HARTLEY v. URBAN OUTFITTERS, INC.

• Court: District Court, E.D. Pennsylvania
• Decided: July 17, 2024
• Docket: 2:23-cv-04891
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA

TOMI HARTLEY, individually and on

behalf of all others similarly situated

Plaintiff, CIVIL ACTION NO. 23-4891 v. URBAN OUTFITTERS, INC. Defendant.

MEMORANDUM OPINION Rufe, J. July 17, 2024 Plaintiff Tomi Hartley filed this putative class action against Defendant Urban Outfitters, Inc., alleging violations of the Arizona Telephone, Utility and Communication Service Records Act.1 The suit arises from Defendant’s use of “spy pixels” which, among various alleged functions, record whether and when consumers open and read Defendant’s promotional emails. Defendant has moved to dismiss the Complaint for lack of jurisdiction under Federal Rule of Civil Procedure 12(b)(1) because Plaintiff does not have standing, or in the alternative, for failure to state a claim under Rule 12(b)(6). For the reasons set forth herein, Defendants’ motion to dismiss will be granted because Plaintiff lacks standing. I. BACKGROUND The following facts, as alleged in the Complaint, are taken as true for purposes of deciding Defendants’ motion to dismiss. Defendant uses Inbox Monster and Salesforce, two email tracking systems, for promotional emails it sends to its subscriber list.2 Both systems utilize trackers that Plaintiff calls “spy pixels,” images typically one pixel high by one pixel long

1 Ariz. Rev. Stat. Ann. § 44-1376 et seq (2007). 2 Compl. ¶¶ 2–4, 32, 37 [Doc. No. 1]. which are embedded into emails and activated when an email is opened.3 These spy pixels allow Defendant to collect an assortment of information about those who open its promotional emails, including whether, when, where, and for how long an email was opened, as well as the recipient’s associated email addresses, email path data, email viewing platform, and operating system.4 These details are tracked for every recipient on an individual level.5 Defendant does not

obtain consent from its subscribers to collect this information.6 Plaintiff resides in Mesa, Arizona and subscribed to Defendant’s email list.7 She received Defendant’s promotional emails over the past two years and frequently opened them, most recently in November 2023.8 Plaintiff alleges that each time she opened Defendant’s emails, Defendant collected details about her opening and reading of the emails, as well as information personally identifying her.9 She did not provide consent for Defendant to procure that data.10 II. LEGAL STANDARDS A. Standing A motion to dismiss for lack of standing is “properly brought pursuant to Rule 12(b)(1) because standing is a jurisdictional matter.”11 Article III of the Constitution authorizes federal courts to hear “[c]ases” and “[c]ontroversies.”12 “For there to be a case or controversy under

3 Id. ¶¶ 29–31, 34, 36–37. 4 Id. ¶¶ 29, 35–36, 49. 5 Id. ¶¶ 35–36. 6 Id. ¶ 4. 7 Id. ¶¶ 3, 6. 8 Id. ¶¶ 6–7. 9 Id. ¶ 8. 10 Id. ¶ 9. 11 In re Schering-Plough Corp. Intron/Temodar Consumer Class Action, 678 F.3d 235, 243 (3d Cir. 2012) (quoting Ballentine v. United States, 486 F.3d 806, 810 (3d Cir. 2007)). 12 U.S. Const. art. III, § 2, cl. 1. Article III, the plaintiff must have a personal stake in the case—in other words, standing.”13 The standing requirement forces plaintiffs “to sufficiently answer the question: ‘What’s it to you?’”14 This requirement “prevents courts of law from undertaking tasks assigned to the political branches,”15 and ensures that they “do not adjudicate hypothetical or abstract disputes” or act as “roving commission[s]” free to “publicly opine on every legal question.”16 The Supreme Court

has “established that the irreducible constitutional minimum of standing contains three elements.”17 “The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.”18 “It is the plaintiffs’ burden, at the pleading stage, to establish standing,”19 by “alleg[ing] facts that affirmatively and plausibly suggest that [they] ha[ve] standing to sue.”20 Plaintiffs must meet this burden “for each type of relief sought.”21 Moreover, “each element [of standing] must be supported in the same way as any other matter on which the plaintiff bears the burden of proof, i.e., with the manner and degree of evidence required at the successive stages of the litigation.”22 Because the Court now addresses a facial challenge to standing, it “appl[ies] the

13 TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021) (quotation marks omitted) (quoting Raines v. Byrd, 521 U.S. 811, 819 (1997)). 14 Id. (quoting Antonin Scalia, The Doctrine of Standing as an Essential Element of the Separation of Powers, 17 Suffolk U. L. Rev. 881, 882 (1983)). 15 Lewis v. Casey, 518 U.S. 343, 349 (1996) (citations omitted). 16 TransUnion, 594 U.S. at 423. 17 Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992) (citations omitted). 18 Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016), as revised (May 24, 2016) (citing Lujan, 504 U.S. at 560–61). 19 Reilly v. Ceridian Corp., 664 F.3d 38, 41 (3d Cir. 2011) (citations omitted). 20 Finkelman v. Nat’l Football League, 810 F.3d 187, 194 (3d Cir. 2016) (quoting Amidax Trading Grp. v. S.W.I.F.T. SCRL, 671 F.3d 140, 145 (2d Cir. 2011)). 21 Summers v. Earth Island Inst., 555 U.S. 488, 493 (2009) (citation omitted). 22 Lujan, 504 U.S. at 561 (citations omitted). same standard as on review of a motion to dismiss under Rule 12(b)(6).”23 The Court must consider only the facts pleaded in the Complaint and the documents referenced therein and attached thereto, viewed in the light most favorable to Plaintiffs.24 B. Failure to State a Claim To survive a motion to dismiss for failure to state a claim under Rule 12(b)(6), a plaintiff

must plead “sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’”25 A claim is facially plausible when a plaintiff pleads “factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.”26 A plaintiff’s “allegations must be enough to raise a right to relief above the speculative level”; something more than a mere possibility of a claim must be alleged.27 The complaint must set forth “direct or inferential allegations respecting all the material elements necessary to sustain recovery under some viable legal theory.”28 At the motion to dismiss stage, courts are not tasked with assessing the probability of whether the alleged facts can or will be proved.29 Rather, the standard “simply calls for enough facts to raise a reasonable expectation that discovery will reveal evidence of the necessary element” of a claim.30 The question is not

23 In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 633 (3d Cir. 2017) (citing Petruska v. Gannon Univ., 462 F.3d 294, 299 n.1 (3d Cir. 2006)). 24 Finkelman, 810 F.3d at 194 (“When assessing standing on the basis of the facts alleged in a complaint, this means we apply the same standard of review we use when assessing a motion to dismiss for failure to state a claim.”) (citing In re Schering Plough Corp., 678 F.3d at 243); see also Richard Roe W.M. v. Devereux Found., 650 F. Supp. 3d 319, 326 n.3 (E.D. Pa. 2023). 25 Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). 26 Id. (citing Twombly, 550 U.S. at 556). 27 Twombly, 550 U.S. at 555 (citations omitted). 28 Id. at 562 (quotation marks and citations omitted). 29 Phillips v. County of Allegheny, 515 F.3d 224, 234 (3d Cir. 2008). 30 Id. (quotation marks omitted) (quoting Twombly, 550 U.S. at 556). whether the plaintiff ultimately will prevail but whether the complaint is “sufficient to cross the federal court’s threshold.”31 In determining whether a motion to dismiss should be granted, the court must consider only those facts alleged in the complaint, accepting the allegations as true and drawing all logical inferences in favor of the non-moving party.32 Courts are not, however, bound to accept as true

legal conclusions framed as factual allegations.33 At the motion to dismiss stage, “courts generally consider only allegations in the complaint, exhibits attached to the complaint, matters of public record, and documents that form the basis of a claim.”34 III. DISCUSSION The Arizona Telephone, Utility and Communication Service Records Act (the “Arizona Records Act”)35 makes it unlawful for a person to “[k]nowingly procure . . . [a] communication service record” of any Arizona resident “without the authorization of the customer . . . .”36 The statute defines “communication service record” as including “subscriber information” like a person’s “name, . . . electronic account identification and associated screen names . . . or access logs,” as well as “records of the path of an electronic communication between the point of origin

and the point of delivery and the nature of the communication service provided, such as . . .

31 Skinner v. Switzer, 562 U.S. 521, 530 (2011) (citation omitted). At the motion to dismiss stage, a court determines only whether a plaintiff will be permitted to seek evidence in support of the claims in the complaint. See Twombly, 550 U.S. at 556, 558–59. 32 ALA, Inc. v. CCAIR, Inc., 29 F.3d 855, 859 (3d Cir. 1994); Fay v. Muhlenberg Coll., No. 07-4516, 2008 WL 205227, at *2 (E.D. Pa. Jan. 24, 2008). 33 Papasan v. Allain, 478 U.S. 265, 286 (1986); Twombly, 550 U.S. at 555. 34 Brown v. Daniels, 128 F. App’x 910, 913 (3d Cir. 2005) (quotation marks omitted) (quoting Lum v. Bank of Am., 361 F.3d 217, 221 n.3 (3d Cir. 2004)); see also Pension Ben. Guar. Corp. v. White Consol. Indus., Inc., 998 F.2d 1192, 1196 (3d Cir. 1993). 35 Ariz. Rev. Stat. Ann. § 44-1376 et seq. 36 Ariz. Rev. Stat. Ann. § 44-1376.01. electronic mail . . . or other service features.”37 Plaintiff alleges that the information gathered through the use of spy pixels falls within the statutory definition of a communication service record, and that Defendant knowingly procured that information without Plaintiff’s consent. Defendant argues that Plaintiff lacks standing to bring her claim because the harms she allegedly suffered are not concrete.

A. Concrete-Harm Requirement Under Article III In TransUnion LLC v. Ramirez, the Supreme Court reaffirmed that the injury-in-fact requirement for standing under Article III—the “‘[f]irst and foremost’ of standing’s three elements”38—requires a plaintiff to establish that an injury is concrete, particularized, and actual or imminent.39 Those separate requirements “ensure[ ] that federal courts decide only ‘the rights of individuals,’ . . . and that federal courts exercise ‘their proper function in a limited and separated government.’”40 An alleged injury is concrete for purposes of Article III if it bears a “‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a lawsuit in American courts.”41 Accordingly, in order to satisfy the concrete-harm requirement, a plaintiff must “identif[y] a close historical or common-law analogue for their asserted injury.”42 Such an

analogue need not be “an exact duplicate in American history and tradition,” but courts should take care not to “loosen Article III based on contemporary, evolving beliefs about what kinds of

37 Ariz. Rev. Stat. Ann. § 44-1376(1). 38 Spokeo, 578 U.S. at 338–39 (alteration in original) (quoting Steel Co. v. Citizens for Better Env’t, 523 U.S. 83, 103 (1998)). 39 TransUnion, 594 U.S. at 423 (citing Lujan, 504 U.S. 555, 560–61 (1992)). 40 Id. (quoting Marbury v. Madison, 5 U.S. 137 (1803); Roberts, Article III Limits on Statutory Standing, 42 Duke L. J. 1219, 1224 (1993)). 41 Id. at 424 (quoting Spokeo, 578 U.S. at 341). 42 Id. suits should be heard in federal courts.”43 Moreover, a plaintiff need not “show facts that would ‘give rise to a cause of action under common law,’”44 but “the de jure injury must ‘protect essentially the same interests’ as ‘traditional causes of action.’”45 As recently explained by the Third Circuit, that does not mean that a plaintiff is required under TransUnion to allege every element of a traditional common-law cause of action;46 it does, however, require something

“more” than merely pointing to a comparable analogue.47 A prospective plaintiff must show that “the harm [she] suffered as a result of the statutory violation bears a sufficiently close relationship to the harm from that common-law action.”48 “A risk of future harm, without more, does not establish standing in a suit for damages.”49 The Supreme Court has made clear that “Congress may ‘elevate’ harms that ‘exist’ in the real world before Congress recognized them to actionable legal status, [but] it may not simply enact an injury into existence, using its lawmaking power to transform something that is not remotely harmful into something that is.”50 So too for state legislatures, whose enactments cannot supersede the absolute jurisdictional requirements of Article III. Accordingly, the

question of whether Plaintiff has sufficiently pleaded a statutory violation of the Arizona Records Act is secondary to this Court’s threshold review of the actual injury alleged—that is, whether there is a “close relationship” between, on the one hand, Defendant’s alleged

43 Id. at 424–25. 44 Huber v. Simon’s Agency, Inc., 84 F.4th 132, 148 (3d Cir. 2023) (quoting In re Horizon, 846 F.3d at 639). 45 Id. (quoting Long v. Se. Pa. Transp. Auth., 903 F.3d 312, 324 (3d Cir. 2018)). 46 Barclift v. Keystone Credit Servs., LLC, 93 F.4th 136, 145 (3d Cir. 2024). 47 Huber, 84 F.4th at 148. 48 Id. (cleaned up) (quoting TransUnion, 594 U.S. at 433); see also Barclift, 93 F.4th at 145 (“TransUnion speaks only of harms, not elements.”). 49 In re BPS Direct, LLC, No. 23-md-3074, 2023 WL 8458245, at *7 (E.D. Pa. Dec. 5, 2023) (citing Davis v. Universal Prot. Servs., LLC, 558 F. Supp. 3d 220, 224 (E.D. Pa. 2021)). 50 TransUnion, 594 U.S. at 426 (quoting Hagy v. Demers & Adams, 882 F.3d 616, 622 (6th Cir. 2018)). procurement of Plaintiff’s data relating to her opening of promotional emails and, on the other hand, a traditionally actionable harm under common law. B. Invasion of Privacy and the Arizona Records Act Injuries in fact sufficient to confer standing are not limited to tangible harms. Various intangible harms have long been understood to be concrete because of their close relationship to traditional causes of action.51 Plaintiff analogizes her claim to the tort of “intrusion upon

seclusion,” which falls under common-law invasion of privacy,52 and “has long been burrowed deep in American law.”53 Under the law discussed above, Plaintiff faces substantial hurdles. First, this case is brought under an Arizona statute that, prior to the recent wave of similar putative class actions brought in federal courts throughout the country,54 has never been invoked in a civil action of this nature.55 The Court has not identified (and the parties do not cite) any relevant guidance from the Arizona courts interpreting the provisions of the Arizona Records Act in the context of a civil case for damages or injunctive relief. Although the Arizona Records Act is modeled on a federal statute—the Telephone Records and Privacy Protection Act of 2006

51 Id. at 425 (citing Davis v. Fed. Election Comm’n, 554 U.S. 724, 733 (2008) (disclosure of private information); Gadelhak v. AT&T Servs., Inc., 950 F.3d 458, 462 (7th Cir. 2020) (Barrett, J.) (intrusion upon seclusion)). 52 Barclift v. Keystone Credit Servs., LLC, 93 F.4th 136, 145 (3d Cir. 2024) (citing Restatement (Second) of Torts § 652A; Nabozny v. Optio Sols. LLC, 84 F.4th 731, 735 (7th Cir. 2023)). 53 Church v. Collection Bureau of Hudson Valley, Inc., No. 20-3172, 2023 WL 8185669, at *4 (D.N.J. Nov. 27, 2023) (citing William L. Prosser, Privacy, 48 Cal. L. Rev. 383, 389–90 (1960)). 54 Over the past seven months, at least eleven other putative class actions have been filed under the Arizona Telephone, Utility and Communication Service Records Act alleging injuries similar to those asserted here. See Mills v. Saks.com LLC, No. 23-10638 (S.D.N.Y. Dec. 6, 2023); McGee v. Nordstrom Inc., No. 23-1875 (W.D. Wash. Dec. 6, 2023); Carbajal v. Home Depot, No. 24-730 (D. Ariz. Apr. 2, 2024); Campos v. TJX Cos., Inc., No. 24-11067 (D. Mass. Apr. 22, 2024); Dominguez v. Lowe’s Cos. Inc., No. 24-1030 (D. Ariz. May 5, 2024); Carbajal v. Gap Inc., No. 24-1056 (D. Ariz. May 7, 2024); Smith v. Target Corp., No. 24-1048 (D. Ariz. May 7, 2024); Knight v. Patagonia Inc., No. 24-255 (D. Ariz. May 20, 2024); Torrez v. Signet Jewelers Ltd., No. 24-1332 (D. Ariz. June 4, 2024); Segovia v. Burlington Coat Factory Warehouse Carp., No. 24-6730 (D.N.J. June 6, 2024); Encinas v. Office Depot LLC, No. 24-1463 (D. Ariz. June 18, 2024). 55 See, e.g., State v. Zuck, No. 2 CA-CR 2019-0130, 2021 WL 2103598 (Ariz. Ct. App. May 25, 2021) (applying law enforcement exemption only in criminal context); State v. Duran, No. 2 CA-CR 2016-0318, 2017 WL 6333916 (Ariz. Ct. App. Dec. 11, 2017) (same). (“TRPPA”)—the federal counterpart is narrower in scope, plainly does not cover Defendant’s alleged conduct, and therefore is of limited help for purposes of historical comparison here.56 Second, Plaintiff does not analogize her present claim to appropriation of name or likeness, publicity given to private life, or false light—other invasion of privacy torts which involve the disclosure of private information.57 That makes sense, given that the allegations in

the Complaint, as Plaintiff concedes, “do not concern . . . redisclosure” to third parties.58 Plaintiff’s concession limits the relevance of many cases she cites, such as those brought under the federal Video Privacy Protection Act (“VPPA”), which prohibits only the wrongful disclosure of video tape rental and sale records by service providers to others.59 Nor can the instant allegations be compared to other tracking-pixel cases involving third-party disclosures.60 Third, while some statutes intended to protect individuals’ private information do not require a disclosure to a third party (as is true of the Arizona Records Act here), the Supreme Court and Third Circuit caution against finding a concrete harm when there is no actual dissemination, even if that information is protected by statute. In Kamal v. J. Crew Group, Inc.,61

the Third Circuit reviewed allegations that the defendant retailer had printed on its sales receipts

56 Compare TRPPA, 18 U.S.C. § 1039(a) (prohibiting the obtaining of confidential phone records information by “making false or fraudulent statements or representations”), with Ariz. Rev. Stat. Ann. § 44-1376.01 (broadly prohibiting procurement of a communication service record “without the authorization of the customer,” separate and apart from procurement through fraud); see also Compl. ¶ 26 [Doc. No. 1] (conceding that the federal TRPPA does not prohibit the use of email trackers). 57 See Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 114 (3d Cir. 2019) (quoting In re Horizon, 846 F.3d at 638). 58 Pl.’s Sur-Reply Opp’n Mot. Dismiss at 3 [Doc. No. 14]. 59 18 U.S.C. § 2710(b). To the extent that some VPPA cases discuss, perhaps unnecessarily, the tort of intrusion upon seclusion, they are further distinguishable in that they involve website users’ private video viewing activity—a category of information materially different from data relating to promotional emails which subscribers opt in to receive. See In re BPS Direct, 2023 WL 8458245, at *16 n.174 (distinguishing VPPA cases about video viewing activity from claims relating to use of “session replay” code to gather browsing activity on retailers’ websites). 60 Cf. Smith v. Loyola Univ. Medical Ctr., No. 23-15828, 2024 WL 3338941, at *3–4 (N.D. Ill. July 9, 2024). 61 918 F.3d 102. the first five and last four digits of a plaintiff consumer’s credit card number, in clear violation of the Fair and Accurate Credit Transactions Act of 2003 (“FACTA”), which prohibits printing more than the last five digits.62 The court held that the alleged injury was not concrete—i.e., that it did not bear a sufficiently “close relationship” to unreasonable publicity or other traditional privacy torts—because there were no allegations that his information was ever disclosed to a

third party.63 Likewise, in TransUnion, the Supreme Court differentiated between class members whose misleading credit files were disseminated to third parties and those class members whose files were inaccurate but maintained only internally by the credit reporting agency.64 The members of the latter group, the Court held, could not have suffered concrete harm if the inaccurate or misleading information about them merely sat in the company’s database.65 Both cases also considered and rejected arguments that the potential risk of dissemination was sufficient to confer standing.66 C. Analogous Harms Specific to Intrusion on Seclusion The Restatement (Second) of Torts provides that “[o]ne who intentionally intrudes . . . upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability

to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.”67 Of the cases in this Circuit and elsewhere which rely predominantly on intrusion on seclusion as a point of comparison, none have force with respect to the allegations here.

62 15 U.S.C. § 1681c(g). 63 Kamal, 918 F.3d at 114 (citing Spokeo, 578 U.S. at 341). 64 594 U.S. at 432–34. 65 Id. at 434. 66 Kamal, 918 F.3d at 116 (noting that, as alleged, the information included on the receipt was insufficient to likely enable identity theft); TransUnion, 594 U.S. at 435–37 (differentiating availability of standing based on “risk of future harm” in suits for injunctive relief versus suits for damages). 67 Restatement (Second) of Torts § 652B. The Third Circuit’s decision in Susinno v. Work Out World Inc.68 is instructive. In Susinno, the court considered (before TransUnion) a claim under the Telephone Consumer Protection Act69 (“TCPA”) based on a single, unsolicited call from a fitness company resulting in a prerecorded, one-minute promotional offer left on a consumer’s voicemail.70 The court acknowledged that a single call would likely not be “highly offensive to a reasonable person,”

and therefore not actionable at common law.71 Nevertheless, the court concluded that a concrete injury had been alleged because Congress, by enacting the TCPA, elevated a harm “‘previously inadequate in law,’ [that] was of the same character of previously existing ‘legally cognizable injuries.’”72 Critically, however, the robocall in Susinno was unsolicited. The relationship in that case—between an unwelcome advertiser and a consumer who wanted to be left alone—is materially distinguishable from Plaintiff’s relationship with Defendant here, as she not only opted in to receiving emails from Defendant by joining its subscriber list, but continued to consume its promotional materials by regularly opening them. This is not to suggest that consumers, by signing up to join an email subscriber list,

thereby grant permission for retailers to surreptitiously gather everything under the sun. If a subscriber were to allege that spy pixels were used, for example, to trawl through the contents of unrelated personal messages, or to gain access to the camera of the subscriber’s device, such invasions of privacy likely would be held comparable to common-law intrusion on seclusion and therefore constitute concrete harms, regardless of whether those messages or video recordings

68 862 F.3d 346 (3d Cir. 2017). 69 47 U.S.C. § 227. 70 Susinno, 862 F.3d at 348. 71 Id. at 351–52. 72 Id. at 352 (quoting Spokeo, 578 U.S. at 341). were disseminated elsewhere. The same might be true of other highly sensitive categories of personal information not before this Court—e.g., the collection of a subscriber’s complete credit card information,73 medical history,74 or social security number.75 The analysis, then, must center on each of the specific categories of data alleged to have been gathered here. Some of the information Defendant allegedly collected through spy pixels does not give

rise to a concrete injury because Plaintiff voluntarily disclosed it. As a willing subscriber, Plaintiff could not have been harmed by Defendant’s procurement of her name or associated email addresses—details she necessarily provided to Defendant when she signed up for its promotional emails. Other types of information allegedly procured are not of the kind in which a party has a reasonable expectation of privacy.76 Plaintiff fails to sufficiently allege how she was harmed by Defendant gleaning the type of device, operating system, or email viewing platform she used to read Defendant’s emails, and in any event, such details are not comparable to those traditionally contemplated as giving rise to a reasonable privacy interest. Individualized data about whether, when, where, and for how long Plaintiff read

Defendant’s emails presents a closer question. Although the Court has not identified cases specifically addressing these categories of data, decisions in this Circuit regarding users’ browsing activity are helpful. In one recent decision in this District, In re BPS Direct LLC, the court held that the general practice of gathering digital information about consumers cannot be

73 See Kamal, 918 F.3d at 116 (“Our analysis would be different if, for example, Kamal had alleged that the receipt included all sixteen digits of his credit card number . . . .”). 74 See Smith, 2024 WL 3338941, at *4. 75 But see Freeman v. Early Warning Servs., LLC, 443 F. Supp. 3d 581, 585 (E.D. Pa. 2020) (“Plaintiff has not alleged that anyone other than himself had access to his unredacted social security number printed on his credit report. Therefore, the violation alleged is technical.”). 76 See Massie v. Gen. Motors LLC, No. 21-787, 2022 WL 534468, at *5 (D. Del. Feb. 17, 2022) (“‘Eavesdropping’ on communications that do not involve personal information, personally identifiable information, or information over which a party has a reasonable expectation of privacy does not amount to a concrete injury.”). compared wholesale to the historical protection against intrusions on privacy without an inquiry into what those intrusions actually yield.77 The district court carefully analyzed each type of information collected using “session replay” code built into the defendant retailers’ websites. Reviewing allegations that defendants gathered data about website users’ mouse clicks and movements, scroll movements, keystrokes, copy and paste actions, and search terms, as well as

pages and content viewed by the users,78 the court concluded that the plaintiffs had failed to allege the interception of “private communications or personal information.”79 The court also held that the defendant retailers’ alleged collection of substantive information inputted by the users was not sufficiently described in the pleadings, and that allegations concerning what session replay code can or may capture were similarly insufficient.80 As a matter of law, the Court concludes that digital records reflecting merely the dates and times at which Plaintiff opened promotional emails she signed up to receive, and the length of time she spent reading them, are not sufficiently personal to support a concrete injury. Like a users’ keystrokes and mouse clicks upon voluntarily visiting a retailers’ website, these details are

entitled to less privacy protection by virtue of Plaintiff’s decision to opt into receiving and reading the emails.81 Plaintiff’s allegations that the spy pixels are designed to extract IP addresses and location data give the Court more pause, but as discussed in In re BPS, allegations of what a technology is

77 2023 WL 8458245, at *8 (citing Cook v. GameStop, Inc., 689 F. Supp. 3d 58, 63–65 (W.D. Pa. 2023); Massie, 2022 WL 534468, at *3, *5). 78 Id. at *11. 79 Id. at *12. 80 Id. (“We need to know what session replay code actually captured, not what session replay code is capable of capturing.”). 81 See Cook, 689 F. Supp. 3d at 66 (comparing online browsing activity to entering a brick-and-mortar store). merely capable of collecting do not equate to sufficient allegations of what that technology actually collected.82 Moreover, although the Complaint alleges that Defendant did in fact use its tracking systems to learn “the time and place of where [Plaintiff’s] email was opened,” it does not specify the granularity of that location data.83 Indeed, elsewhere in the Complaint, Plaintiff suggests that Inbox Monster’s spy tracking pixel allows Defendant to view only the country of

an email recipient—an insufficient level of specificity to implicate privacy concerns.84 Accordingly, the Court holds that Plaintiff has failed to allege facts supporting an injury in fact sufficient to confer standing under Article III. Because standing is a jurisdictional matter,85 it is unnecessary for this Court to decide whether Plaintiff has adequately pleaded a violation of the Arizona Records Act. IV. CONCLUSION For the reasons stated above, Defendant’s motion to dismiss will be granted for lack of jurisdiction. The Court will grant Plaintiff the opportunity to file an amended complaint. An order will be entered.

82 2023 WL 8458245, at *12; see Compl. ¶ 49 [Doc. No. 1] (alleging that spy pixels are “designed to extract” certain information, including IP addresses). 83 Compl. ¶ 37 [Doc. No. 1] (emphasis added). 84 Id. ¶ 35. 85 Ballentine, 486 F.3d at 810.