr. Delong proffers as his analogous common-law tort. See Barclift, 93 F.4th at 144-46. An injury is particularized if it “affect[s]” the plaintiff in a “personal and individual way.” Spokeo, 578 U.S. at 339-40. We agree with Mr. Delong that his complaint alleges particularized harm because the alleged injury is the interception of his own browsing activity on PHE’s website. See DI 1; In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 273-74 (2016) (“The purported injury here is clearly particularized, as each plaintiff complains about

the disclosure of information relating to his or her online behavior.”). However, we agree with PHE that Mr. Delong has not alleged a concrete harm. Federal claims require concrete injury beyond the mere assertion of a statutory violation. Lujan, 504 U.S. at 578. “[A]n injury in law is not an injury in fact. Only those plaintiffs who have been concretely harmed by a defendant’s statutory violation may sue that private defendant over that violation in federal court.” TransUnion, 594 U.S. at 427.1 Thus, even assuming that Mr.

1 “That a suit may be a class action . . . adds nothing to the question of standing, for even named plaintiffs who represent a class must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong.” Spokeo, 578 U.S. at 338 n.6 (citation modified) (quoting Simon v. Eastern Ky. Welfare Rts. Org., 426 U.S. 26, 40 n.20 (1976)). 7 Delong stated a claim under WESCA, that alone does not answer the standing question. Although intangible harms can be concrete, he must allege more than merely abstract injuries stemming solely from statutory breaches. See Spokeo, 578 U.S. at 340-41. To determine whether an intangible harm is sufficiently concrete, we assess “whether the asserted harm has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a lawsuit in American courts.” TransUnion, 594 U.S. at 417 (quoting Spokeo, 578 U.S. at 340). Mr. Delong argues that PHE’s intentional disclosure of “his highly sensitive, private personal information to a third party[, Google,] without his knowledge or consent” is a concrete injury. DI 10 at 7. He contends that this alleged harm has a sufficiently close relationship to the harm associated with the tort of intrusion upon seclusion. Id. at 6-7; see TransUnion, 594 U.S. at 417; Barclift, 93 F.4th at 146. But because Mr. Delong does not demonstrate that he had a reasonable expectation for his purchases or browsing activity on PHE’s website to be private,

the alleged harm is insufficiently analogous to the kind of harm recognized in intrusion-upon- seclusion claims.2 Intrusion upon seclusion is the intentional intrusion, “physical[] or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, . . . if the intrusion would be highly offensive to a reasonable person.” Borse v. Piece Goods Shop, Inc., 963 F.2d 611, 620 (3d Cir. 1992) (quoting Restatement (Second) of Torts § 652B); see Boring v. Google Inc., 362 F. App’x 273, 278-79 (3d Cir. 2010). Intrusion upon seclusion may occur through “(1) physical

2 While the complaint often mentions “disclosure,” at oral argument Mr. Delong confirmed that the purported comparable tort is intrusion upon seclusion. 8 intrusion into a place where the plaintiff has secluded himself or herself; (2) use of the defendant’s senses to oversee or overhear the plaintiff's private affairs; or (3) some other form of investigation or examination into plaintiff’s private concerns.” Borse, 963 F.2d at 621. To assess injury-in-fact, our analysis focuses specifically on the harm that results from the intrusion itself. See Boring, 362 F. App’x at 279. Generally, harms arising from intrusion upon seclusion involve significant nuisance or invasions of privacy that disturb reasonable expectations of solitude, causing “mental suffering, shame[,] or humiliation” to “a person of ordinary sensibilities.” Id. at 278-79 (quoting Pro Golf Mfg., Inc. v. Tribune Rev. Newspaper Co., 809 A.2d 243, 247 (Pa. 2002) (citations omitted); see Susinno, 862 F.3d at 351-52. Unlike other privacy torts, such as defamation or public disclosure of private facts, intrusion upon seclusion does not require publication or dissemination of information to the public. Cook, 2025 WL 2250261, at *4; see Borse, 963 F.2d at 621; Boring, 362 F. App’x at 279.

Mr. Delong argues that the harm he suffered parallels intrusion upon seclusion because PHE and Google3 collected highly sensitive, private information about his “sexual interests, activity, and history.” DI 10 at 7; DI 1 ¶¶ 1, 15. Mr. Delong’s argument misses the mark. Although Mr. Delong plausibly alleges that the collected information is sensitive, Mr. Delong has not shown that the alleged acts of collection and disclosure caused a highly offensive intrusion that violated Mr. Delong’s reasonable expectation of privacy while using PHE’s website.

3 Google is not a party to this action. All of Mr. Delong’s claims allege harm caused by PHE. 9 It is widely understood that most online activity is not entirely private. See Nickelodeon, 827 F.3d at 266 (“Most of us understand that what we do on the Internet is not completely private. . . . We recognize, even if only intuitively, that our data has to be going somewhere.”); see Cook, 2025 WL 2250261, at *5. Thus, the exact nature of the online activity is highly material to the degree of privacy one can reasonably expect. Consistent with this understanding, courts in this district have held that invasion-of-privacy claims based solely on the tracking of online retail behavior do not confer Article III standing. See Heaven v. Prime Hydration LLC, 761 F. Supp. 3d 812, 819 (E.D. Pa. 2025) (citing In re BPS Direct, LLC, 705 F. Supp. 3d 333 (E.D. Pa. 2024)). While “private companies often promise to protect their customers’ privacy in ways that may be enforceable in court,” merely collecting and analyzing online shopping behavior — without further allegations such as explicitly promising confidentiality or disclosing certain types of private information — does not constitute a concrete harm for injury-in-

fact. Nickelodeon, 827 F.3d at 267; see Heaven, 761 F. Supp. 3d. at 820; Hartley v. Urban Outfitters, Inc., 740 F. Supp. 3d 410, 421-22 (E.D. Pa. 2024) (finding defendant recording information about consumers opening promotional emails did not create injury-in-fact); Ingrao v. AddShoppers Inc., No. 24-1022, 2024 WL 4892514, at *2 (E.D. Pa. Nov. 25, 2024) (finding browsing activity and email address was not “sufficiently sensitive information” for a concrete injury). In both Google and Nickelodeon, the Third Circuit found that claims under the federal Wiretap Act and of common law intrusion upon seclusion sufficiently alleged concrete harm where website operators promised to not disclose users’ online activity, thereby creating a

10 reasonable expectation of privacy, and then broke their own promises by tracking and disclosing such information. In re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125, 149-52 (3d Cir. 2015) (Google I); Google II, 934 F.3d at 324-25; Nickelodeon, 827 F.3d at 293- 95; Cook, 2025 WL 2250261, at *6 (“[T]he allegations in Google II and Nickelodeon were ‘indistinguishable’ from one another — and distinguishable from this case — because the ‘plaintiffs alleged that a third party . . . tracked their personal internet browsing information in violation of the third party's own promises not to do so.’” (quoting Google II, 934 F.3d at 325)). Further, the Nickelodeon court emphasized that “the heart” of the intrusion-upon- seclusion claim was not that the website operator “collected children’s personal information, or even that they disclosed it,” but that it “created an expectation of privacy” by promising not to track and proceeded to do so anyway “under false pretenses.” 827 F.3d at 292. Therefore, claims alleging third-party tracking of website browsing and purchase information, without an

expectation of privacy, cannot allege the same kind of harm as an intrusion-upon-seclusion claim. Here, Mr. Delong does not allege that PHE made any explicit promises creating a reasonable expectation of privacy on its website that could make PHE’s use of Google Analytics an intrusion sufficient to confer standing. He has not alleged facts showing that PHE’s routine collection and disclosure of his IP address, browsing history, and purchase data to Google Analytics amounted to a highly offensive intrusion upon his private concerns. Internet users typically understand and implicitly accept that their IP addresses and online shopping activities are routinely shared with website operators and third parties during normal browsing. See id. at

11 266. It is fundamental to the act of online shopping that information related to purchases made by consumers is given to the retailer, and it is reasonable to expect that the retailer could be using third-party tracking tools to collect that same essential data. Absent assurances of confidentiality or privacy, there is no reasonable expectation that such common business information will not be collected, and Mr. Delong does not allege that PHE made any such promises related to tracking its users’ browsing histories or purchases. Because the focus of our analysis here is on the harm that results directly from the alleged intrusion, a lack of any demonstrated expectation of privacy is dispositive of the standing issue. See Borse, 963 F.2d at 621. Internet users customarily volunteer their browsing behavior to websites during normal internet use. The alleged data collection here is typical in the digital world, and the way it was allegedly done here is not highly offensive. Some of Mr. Delong’s arguments focus on the business of the Adam & Eve website —

selling sex toys and other adult products that are, by their nature, personal and potentially embarrassing. For example, PHE’s promise of discreet shipping for product delivery does not create a reasonable expectation of privacy from online data collection. Mr. Delong argues that PHE “acknowledges right on its website that the items its customers purchase are sensitive and private and should be treated with discretion,” and that such acknowledgments create a reasonable expectation of privacy. DI 10 at 10 (stating the website promises “[p]lain, [a]nonymous [p]ackaging” and “[w]hen you order a sex toy, the last thing you want is for your mailman or anyone else to know about it.”); DI 10-4. However, a promise to discreetly ship products relates only to physical delivery and does not imply a broader commitment to refrain

12 from tracking online behavior or collecting purchase information. Mr. Delong does not point to any specific promise by PHE, akin to those made in Google and Nickelodeon, to abstain from online tracking or data collection. Thus, PHE’s assurances about discrete shipping do not alter the privacy expectations of website users. Nor does the nature of the products themselves make a difference here. Mr. Delong alleges that PHE and Google collected his non-anonymized IP address along with his browsing history, search terms, and purchases on an adult website. DI 1 ¶¶ 2, 15, 19-23. While a third party collecting certain data like credit card, banking, or medical information may constitute concrete harm, that is because such harm is analogous to harms related to different privacy torts — such as public disclosure of private information — and only because such information is private. See Cook, 2025 WL 2250261, at *4-5 (finding that because GameStop did not capture the plaintiff’s “personal or sensitive” information, like her “name, contact information, address,

or billing information,” when it allegedly tracked her “mouse movements, clicks, keystrokes[,] . . . URLs of web pages visited, and/or other electronic communications in real-time,” the plaintiff could not “plausibly allege that there was an intrusion of her solitude or seclusion as to her person or private affairs.”). Without more, preference for certain products, including those sexual in nature, is not private information. Cf. U.S. Dep’t of Justice v. Reporters Comm. For Freedom of Press, 489 U.S. 749, 763 (1989) (“[T]he common law and the literal understandings of privacy encompass the individual’s control of information concerning his or her person. . . . Thus the extent of the protection accorded a privacy right at common law rested in part on the degree of dissemination of the allegedly private fact.”). While the sensitive nature of

13 allegedly intercepted information may help demonstrate whether the interception is highly offensive, “the harm caused by intrusion upon seclusion does not turn on the exposure of personal or sensitive information.” Cook, 2025 WL 2250261, at *4; see Borse, 963 F.2d at 621- 26 (explaining that while “[t]here are few activities in our society more personal or private than the passing of urine,” employers do not necessarily commit intrusion upon seclusion by requiring employees to submit to a urinalysis for the purpose of drug-testing (quoting Skinner v. Ry. Lab. Execs.’ Ass’n, 489 U.S. 602, 617 (1989))). Product preferences are implicitly disclosed through commonplace shopping activity. And while a customer might not like to have his online shopping activity tracked — on an adult-products website as well as any other — as other courts have recognized, there is no meaningful privacy distinction between shopping online and shopping in retail stores. See In re BPS Direct, 705 F. Supp. 3d at 355-56; Heaven, 761 F. Supp. 3d at 820; see also Jones v.

Bloomingdales.com, LLC, 124 F.4th 535, 539 (8th Cir. 2024); Arndt v. Gov’t Emps. Ins. Co., 750 F. Supp. 3d 518, 528 (D. Md. 2024). Whether consumers enter a brick-and-mortar adult- products store or browse online, their preferences are inherently disclosed to the store, employees, or any other customers who might happen by. See In re BPS Direct, 705 F. Supp. 3d at 356 (“Website Users do not have a personal privacy interest in their shopping activity.”). It is not a highly offensive intrusion into Mr. Delong’s private affairs for PHE, an online retailer, to learn information about Mr. Delong’s preferences for certain adult products through his own browsing and purchasing of those same adult products on PHE’s website. We also note that courts have not considered static IP addresses to be sensitive personal

14 information in similar contexts. See Nickelodeon, 827 F.3d at 282-83 (finding that, in the context of the Video Privacy Protection Act, static IP addresses are very low on the spectrum of personal information because “an IP address or a digital code in a cookie file would likely be of little help in trying to identify an actual person”); see also Cook v. GameStop, Inc., 689 F. Supp. 3d 58, 65 (W.D. Pa. 2023) (finding that in the context of public disclosure of private information, such information must not be “open to the public eye” (quoting Restatement (Second) of Torts § 652D cmt. b.)). Static IP addresses are customarily disclosed through ordinary internet usage, and an individual of normal sensibilities would not be offended if a website they visit obtained his IP address. It is a fact of modern life that internet users do not reasonably expect all their online activity to be private. A reasonable person would expect that an online retailer — absent an express promise not to — would have access to their IP address, searches, clicks, and purchases

just like a brick-and-mortar store would be expected to observe its customers. Adult merchandise may be more intimate than products sold in other online stores, but that alone does not change the background expectation of privacy on a website. Adult-product preferences are still product preferences, and the information allegedly disclosed here was gleaned from routine browsing and purchasing. Because Mr. Delong’s argument analogizes his alleged harm to intrusion upon seclusion, and the conduct at issue does not rise to the requisite level of a highly offensive intrusion, he has not alleged a concrete harm sufficient to establish Article III standing. B. The complaint may also be dismissed for lack of personal jurisdiction

15 Under Federal Rule of Civil Procedure 4(k)(1)(A), district courts may exercise personal jurisdiction over an out-of-state defendant in diversity cases “to the extent permitted by the law of the forum state.” Hasson v. FullStory, Inc., 114 F.4th 181, 186 (3d Cir. 2024). The long-arm statute in Pennsylvania permits jurisdiction over defendants “based on the most minimum contact with th[e] Commonwealth allowed under the Constitution of the United States.” Id. (quoting 42 Pa. Cons. Stat. § 5322(b)). Personal jurisdiction may be general or specific. Remick v. Manfredy, 238 F.3d 248, 255 (3d Cir. 2001). We have general jurisdiction over a party with “continuous and systematic” contacts with the forum such that the party is “essentially at home” in the forum. Id.; Ford Motor Co. v. Montana Eighth Jud. Dist. Ct., 592 U.S. 351, 352 (2021). We may exercise specific personal jurisdiction over an out-of-state defendant when the “plaintiff's cause of action is related to or arises out of the defendant's contacts with the forum.” Pinker, 292 F.3d at

368. We use either the “traditional” test or the Calder “effects” test to assess whether we may exercise specific personal jurisdiction over a defendant. Hasson, 114 F.4th at 186-87. Specific personal jurisdiction may be proper through the Calder effects test where “(1) the defendant committed an intentional tort; (2) the plaintiff felt the brunt of the harm in the forum; and (3) the defendant expressly aimed his tortious conduct at the forum.” Id. at 187 (citing Remick, 238 F.3d at 258). The traditional test for specific jurisdiction requires claims to meet three criteria. Id. at 186. First, the defendant must have “minimum contacts” with the forum such that it “purposefully avails itself of the privilege of conducting activities within the forum State, thus invoking the benefits and protections of its laws.” Asahi Metal Indus. Co. v.

16 Superior Ct. of Cal., Solano Cnty., 480 U.S. 102, 109 (1987) (quoting Burger King Corp. v. Rudzewicz, 471 U.S. 462, 475 (1985)). Second, the claims must “arise out of or relate to” at least some of those minimum contacts. Helicopteros Nat’l de Colom., S.A. v. Hall, 466 U.S. 408, 414 (1984). These contacts should evidence “a strong relationship among the defendant, the forum, and the litigation.” Hepp v. Facebook, 14 F.4th 204, 208 (3d Cir. 2021) (citation modified) (quoting Ford, 592 U.S. at 365). Third, exercising such jurisdiction must “not offend ‘traditional notions of fair play and substantial justice.’” World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 292 (1980) (quoting Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)). Defendants should be able to “reasonably anticipate being haled into court” in that forum. Id. at 297. Mr. Delong argues that personal jurisdiction over PHE is proper in Pennsylvania because class members using the Adam & Eve website had their “internet messages, reports, and/or communications . . . sent from and received in Pennsylvania.” DI 1 ¶¶

54-56. PHE argues that such contacts do not confer personal jurisdiction in Pennsylvania under either the Calder effects test or the traditional minimum contacts test. DI 8-1 at 2, 13-14. Under the traditional test, PHE argues that Mr. Delong does not show a sufficient nexus between PHE, the alleged wiretapping, and Pennsylvania. Id. at 14. PHE further argues that the Calder effects test also does not confer jurisdiction because PHE’s website has national reach and PHE neither targeted nor expressly aimed its allegedly tortious conduct toward Pennsylvania, and therefore, PHE did not “purposefully avail[] itself of the benefits and protections of Pennsylvania law.” Id. at 2, 9 (citing Remick, 238 F.3d at 255).

17 In response, Mr. Delong argues that PHE has sold many products to Pennsylvania residents. DI 10 at 10. He says that a website operator like PHE purposefully avails itself to the benefits and privileges of conducting business in a forum if it directly targets a website to the state, knowingly interacts with state residents through the website, or has “sufficient other related contacts.” Id. at 11 (citing Toys “R” Us, Inc., v. Step Two, S.A., 318 F.3d 446, 454 (3d Cir. 2003)). He asserts that PHE purposefully availed itself to this forum by conducting business transactions with Pennsylvania customers when it “repeatedly and consciously cho[se] to process Pennsylvania residents’ interactions and orders, ‘knowing that this contact would result in business relationships with Pennsylvania customers.’” Id. at 18 (quoting Toys “R” Us, Inc., 318 F.3d at 452). Mr. Delong argues PHE satisfied the traditional test when it “knowingly interact[ed] with residents of Pennsylvania” while allegedly inflicting the injury of disclosing users’ data to Google Analytics. Id. at 13.

Mr. Delong’s claims do not permit us to exercise personal jurisdiction over PHE. While we accept the allegation that Pennsylvanians both access and purchase products through PHE’s website, that is not enough under either test for specific personal jurisdiction.4 Calder effects test. Mr. Delong cannot demonstrate personal jurisdiction through the Calder effects test because he does not allege that PHE expressly aimed its allegedly tortious conduct at the forum. See Remick, 238 F.3d at 258. A defendant’s website-related conduct may be expressly aimed at a forum if its website is “targeted at a particular jurisdiction.” Toys “R”

4 There is no serious dispute that there could be general personal jurisdiction over PHE in Pennsylvania. 18 Us, Inc., 318 F.3d at 452 (quoting S. Morantz, Inc. v. Hang & Shine Ultrasonics, Inc., 79 F. Supp. 2d 537, 540 (E.D. Pa. 1999)). However, “a defendant does not expressly target a forum merely by operating a website that is accessible there — even when the plaintiff alleges harm in that forum arising out of his engagement with that website.” Hasson, 114 F.4th at 190. Mr. Delong alleges that Pennsylvanians have purchased products from PHE’s website, but he does not allege facts showing the website is expressly aimed at Pennsylvania to satisfy the Calder effects test. Hasson is informative. There, the plaintiff’s claim against the pizza chain restaurant Papa Johns lacked personal jurisdiction through the Calder effects test. Id. Papa Johns’ website was accessible across the nation, but it did not expressly aim its allegedly tortious conduct — deploying a data tracking software called “Session Replay Code” — at Pennsylvania. Id. at 187- 88, 190 (“[The plaintiff] did not allege that Papa Johns’ website is accessible only in

Pennsylvania, that the company deploys Session Replay Code only to users who access the site while in Pennsylvania, or that the website tailors its content in any meaningful way to Pennsylvanians.”). Like the plaintiff in Hasson alleging that Pennsylvanians browse and purchase products on Papa Johns’ website, Mr. Delong alleges Pennsylvanians browse and purchase products on PHE's website. See DI 1 ¶¶ 12-14. And like Papa Johns’ website, PHE’s website is available to users across the country, but nothing in our record suggests that PHE’s website is expressly aimed at Pennsylvania. Traditional test. Mr. Delong’s allegations are also insufficient under the traditional test because PHE’s minimum contacts with Pennsylvania, the sales it conducts through its website,

19 do not sufficiently relate or give rise to the alleged online wiretapping injuries. PHE meets the first prong of the traditional test because its website regularly sells products to Pennsylvanians. Id.; see Toys “R” Us, Inc., 318 F.3d at 452 (“If a defendant web site operator . . . knowingly conducts business with forum state residents via the site, then the ‘purposeful availment’ requirement is satisfied.”). However, PHE does not satisfy the second part of the traditional test because these business contacts do not relate to or give rise to Mr. Delong’s wiretapping claim. The second component of the traditional test requires that the claim “arise out of or relate to” the defendants’ minimum contacts. Helicopteros Nat’l de Colom., S.A., 466 U.S. at 414. These contacts should evidence “a strong relationship among the defendant, the forum, and the litigation.” Hepp, 14 F.4th at 208 (citing Ford, 592 U.S. at 365); see also Burger King, 471 U.S. at 472; O’Connor v. Sandy Lane Hotel Co., 496 F.3d 312, 323 (3d Cir. 2007).

Hasson again provides useful guidance. The Third Circuit considered personal jurisdiction over Papa Johns through the traditional test, and the Court found the plaintiff’s complaint did not show “a specific connection between Pennsylvania, Papa Johns, and the deployment of Session Replay Code” on Papa Johns’ website. 114 F.4th at 193 (citing Hepp, 14 F.4th at 208 (citing Ford, 592 U.S. at 365)). The Third Circuit explained that litigation stemming from website use could have related to the plaintiff’s claims if Papa Johns’ minimum contacts in Pennsylvania had been the promotion of its website rather than the pizza itself, such that the website was the product or service through which Papa Johns’ purposefully availed itself to Pennsylvania’s market. See Id. at 193-94 (contrasting claims with those in Ford, where

20 personal jurisdiction over Ford was proper in a forum where it sold and advertised vehicles when the claims alleged harm caused by its defective cars). Similarly, here, Mr. Delong’s alleged injury is unrelated to the sale of products in Pennsylvania and relates only to allegedly intrusive and tortious behavior that occurs when one is browsing the website, regardless of purchase. DI 1 ¶¶ 14, 18-19, 22. Thus, PHE’s incidental product sales in the Pennsylvania market do not foreseeably give rise to the alleged wiretapping injuries that occur on its nationally accessible website. The holding in Hepp provides further support. See 14 F.4th at 208. There, a news reporter claimed that Reddit and Imgur, an online forum and an image hosting website respectively, misappropriated her likeness by airing advertisements depicting her image without her consent. Id. at 206-07. The Third Circuit found that the misappropriation claims against Reddit and Imgur did not sufficiently relate to the defendants’ online stores and premium

memberships, which were the contacts through which these defendants purposefully availed themselves to Pennsylvania. Id. at 208. Despite advertising and maintaining online stores that sold merchandise to Pennsylvanians, these contacts did not form “a strong connection to the misappropriation of Hepp’s likeness.” Id. The same sort of mismatch between the purposeful availment and the cause of action is present here. Although Pennsylvania customers use PHE’s website to purchase its products and have them sent to Pennsylvania, the alleged wiretapping and data capture by Google Analytics happens exclusively on the website and occurs regardless of whether the customer completes a sale. Thus, the contacts from the product sales lack the “strong relationship among the defendant, the forum, and the litigation” required for specific

21 personal jurisdiction. Id. And in turn, we conclude that Mr. Delong has not established any route to personal jurisdiction over PHE. III. Conclusion For the reasons explained above, we dismiss the complaint without prejudice because Mr. Delong does not plead facts to establish Article III standing or, alternatively, because he does not plead facts to demonstrate that we have personal jurisdiction over PHE. An appropriate order follows this memorandum.