EMMETT v. DELTA AIR LINES, INC.

• Court: District Court, W.D. Pennsylvania
• Decided: June 3, 2024
• Docket: 2:22-cv-01568
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF PENNSYLVANIA

RYAN EMMETT, ) ) No. 2:22-1568 Plaintiff, ) ) v. ) Judge Robert J. Colville ) DELTA AIR LINES, INC., ) ) Defendants. ) ) )

MEMORANDUM OPINION Robert J. Colville, United States District Judge Before the Court is a Motion to Dismiss (ECF No. 34) filed by Defendant in this matter. Defendant moves to dismiss all counts in Plaintiff’s First Amended Complaint (ECF No. 29), arguing that Plaintiff has failed to state a claim upon which relief can be granted, that the Court lacks personal jurisdiction over Defendant, and that Plaintiff’s claims are barred by Federal law. The Court has subject matter jurisdiction to rule on this matter pursuant to 28 U.S.C. § 1332(a). The Motion has been fully briefed and is ripe for disposition. I. Factual Background & Procedural History In the Complaint, Plaintiff sets forth the following factual allegations relevant to the Court’s consideration of the Motions at issue: Defendant’s website, www.delta.com, employs session replay software (the “Session Replay Code”), which “enables website operators to record, save, and replay website visitors’ interactions with [the] website[, providing] online marketers and website designers with insights into the user experience by recording website visitors ‘as they click, scroll, type or navigate across different web pages.’” ECF No. 29 ¶ 23 (quoting Erin Gilliam Haije, Are Session Recording Tools a Risk to Internet Privacy?, Mopinion (Mar. 7, 2018)). The software “works by inserting computer code into the various event handling routines that web browsers use to receive input from users.” Id. ¶ 25. It can monitor “all mouse movements, clicks, scrolls, zooms, window resizes, keystrokes, text entry, and numerous other forms of a user’s navigation and interaction through the website.”

26. After this information is recorded, “a website operator can view a visual reenactment of the user’s visit through the Session Replay Provider, usually in the form of a video.” Id. ¶ 28. “[The Session Replay Code] collects highly personal information and substantive communications that can be linked directly to a website user’s identity as it monitors, records, and collects a website user’s every move [which] can then be used to play back a user’s journey through a website, showing how they interacted with site navigation, calls to action, search features, and other on-page elements.” Id. ¶ 48. It also collects “IP address information, [which] enables websites such as Delta to search recorded website user sessions by specific locations that is ‘fairly accurate’ at the country and state level.” Id. ¶ 49. Notably, “[t]he Session Replay Code procured

by [Defendant] is not a website cookie, analytics tool, tag, web beacon, or other similar technology. Instead, the data collected by the Session Replay Code identified specific information inputted and content viewed, and thus revealed personalized and sensitive information about website visitors’ Internet activity and habits.” Id. ¶ 70. Plaintiff visited Defendant’s website, and some of his actions and communications on the site were recorded by the Session Replay Code. Id. ¶ 54–63. Plaintiff did not provide prior consent. Id. ¶ 72. And Delta did not ask for it. Id. ¶ 73. Plaintiff brings claims for violations of the Pennsylvania Wiretap Act, under 18 Pa. Cons. Stat. § 5701, (the “PWA”), and common law Invasion of Privacy – Intrusion Upon Seclusion, individually and on behalf of the following Class: All natural persons in Pennsylvania whose Website Communications were captured in Pennsylvania through the Session Replay Code embedded in www.delta.com. Id. ¶¶ 76, 105–118. On March 7, 2023, Plaintiff filed an Amended Complaint. On April 7, 2023, Defendant filed a Motion to Dismiss, along with a Brief in Support (ECF No. 35).

II. Legal Standard Defendant has moved to dismiss for lack of personal jurisdiction under Federal Rule of Civil Procedure 12(b)(2) and for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6). A. Personal Jurisdiction A motion to dismiss under Federal Rule of Civil Procedure 12(b)(2) tests the Court’s power over the defendant. There are two kinds of personal jurisdiction: specific and general. A court that has general jurisdiction over a party has jurisdiction to hear all claims against that party, irrespective of the relationship between those claims and the forum State. Burger King Corp. v.

Rudzewicz, 471 U.S. 462, 473 n.15 (1985). General jurisdiction is proper over corporations “when their affiliations with the State are so ‘continuous and systematic’ as to render them essentially at home in the forum State.” Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 923– 24 (2011) (quoting Int’l Shoe Co. v. Washington, 326 U.S. 310, 317 (1945)). A corporation is typically “at home” where it is incorporated and where it has its principal place of business. See Daimler AG v. Bauman, 571 U.S. 117, 137 (2014) (“With respect to a corporation, the place of incorporation and principal place of business are ‘paradig[m] . . . bases for general jurisdiction.’” (quoting Lea Brilmayer, Jennifer Haverkamp, & Buck Logan, A General Look at General Jurisdiction, 66 TEX. L. REV. 721, 735 (1988)). Specific jurisdiction, on the other hand, exists where a claim relates to the defendant’s contacts with the forum. See Goodyear, 564 U.S. at 923–24 (“Adjudicatory authority is ‘specific’ when the suit ‘aris[es] out of or relate[s] to the defendant’s contacts with the forum.’” (quoting Helicopteros Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 414 n.8 (1984))). Under the Federal Rules of Civil Procedure, district courts are authorized to exercise specific personal

jurisdiction over non-residents to the extent permissible under the law of the state in which the district court is located. Fed. R. Civ. P. 4(e); N. Penn Gas Co. v. Corning Nat. Gas Corp., 897 F.2d 687, 689 (3d Cir. 1990). In exercising personal jurisdiction, the court must first ascertain whether jurisdiction exists under the forum state’s long-arm jurisdiction statute and then determine whether the exercise of jurisdiction comports with the Due Process Clause of the Fourteenth Amendment to the Constitution. Van Buskirk v. Carey Canadian Mines, Ltd., 760 F.2d 481, 489– 90 (3d Cir.1985). In Pennsylvania, the inquiry into whether the state long-arm statutes satisfy the United States Constitution is straightforward. The statute provides that “the jurisdiction of the tribunals

of this Commonwealth shall extend to all persons . . . to the fullest extent allowed under the Constitution of the United States and may be based on the most minimum contact with this Commonwealth allowed under the Constitution of the United States.” 42 Pa. Const. Stat. § 5322(b); Van Buskirk, 760 F.2d at 490. The reach of the Pennsylvania long-arm statute is thus “coextensive” with the Due Process Clause. North Penn Gas, 897 F.2d at 690. The Due Process Clause permits the court to assert personal jurisdictional over a nonresident defendant who has “certain minimum contacts with [the forum] such that the maintenance of [a] suit does not offend traditional notions of fair play and substantial justice.” Int’l Shoe Co., 326 U.S. at 316 (quotations omitted). To establish “minimum contact” in intentional torts cases, the United States Supreme Court has developed a three-pronged “effects” test. Calder v. Jones, 465 U.S. 783 (1984). Under the Calder test, the following elements must be satisfied: (1) the defendant committed an “intentional tort,” (2) the plaintiff “felt the brunt of the harm” in the forum, such that the forum can be said to be the focal point of the harm suffered, and (3) the defendant “expressly aimed” the allegedly

tortious conduct at the forum. See IMO Indus., Inc. v. Kiekert AG, 155 F.3d 254, 265–66 (3d Cir. 1998); Remick v. Manfredy, 238 F.3d 248, 260 (3d Cir. 2001). The plaintiff bears the burden of establishing that these standards are met to show that personal jurisdiction exists over the defendant. Where the parties have not conducted discovery, the plaintiff need only make a prima facie showing that jurisdiction is proper, and the pleadings and affidavits are to be construed in the light most favorable to the plaintiff. See Autogenomics, Inc. v. Oxford Gene Tech. Ltd., 566 F.3d 1012, 1017 (Fed. Cir. 2009) (quoting Avocent Huntsville Corp. v. Aten Int’l Co., 552 F.3d 1324, 1328 (Fed. Cir. 2008). B. Failure to State a Claim

A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests the legal sufficiency of the complaint. Kost v. Kozakiewicz, 1 F.3d 176, 183 (3d Cir. 1993). In deciding a motion to dismiss, the court is not opining on whether the plaintiff will likely prevail on the merits, but simply accepts as true all well-pled factual allegations in the complaint and views them in a light most favorable to the plaintiff. U.S. Express Lines Ltd. v. Higgins, 281 F.3d 383, 388 (3d Cir. 2002). While a complaint does not need detailed factual allegations to survive a Rule 12(b)(6) motion to dismiss, a complaint must provide more than labels and conclusions. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). A “formulaic recitation of the elements of a cause of action will not do.” Id. (citing Papasan v. Allain, 478 U.S. 265, 286 (1986)). “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 554). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678 (citing Twombly, 550 U.S.

at 556). The Supreme Court of the United States has explained: The plausibility standard is not akin to a “probability requirement,” but it asks for more than a sheer possibility that a defendant has acted unlawfully. Where a complaint pleads facts that are “merely consistent with” a defendant’s liability, it “stops short of the line between possibility and plausibility of ‘entitlement to relief.’”

Id. (quoting Twombly, 550 U.S. at 556) (internal citations omitted). The United States Court of Appeals for the Third Circuit instructs that “a court reviewing the sufficiency of a complaint must take three steps.” Connelly v. Lane Constr. Corp., 809 F.3d 780, 787 (3d Cir. 2016). The court explained: First, it must “tak[e] note of the elements [the] plaintiff must plead to state a claim.” Iqbal, 556 U.S. at 675. Second, it should identify allegations that, “because they are no more than conclusions, are not entitled to the assumption of truth.” Id. at 679; see also Burtch v. Milberg Factors, Inc., 662 F.3d 212, 224 (3d Cir. 2011) (“Mere restatements of the elements of a claim are not entitled to the assumption of truth.” (citation and editorial marks omitted)). Finally, “[w]hen there are well- pleaded factual allegations, [the] court should assume their veracity and then determine whether they plausibly give rise to an entitlement to relief.” Iqbal, 556 U.S. at 679.

Connelly, 809 F.3d at 787. “Determining whether a complaint states a plausible claim for relief will . . . be a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Iqbal, 556 U.S. at 679 (internal citations omitted). In addition to reviewing the facts contained in the complaint, a court may consider “matters of public record, orders, exhibits attached to the complaint and items appearing in the record of the case.” Oshiver v. Levin, Fishbein, Sedran & Berman, 38 F.3d 1380, 1384 n.2 (3d Cir. 1994). When a document integral to or relied upon in the complaint is included, the court may also consider that document. In re Burlington Coat Factory Sec. Litig., 114 F.3d 1410, 1426 (3d Cir. 1997). Although a district court is not obligated to permit leave to amend before dismissing a

complaint in a non-civil rights case, Wolfington v. Reconstructive Orthopaedic Assocs. II P.C., 935 F.3d 187, 210 (3d Cir. 2019), courts generally grant leave to amend unless amendment of the complaint would be inequitable or futile. See, e.g., Bachtell v. Gen. Mills, Inc., 422 F. Supp. 3d 900, 915 (M.D. Pa. Oct. 1, 2019) (citing Phillips v. Allegheny Cty., 515 F.3d 224, 245 (3d Cir. 2008)). III. Discussion A. Personal Jurisdiction As to personal jurisdiction, Plaintiff argues that jurisdiction is proper because the allegations in the Complaint meet the Calder effects test: (1) by violating the Pennsylvania Wiretap

Act and common law invasion of privacy rules, Defendant has committed an intentional tort, (2) Plaintiff visited the Delta website and had his interactions recorded within Pennsylvania, and therefore felt the brunt of the harm in this forum, and (3) Defendant expressly aimed its tortious conduct at Pennsylvania, by servicing two major airports in the state, which essentially guaranteed that residents of the state would visit the website and have their actions recorded. Defendant does not contest that the first two factors of the Calder test are met, and instead focuses its challenge on the “expressly aiming” prong. Defendant argues that courts repeatedly find a lack of express aiming in cases involving nationally accessible websites. Citing Toys “R” Us, Inc. v. Step Two, S.A., 318 F.3d 446 (3d Cir. 2003), Defendant posits that the mere fact that a website was accessible in the forum state does not establish that the defendant expressly aimed to commit the alleged tort in the forum. Similarly, in M.H. ex rel. C.H. v. Omegle.com LLC, 2021 WL 1050234 (D.N.J. Mar. 19, 2021), the court granted the defendant’s motion to dismiss for lack of personal jurisdiction because “the mere operation of a commercially interactive web site” does not establish that the website was purposefully directed at the forum, just because the website is accessible therefrom. Id. at *3 (citing Toys “R” Us, 318 F.3d at 454). In Massie v. Gen. Motors Co., 2021 WL

2142728 (E.D. Cal. May 26, 2021), the United States District Court for the Eastern District of California ruled on a case involving replay software similar to the program at the center of this matter. The court found that although there was access to the General Motors Company’s website from California, that alone did not satisfy the express aiming prong of the Calder test. Defendant further argues that the record does not support a finding that Delta knew that Plaintiff would suffer the brunt of the harm in Pennsylvania. To establish the expressly aiming element, the plaintiff must show that the defendant knew that the plaintiff would suffer the brunt of the harm in the forum state. IMO Indus., 155 F.3d at 266. The way Defendant frames it, Defendant did not know that Plaintiff resided in Pennsylvania, and so it could not know Plaintiff was likely to be harmed in Pennsylvania. ECF No. 35 at 8. Defendant concludes its expressed aiming argument by claiming that the company’s general knowledge that its website collected data from visitors in Pennsylvania would not establish jurisdiction because “the foreseeability of harm being suffered in a forum is insufficient to establish personal jurisdiction under Calder.” LaSala v. Marfin Popular Bank Pub. Co., 410 F. App’x 474, 477 (3d Cir. 2011) (citing Marten v. Godwin, 499 F.3d 290, 297 (3d Cir. 2007)).

The Court analyzes this issue differently. In Toys “R” Us, the court was ruling during the infancy of the world wide web, and the commercial nature of business websites was simply not as robust. In 2003, it was yet unclear that the internet would become the primary marketplace for businesses. Applying the standard described by Defendant would essentially foreclose most people injured by e-commerce websites from seeking redress in the forum in which they were harmed. Further, the Court questions Defendant’s interpretation of Toys “R” Us. The Third Circuit Court established a distinction between a company that incidentally makes its website available in a particular state (because it is available nationwide) and a company that “directly

target[s] its web site to the state, knowingly interact[s] with residents of the forum state via its web site, or through sufficient other related contacts.” 318 F.3d at 454. By the Court’s reading of the record, Defendant’s website is more analogous to the latter. Defendant services customers in Pennsylvania primarily through airports, but has an additional interest in having residents in Pennsylvania visit the website to facilitate ease of commerce. A similar analysis applied in the Omegle case, where the matter hinged on the fact that the website had nothing special to offer residents of the forum (in that case, New Jersey). Omegle.com, 2021 WL 1050234. The decision was not simply that websites never establish express aiming. It was instead that the particular website was so bare bones and non-commercially relevant to New Jersey that it did not establish aiming. The website’s interface and all its services remained the same for

all users worldwide. Id. at *5. The defendant company did not provide a service or product that was particular to or connected with New Jersey. Id. In fact, the defendant company had no way of determining whether a user was even located in New Jersey. Id. at *3. This is not the case for Defendant’s website, which provides Delta with particular benefit when residents of Pennsylvania visit. Despite the similarities to the facts alleged in this case, Massie, by the Court’s reading, is also not analogous for personal jurisdiction purposes. In fact, the court in Massie specifically outlined the range or “scale” of a website’s forum contact that courts may encounter when analyzing the question of personal jurisdiction: At one end of the scale [are] active sites ‘where a defendant clearly does business over the Internet’ and ‘enters into contracts with residents of a foreign jurisdiction that involve the knowing and repeated transmission of computer files over the Internet,’ which support[s] jurisdiction. . . . At the other end [are] passive sites ‘where a defendant has simply posted information on an Internet Web site which is accessible to users in foreign jurisdictions,’ and which do[es] not support jurisdiction.

Massie, 2021 WL 2142728, at *4 (quoting Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1226 (9th Cir. 2011)). There the court ruled that the defendant’s website fell squarely in the passive category. Id. When analyzing the “level of interactivity and commercial nature of the exchange[s on the website,]” the court found that it did not expressly aim to attract users within the forum (in that case, California). Id. Instead, the website was designed to maximize overall traffic, not to specifically target California residents. There was no particular benefit to the defendant if Californians reached the website versus residents of any other state. Id. That is not the case here. Defendant has a particular interest in attracting Pennsylvania residents to its website, because of the two major Delta hubs in the state, one in Philadelphia and one in Pittsburgh. ECF No. 29 ¶ 9. The website is not merely informational nationally and incidentally available in Pennsylvania. Interactions with Pennsylvanians have specific benefits to Defendant, and increased engagement by Pennsylvanians is likely to translate into direct and specific Pennsylvania- based commercial benefits for the company. People visiting Delta.com within Pennsylvania are very likely seeking a service that Defendant will provide, at least in part, within Pennsylvania. The Court notes that flight tickets are purchased, if not predominantly then at least frequently enough, online. This would mean that if two airports service passengers either leaving from or heading to Pennsylvania, then Defendant specifically benefits from Pennsylvania residents visiting the website, and Defendant, therefore, “appeals to, and profits from, an audience in [this] particular state.” Massie, 2021 WL 2142728, at *5. The Court is also unpersuaded by Defendant’s claim that “the Amended Complaint fails to allege facts demonstrating that Delta ‘knew’ Plaintiff ‘would suffer the brunt of the harm’ in Pennsylvania [or that] Delta was aware that Plaintiff resided in Pennsylvania.” ECF No. 35 at 8 (quoting IMO Indus., 155 F.3d at 266). If the Court understands the argument, the implication seems to be that Defendant would have to know that Plaintiff, in particular, would suffer the brunt of the harm in Pennsylvania. The Court does not read the law in the same narrow fashion. The IMO

Industries case that Defendant cites involved a business relationship that centered itself squarely outside the forum (in that case, New Jersey). IMO Indus., 155 F.3d at 256. The Third Circuit Court found that the few incidents that took place between the parties when the plaintiff happened to be in New Jersey was not enough to establish that the defendant had expressly aimed its conduct at that forum. The court further concluded that because the plaintiff was not a New Jersey entity with its principal place of business in New Jersey, it would not feel the brunt of the harm in New Jersey simply because there was some momentary presence in the state. Id. at 253. None of this adequately analogizes to the facts in the present case. Here we have a relationship that orbits Pennsylvania. Defendant seeks a steady stream of passengers flying in and

out of two major airports in Pennsylvania. As a result, its website is an essential resource to its business within Pennsylvania. The parties came in to contact as a normal part of that business via the website. Plaintiff is a Pennsylvania resident, and Defendant services Pennsylvanian passengers. Defendant’s assertion that the “alleged harm would have occurred regardless of the location Plaintiff visited the . . . website” assumes that Plaintiff would have even been inclined to visit Delta.com if he did not reside in a state with two large airports serviced by Delta. ECF No. 35 at 8 (quoting Sacco v. Mouseflow, Inc., 2022 WL 4663361, at *5 n.2 (E.D. Cal. Sept. 30, 2022)). The point relevant here is that there is a particular reason why Pennsylvania residents visit the website (a reason designed by Defendant), and if the harm alleged occurs to a Pennsylvania resident as a result, then that harm occurs as a result of Defendant’s efforts specifically aimed at Pennsylvania. The fact that Defendant may have similar operations targeting residents of other forums and may perpetrate the same alleged harm against all of them does not require all potential defendants in Pennsylvania to sue Delta only in Delta’s preferred forum. Turning to Defendant’s final “expressed aiming” argument about the foreseeability of

harm, the contention is put as follows: “[A]ny allegation that Delta ‘knew’ that data of Pennsylvania residents generally would be collected . . . is insufficient to establish specific jurisdiction because ‘the foreseeability of harm being suffered in a forum is insufficient to establish personal jurisdiction under Calder.’”

ECF No. 35 at 8 (quoting LaSala, 410 F. App’x at 477). The Court is not convinced that Defendant properly stated the legal standard. In the LaSala case quoted by Defendant, additional context is illuminating. “[T]he foreseeability of harm being suffered in a forum is insufficient to establish personal jurisdiction under Calder. In the absence of ‘specific facts showing a deliberate targeting of [the forum],’ the District Court properly refused to premise personal jurisdiction upon the effects test.” LaSala, 410 F. App’x at 477 (quoting Marten, 499 F.3d at 298). In other words, foreseeability alone may not establish expressed aiming, but it does not foreclose it either. Facts showing deliberate targeting of the forum do satisfy the expressed aiming prong of the Calder test. As discussed above, the facts in the Complaint, if true, would show that Defendant deliberately targets this forum. Delta.com is not merely an informational website available nationwide so that Americans can engage with the brand or receive a service accessed directly through an online application or portal. That sort of website may establish the mere foreseeability of harm in Pennsylvania. Instead, Defendant’s website provides a platform by which Defendant sells the service of transporting travelers to and from various airports. The potential customers who live near those airports are not just foreseeable customers, but targeted ones. Thus, the Court finds that deliberate targeting is satisfied. Accordingly, the Court finds that Defendant is subject to personal jurisdiction in Pennsylvania. B. Failure to State a Claim

a. Count I – Pennsylvania Wiretap Act 18 Pa. Cons. Stat. § 5701 The PWA criminalizes various actions related to intentionally intercepting or trying to intercept any wire, electronic, or oral communication. 18 Pa. Const. Stat. § 5703. More specifically, it “prohibits the interception of an electronic communication without prior consent.” Cook v. GameStop, Inc., 2023 WL 5529772, at *6 (W.D. Pa. Aug. 28, 2023) (emphasis added) (quoting 18 Pa. Const. Stat. § 5725(a)). To establish a PWA violation, a plaintiff must show: (1) that [the claimant] engaged in a communication; (2) that he possessed an expectation that the communication would not be intercepted; (3) that his expectation was justifiable under the circumstances; and (4) that the defendant attempted to, or successfully intercepted the communication, or encouraged another to do so.

Kelly v. Carlisle, 622 F.3d 248, 257 (3d Cir. 2010) (quoting Agnew v. Dupler, 553 Pa. 33, 717 A.2d 519, 522 (Pa. 1998)). Courts tend to dispense with defining “communication” in any particular fashion, seeming to accept the common parlance, and finding that verbal, signed, or written congress is communication for PWA purposes. See, e.g., Mulder v. Wells Fargo Bank, N.A., 2018 WL 3750627 (W.D. Pa. July 10, 2018); Oliver v. Noom, Inc., 2023 WL 8600576, at *7 (W.D. Pa. Aug. 22, 2023); In re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125 (3d Cir. 2015). Defendant argues that the information gathered by the Session Replay Code is not a “communication” because it does not qualify as “contents of communication” under the definition of “content” in the PWA, which creates a cause of action for, among other things, “intentionally disclos[ing] or endeavor[ing] to disclose to any other person the contents of any wire, electronic or oral communication, or evidence derived therefrom, [while] knowing or having reason to know that the information was obtained through the interception of a wire, electronic or oral communication.” 18 Pa. Const. Stat. § 5703(2) (emphasis added). “The term ‘contents’ does not

include ‘record information.’” ECF No. 35 at 21 (quoting In re Zynga Priv. Litig., 750 F.3d 1098, 1106 (9th Cir. 2014)). Examples of information intercepted that would not be considered contents are “‘addresses, phone numbers, and URLs’ when performing a ‘dialing, routing, addressing, or signaling’ function.” Id. (quoting Google Inc. Cookie Placement, 806 F.3d at 137). This argument fails for various reasons. First, in a highly analogous case, Judge Stickman stated, “Plaintiffs allege that [the] Session Replay Code records all website visitor actions[,] which necessarily includes all of the information input. . . . At this stage, these allegations are sufficient to establish that [the defendant] intercepted contents of [the p]laintiff[’s] communications.” Oliver, 2023 WL 8600576, at *7 (internal quotation marks omitted, emphasis added) (citing

Google Inc. Cookie Placement, 806 F.3d at 139 (“Because the complaint pleads a broad scheme in which the defendants generally acquired and tracked the plaintiffs’ internet usage, we are satisfied that this scheme, if it operated as alleged, involved the collection of at least some ‘content’ within the meaning of the Wiretap Act.”)). Second, there is a viable cause of action under the PWA that does not require the interception of the “contents” of a communication. Plaintiff brings this action under 18 Pa. Const. Stat. §§ 5703(1)–(3). 18 Pa. Const. Stat. § 5703(1) creates a cause of action against one who “intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept any wire, electronic or oral communication.” No mention of content here, and this alone would provide Plaintiff with a viable cause of action under the PWA. Defendant claims that Plaintiff did not have an “expectation that the communication would not be intercepted,” because Plaintiff consented to such interception. “[A]n interception does not occur where a party elects to [communicate] with or send messages to a recipient.” Id. (citing

Com. v. Cruttenden, 619 Pa. 123, 58 A.3d 95, 100 (2012)). The Court derives the inverse, as well, that when a party does not elect to communicate or send a message, the acquisition of said communication through indirect means is an interception. Here, the Complaint alleges that Defendant’s website provides no method for visitors to consent to having their mouse movements and keystrokes recorded. Defendant contends that Plaintiff did in fact consent, because the website includes a pop-up banner requesting visitors’ consent to record cookies. ECF No. 35 at 24. The Court does not accept that this would qualify as notice or consent, as the Session Replay Code does not record cookies. Additionally, Plaintiff alleges that no such banner was available on Defendant’s website at the time that he visited, which presents a material dispute of substantive

fact between the parties. ECF No. 29 ¶ 102. Further, the Court found no source in this District or under this Circuit to suggest that visitors to websites should justifiably expect to have all their actions recorded. On the contrary, courts have found that software like the Session Replay Code are not an expected component of internet activity. See, e.g., Oliver, 2023 WL 8600576. The Court finds that Plaintiff had a justifiable expectation that his keystroke and mouse movement activity on Defendant’s website was not being recorded. An “interception” is an “[a]ural or other acquisition of the contents of any wire, electronic or oral communication through the use of any electronic, mechanical or other device.” 18 Pa. Const. Stat. § 5702. Such an interception happens “when the contents of a communication are ‘captured or redirected in any way.’” Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (3d Cir. 2022) (quoting United States v. Rodriguez, 968 F.2d 130, 136 (2d Cir. 1992)). Defendant posits that there was no interception because the Session Replay Code is not an intercepting “device” under the meaning of the PWA. ECF. No. 35 at 17–18. “The [PWA] defines ‘device,’ . . . as ‘[a]ny device or apparatus . . . that can be used to intercept a wire, electronic or

oral communication.’” Id. at 18 (quoting 18 Pa. Const. Stat. § 5702). The Session Replay Code, however, is an intangible computer code embedded in the website’s software. Id. Quoting a case from the District of Maryland, Defendant argues that “the ‘most natural reading’ of the terms ‘device’ and ‘apparatus’ ‘calls to mind’ something physical like ‘a piece of equipment,’ not software code.” Mason v. Mach. Zone, Inc., 140 F. Supp. 3d 457, 462–63 (D. Md. 2015).” The Court does not accept this argument on multiple levels. First, the Court is not bound by the opinion Defendant cites.1 Courts in this District have found that software similar to the Session Replay Code do fall within the definition of “device.” See, e.g., Oliver, 2023 WL 8600576, at *6. Second, as a practical matter, software does not operate independently of

hardware. Not only is Plaintiff’s computer or mobile phone, which facilitated the connection to Defendant’s website, a “device,” but the Session Replay Code itself operates on a remote computer or server controlled by Defendant. It is hard to imagine that software installed on a user’s phone that intercepts phone conversations would not fall under the category of “device” for PWA purposes, and the Court fails to see why it should be any different for internet communications.

1 It is worth noting that the Court does not read the case from the District of Maryland as a proper analogue to the matter here. That case involved a California statute banning the manufacture of slot machine devices. The court there found that because the defendant created a computer game that the plaintiff knowingly downloaded onto her hardware (effectively providing half the machine), it would not be sensible to claim that the defendant manufactured an outlawed “device.” Here, Plaintiff did something similar to the plaintiff in that case, by interacting with Defendant’s website. He used his own hardware device to visit the site and navigate to the various pages. However, that is not the “device” under scrutiny here. The second “secret” device, operating from a remote location, is not something Plaintiff chose to download to his device, thereby providing the hardware half of the machine. Indeed, Defendant used its own device that could remotely access keystrokes and mouse movements. Accordingly, the Court finds that the Session Replay Code, or Defendant’s remote hardware that operates the Session Replay Code, is a device that intercepts under the meaning of the PWA. For the reasons discussed, as to the PWA claim, the Court denies Defendant’s motion to dismiss. b. Count II – Common Law Invasion of Privacy – Intrusion Upon Seclusion

Under the Restatement of Torts, Intrusion Upon Seclusion requires the plaintiff to show “(i) an intentional intrusion (ii) upon the seclusion of another that is (iii) highly offensive to a reasonable person.” In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 293 (3d Cir. 2016) (citing RESTATEMENT (SECOND) OF TORTS § 652B (Am. L. Inst. 1972)); see also Boring v. Google Inc., 362 F. App’x 273, 278–79 (3d Cir. 2010) (“To state a claim for intrusion upon seclusion, plaintiffs must allege conduct demonstrating ‘an intentional intrusion upon the seclusion of [her] private concerns which was substantial and highly offensive to a reasonable person, and aver sufficient facts to establish that the information disclosed would have caused mental suffering, shame or humiliation to a person of ordinary sensibilities.’” (quoting Pro Golf Mfg., Inc. v. Trib.

Rev. Newspaper Co., 570 Pa. 242, 809 A.2d 243, 247 (2002))). An intrusion may be physical, but it can also involve some form of eavesdropping or attempt to investigate or examine someone’s private affairs. RESTATEMENT (SECOND) OF TORTS § 652B. An intentional intrusion is established by showing that the defendant lacked “the necessary legal or personal permission to commit the intrusive act.” O’Donnell v. United States, 891 F.2d 1079, 1083 (3d Cir. 1989). In the context of internet activity monitoring, if “the plaintiffs [n]ever authorized [the defendant] to collect or disclose their personal information,” this establishes that the defendant had substantial certainty that it lacked permission to intrude. Nickelodeon, 827 F.3d at 293. “Courts ‘have appropriately treated the presence or absence of consent as a key factor in’ determining whether an alleged intrusion occurred without ‘legal or personal permission.’” Oliver, 2023 WL 8600576, at *9 (quoting Nickelodeon, 827 F.3d at 293). Here, Plaintiff alleged that Defendant never received consent to intrude upon his internet behavior. ECF No. 29 ¶ 102. Thus, the Court finds that Plaintiff properly alleges that Defendant’s use of Session Replay Code software is an “intentional intrusion” for the common-law claims purposes.

Establishing that the intrusion was “upon the seclusion of another” requires a showing that the defendant intruded upon a space where the plaintiff had an expectation of privacy. Notably, “a person ‘has no legitimate expectation of privacy in information he voluntarily turns over to third parties.’” United States v. Bowers, 2021 WL 2882438, at *3 (W.D. Pa. July 8, 2021) (quoting Smith v. Maryland, 442 U.S. 735, 743–44 (1979)). The inverse is true, as well; what is turned over involuntarily maintains its expectation of privacy. See, e.g., Oliver, 2023 WL 8600576, at *9 (dismissing claims only as related to information voluntarily provided). The Third Circuit Court has noted that sophisticated internet users likely know that their browsing activity may be monitored when visiting a website. Google Inc. Cookie Placement, 806 F.3d at 151. However,

this was intrinsically linked to consent; allowing cookies is clear consent to collect them, and refusing cookies is clear indication that cookies are presumed private and collecting them is non- consensual. Id. Here, Plaintiff alleges that the Session Replay Code on Defendant’s website is enabled before visitors have a chance to consent to any monitoring. ECF No. 29 ¶ 74. Further, the only consent Defendant requests is to collect cookies, not to fully monitor every aspect of visitor activity. Id. Notifying website visitors in a terms page of the fact that Defendant collects all activity is not sufficient prior notice, because the Session Replay Code is deployed as soon as users visit the website, before they have had a chance to read any terms of service or user agreements. Courts have likened the degree of privacy reasonably expected online to that in a brick- and-mortar store. See, e.g., Farst v. AutoZone, Inc., 2023 WL 7179807 (M.D. Pa. Nov. 1, 2023) (“Shopping on a public website, like shopping in a public store, is not an activity one can reasonably expect to keep private from the retailer.”); Cook, 2023 WL 5529772, at *5 (“[Session replay] information is no different from what [the defendant’s] employees would have been able

to observe if [the plaintiff] had gone into a brick-and-mortar store and began browsing the inventory.”). This is certainly true in terms of shopping activity, where it would essentially be unimaginable to withhold from an online retailer that you made a purchase on its website or even added an item to your online shopping cart. Some courts have gone even further, finding that the comparison to physical stores holds for browsing and even mouse hovering, which are similar to physical browsing activities customers routinely do in stores. See, e.g., Id. (“[The plaintiff’s] physical movements in the store are like her mouse movements, her pauses to look at inventory are like her mouse pointer hovering over products, and her picking up [products] off the shelf are like placing those same [items] in her virtual cart.”)

But here Plaintiff alleges that Defendant used software to sidestep seclusion that exists in a traditional store. Stores do not read and keep information from, say, credit cards that customers may have in their possession but do not ultimately choose to use as payment. Plaintiff points out that this reveals inherent vulnerabilities in the use of Session Replay Code, noting that credit card details and other sensitive information not intentionally disclosed, or even actively withheld after typing errors, are recorded and stored for Defendant to access. ECF No. 29 ¶ 29. This would likely be seen as an intrusion in the brick-and-mortar setting. As the Court sees it, generally, online activity is not secluded, but the Court is obliged to recognize limits to that rule. Finally, we turn to the question of whether the nature of this intrusion would be “highly offensive to a reasonable person.” Nickelodeon, 827 F.3d at 293. For an intrusion to be highly offensive, a plaintiff must “establish that the information disclosed would have caused mental suffering, shame or humiliation to a person of ordinary sensibilities.” Google Inc., 362 F. App’x at 279 (quoting Pro Golf Mfg., Inc., 570 Pa. at 247 (2002)) (internal quotation marks omitted).

Several courts in this District have found that recording keystrokes and mouse movements alone are simply not enough to reasonably induce mental suffering, shame, and humiliation in ordinary people. See, e.g., Oliver, 2023 WL 8600576, at *10 (“While having one’s keystrokes and mouse movements recorded may be an invasion of a website user’s privacy, it is simply not the type of highly offensive act to which liability can attach.” (internal quotation marks omitted)); Popa v. Harriet Carter Gifts, Inc., 426 F. Supp. 3d 108, 122 (W.D. Pa. 2019) (“The act of collecting [the plaintiff’s] keystrokes, mouse clicks, and PII is simply not the type of highly offensive act to which liability can attach.”); Cook, 2023 WL 5529772, at *10 (“[T]he collection . . . of a website visitor’s activity does not constitute the highly objectionable conduct needed to state a claim. . . . Nor has

[the plaintiff] alleged how [the defendant’s] use of Session Replay Code caused her mental suffering, shame, or humiliation.” (internal quotation marks omitted)). If your mouse movement and keystroke data is stored somewhere on Delta’s servers, “does it make a sound?” Owner- Operator Indep. Drivers Ass’n, Inc. v. United States Dep’t of Transp., 879 F.3d 339, 345 (D.C. Cir. 2018). The Court is not ruling that information gathered through the Session Replay Code cannot lead to harm. But, to date, Plaintiff provides no specific keystrokes or mouse movements (or any other digital input) the collection of which was harmful. Plaintiff’s allegation that Defendant’s practices are “highly objectionable to a reasonable person and constitutes an egregious breach of the social norms underlying the right to privacy [that led to] mental anguish and suffering arising from their loss of privacy and confidentiality” reads more like a “formulaic recitation” deemed inadequate under Twombly to satisfy the pleading requirement of substantive factual allegations. ECF No. 29 ¶¶ 112–13. Because a consensus has emerged within this District that the collection of this keystroke and mouse movement data alone is not sufficient harm to establish Intrusion

Upon Seclusion, without some additional specific allegations of harm, the Court will not make a finding that the generic allegation of the mere collection of this sort of data constitutes highly offensive harm. Because the third element of Intrusion Upon Seclusion is not met, the Court finds that the Complaint does not state a facially plausible claim for relief. Accordingly, as to the claim of Intrusion Upon Seclusion, the Court grants Defendant’s motion to dismiss. C. Preemption Under the Airline Deregulation Act Defendant argues that even if this Court has jurisdiction and the Complaint properly states a claim, this matter should still be dismissed as preempted by the Airline Deregulation Act (the

“ADA”). 49 U.S.C. § 41713(b). Defendant posits that because its website is related to various services provided by the airline, this action should be barred as preempted. In 1978, the United States Congress passed the ADA to reduce airline regulations and allow market forces to further efficiency, innovation, price, variety, and quality of air transportation services. Morales v. Trans World Airlines, Inc., 504 U.S. 374, 378 (1992). The law includes a preemption provision, designed to make sure states do not simply “re-regulate” how airlines operate within the state, contrary to Congress’s intent. Taj Mahal Travel, Inc. v. Delta Airlines, Inc., 164 F.3d 186, 191 (3d Cir. 1998). The ADA reads, “a State . . . may not enact or enforce a law, regulation, or other provision having the force and effect of law related to a price, route, or service of an air carrier.” 49 U.S.C. § 41713(b)(1). The precise meaning of “related to a … service” is not always clear and may require some degree of balancing. In Taj Mahal Travel, the Third Circuit Court advised that “service” means the functions of an airline that operate as public utilities, such as “‘the frequency and scheduling

of transportation,’ and ‘the selection of markets’ for that activity.” 164 F.3d 193 (quoting Charas v. Trans World Airlines, Inc., 160 F.3d 1259, 1265–66 (9th Cir.1998)). In Smith v. Comair, Inc., for example, the Fourth Circuit Court found that an airline’s boarding practices could not be preempted by state law. 134 F.3d 254 (4th Cir.1998). “Transportation itself” can also not be regulated by states. Hodges v. Delta Airlines, Inc., 44 F.3d 334, 336 (5th Cir.1995). But the ADA does not allow airlines to simply conduct business however they see fit without being subjected to state laws. As the United States Supreme Court put it, states may oversee an airline’s ability to provide regulated services, such as gambling or sex work. Morales, 504 U.S. at 390. As a more general guideline, the ADA does not bar state laws that are connected

to airlines in “too tenuous, remote, or peripheral a manner to have preemptive effect.” Id. For example, states may enforce against an airline “run-of-the-mill personal injury claims,” Charas, 160 F.3d 1261, routine breach-of-contract claims, Am. Airlines, Inc. v. Wolens, 513 U.S. 219, 220 (1995), and defamation claims. Taj Mahal Travel, 164 F.3d at 193 (finding that enforcing a defamation claim did “not frustrate Congressional intent, nor [did] it impose a state utility-like regulation on the airlines”). In fact, as the Third Circuit Court put it, preemption is generally inappropriate in the tort field. Id. at 194. Here, Plaintiff brings tort actions against an airline, and, if successful, the Court is not convinced that such action would limit the airline’s public utility function or act as a “re- regulation” of the industry in opposition to the legislative intent of the ADA. It seems that even if the result of this action would be that Defendant is prevented from engaging in the allegedly harmful behavior going forward, all the central functions of the airline would still survive. For the reasons discussed, the Court finds that Plaintiff’s claims are not preempted by the ADA. IV. Article III Standing

Defendant cited Cook, 2023 WL 5529772 as a supplemental authority regarding the question of whether the operations of the Session Replay Code meet the definitions of “interception” of the “content” of a “communication.” ECF No. 51. The Court notes that neither party addressed the question of whether the instant matter satisfies Article III standing, one of the grounds upon which Judge Ranjan granted the motion to dismiss in Cook. Cook, 2023 WL 5529772, at *2–6. “Federal courts are courts of limited jurisdiction.” Ins. Corp. of Ireland v. Compagnie des Bauxites de Guinee, 102 S. Ct. 2099, 2104 (1982). As such, the Court does not proceed with the “presumption that [it has] . . . jurisdiction to adjudicate a particular case,” Allison v. Chesapeake Energy Corp., 2013 WL 787257 (W.D. Pa. Jan. 29, 2013), and must do an analysis

on Plaintiff’s standing. “Absent Article III standing, a federal court does not have subject matter jurisdiction to address a plaintiff’s claims, and they must be dismissed.” Taliaferro v. Darby Twp. Zoning Bd., 458 F.3d 181, 188 (3d Cir. 2006). Under Article III of the United States Constitution, the power of the federal judiciary is limited to “cases” and “controversies.” U.S. Const. art. III, § 2. To establish the existence of a case or controversy, a plaintiff must show that (1) as a result of the defendant’s conduct (2) plaintiff suffered an injury in fact (3) that a favorable decision can redress. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560–61 (1992). However, it is not the case that “a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016). As the Supreme Court ruled in TransUnion v. Ramirez, “[o]nly plaintiffs concretely harmed by a defendant’s statutory violation have Article III standing to seek damages against that private defendant in federal court.” 594 U.S. 413 (2021). While physical and monetary injuries are the more readily identifiable concrete harms, concreteness can also be found when the “harm

has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a lawsuit in American courts.” Id. (quoting Spokeo, 578 U.S. 330, at 340). The types of harms with such a tradition “include, for example, reputational harms, disclosure of private information, and intrusion upon seclusion.” Id. at 425 (citing Gadelhak v. AT&T Services, Inc., 950 F.3d 458, 462 (CA7 2020) (Barrett, J.)). At bottom, TransUnion is attempting to limit standing to those who were victims of bad acts and to prevent “virtually any citizen [from bringing] a statutory damages suit against virtually any defendant who violated virtually any federal law.” Id. at 428. The instant matter is analogous to the facts in TransUnion. In that case, the plaintiffs sued the defendant under the Fair Credit Reporting Act for providing misleading credit reports to third

parties. Id. at 417. Justice Kavanaugh, writing for the majority, ruled that, despite the fact that the information in the credit reports may not have been false, the injury under the statute nevertheless bore a close relationship to the traditional injury of defamation, thereby satisfying the concreteness requirement necessary to establish Article III standing. Id. at 432. Here, Plaintiff sues Defendant under the PWA for non-consensual recording of various, otherwise private, movements and communications. The injury under the PWA bears a close relationship to the broad category of traditional invasion of privacy injuries, including common law intrusion upon seclusion, eavesdropping, trespass, and others. The PWA alone is not the sole method by which litigants have been, historically, made whole for having their private information invaded or recorded. Courts have recognized a cause of action for such invasions since well before it became common for state legislatures to provide statutory remedies. See, e.g., Rhodes v. Graham, 37 S.W.2d 46 (1931) (“The evil incident to the invasion of the privacy of the telephone is as great as that occasioned by unwarranted publicity in newspapers and by other means of a man’s private affairs for which courts have granted the injured person redress. Whenever a telephone line is tapped the

privacy of those talking over the line is invaded and conversations, wholly proper and confidential, may be overheard. Wire tapping is akin to eavesdropping, which was an indictable offense at common law, and while it has not been made a punishable offense by statute in this state, we conclude that the facts alleged in the petition in this case constitute a wrong done to appellant for which the law affords a remedy by an action for damages.”). The Court recognizes that there are two analyses of harm in this Memorandum, one of which (Article III standing) is satisfied and one of which (Intrusion Upon Seclusion) is not. To clarify any potential confusion, the Court stresses its previous findings, supra Section III (B)(b), that courts in this District have set a high bar to meet the “highly offensive” element of Intrusion

Upon Seclusion. On the other hand, to establish Article III standing for an injury that is not physical or monetary but is recognized by statute, a plaintiff must show that (1) the defendant’s violation (2) harmed the plaintiff (3) in a manner for which courts traditionally provide a remedy. As the Court reads it, the corpus of Article III caselaw assessing the question of the concreteness of intangible harm is driving at a very particular limitation: the plaintiff should be the party injured by the statutory violation. See, e.g., Warth v. Seldin, 422 U.S. 490, 498 (1975) (“[T]he standing question is whether the plaintiff has alleged such a personal stake in the outcome of the controversy as to warrant his invocation of federal-court jurisdiction and to justify exercise of the court’s remedial powers on his behalf.” (internal quotation marks omitted)); Allen v. Wright, 468 U.S. 737, 761 (1984) (“A black person in Hawaii [should not have standing to] challenge the grant of a tax exemption to a racially discriminatory school in Maine. Recognition of standing in such circumstances would transform the federal courts into no more than a vehicle for the vindication of the value interests of concerned bystanders.” (internal quotation marks omitted)); Lujan, 504 U.S. at 561–62 (“[T]he nature and extent of facts that must be averred . . . in order to establish

standing depends considerably upon whether the plaintiff is himself an object of the action . . . If he is, there is ordinarily little question that the action . . . has caused him injury, and that a judgment preventing or requiring the action will redress it.”); Hollingsworth v. Perry, 570 U.S. 693, 707 (2013) (“Article III standing is not to be placed in the hands of concerned bystanders, who will use it simply as a vehicle for the vindication of value interests.” (internal quotation marks omitted); TransUnion, 594 U.S. at 429 (“Private plaintiffs are . . . not charged with pursuing the public interest in enforcing a defendant’s general compliance with regulatory law.”). Some courts have found that, for Article III standing purposes, it would be appropriate at the pleading stage to determine whether the harm alleged would be sufficient to establish harm

under the closely connected traditionally harmful cause of action. See, e.g., Cook, 2023 WL 5529772, at *4 (“[T]he Court must examine the nature of the information that [the defendant] allegedly intercepted and determine whether the interception of that kind of information amounts to an invasion of privacy interests that have been historically protected.”). But the Court is instructed more directly by the Supreme Court. “In looking to whether a plaintiff’s asserted harm has a ‘close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit in American courts, we do not require an exact duplicate.” TransUnion, 594 U.S. at 433. In fact, in TransUnion, the Supreme Court found that the plaintiff’s claim of harm can qualify for Article III standing, even if harm would not be established under the standards of the traditional harm the plaintiff’s cause of action was closely related to. As noted, in that case, the plaintiff did not allege that the information disseminated was untrue, and the Supreme Court made no finding that true negative speech is actionable. Instead, the Supreme Court found that the harm alleged, while perhaps not defamation (a cause of action that requires the negative statement to be untrue), was sufficiently closely related to the traditionally recognized harm of defamation. Id.

Plaintiff alleges that Defendant violated the law and that Plaintiff was the victim of said violation. The sort of harm outlined in the PWA is closely related to several harms that American courts have traditionally recognized as worthy of remedy. As such, the Court is satisfied that Article III standing is met. V. Conclusion For the reasons discussed above, the Court grants in part and denies in part Defendant’s Motion to Dismiss. Plaintiff’s Intrusion Upon Seclusion claim is dismissed without prejudice, and the Court grants Plaintiff leave to amend the Complaint within 21 days of the date of this memorandum order.

BY THE COURT:

/s/Robert J. Colville Robert J. Colville United States District Judge DATED: June 3, 2024 cc: All counsel of record,