Kenneth Hasson v. Fullstory Inc

114 F.4th 181

• Court: Court of Appeals for the Third Circuit
• Decided: September 5, 2024
• Docket: 23-2535
• Status: Published

Opinion

PRECEDENTIAL

UNITED STATES COURT OF APPEALS FOR THE THIRD CIRCUIT ____________

No. 23-2535 ___________

KENNETH HASSON, Individually and on behalf of all others similarly situated, Appellant

v.

FULLSTORY, INC. ____________

On Appeal from the United States District Court for the Western District of Pennsylvania (D.C. No. 2-22-cv-01246) District Judge: Honorable Marilyn J. Horan ____________

No. 23-2573 ___________

JORDAN SCHNUR, Individually and on behalf of all others similarly situated, Appellant

v. PAPA JOHN’S INTERNATIONAL, INC., d/b/a Papa Johns ____________

On Appeal from the United States District Court for the Western District of Pennsylvania (D.C. No. 2-22-cv-01620) District Judge: Honorable J. Nicholas Ranjan ____________

Argued on April 18, 2024

Before: HARDIMAN, PHIPPS, and SMITH, Circuit Judges.

(Filed: September 5, 2024)

Gary F. Lynch Jamisen A. Etzel [Argued] Lynch Carpenter, LLP 1133 Penn Avenue, 5th Floor Pittsburgh, PA 15222 Counsel for Appellants Emily Johnson Henn Covington and Burling LLP 3000 El Camino Real 5 Palo Alto Square, 10th Floor Palo Alto, CA 94306

Peter S. Wolff Pietragallo Gordon Alfano Bosick & Raspanti 301 Grant Street One Oxford Centre,38th Floor Pittsburgh, PA 15219

2 Mark W. Mosier [Argued] Eric C. Bossett Kendall T. Burchard Grace Pyo Covington & Burling LLP One CityCenter 850 Tenth Street, NW Washington, DC 20001 Counsel for Appellees ________________________

OPINION OF THE COURT ________________________

HARDIMAN, Circuit Judge.

These appeals come to us from the District Courts’ orders dismissing two class actions for lack of personal jurisdiction. In the first case, Kenneth Hasson sued FullStory, Inc., claiming that the company unlawfully wiretapped him when it deployed a script of computer code—known as Session Replay Code—to intercept his online communications. In the second case, Jordan Schnur sued Papa John’s International, Inc. for its use of FullStory’s Session Replay Code.

I

We begin by describing the technology at issue. FullStory’s Session Replay Code enables companies like Papa Johns to collect detailed information about the way visitors

3 interact with its website. The website “delivers” the code “to a user’s browser,” which “follow[s] the code’s instructions by sending . . . data to a . . . third-party server.” Hasson App. 29. The data encompasses “virtually every user action, including all mouse movements, clicks, scrolls, zooms, window resizes, keystrokes, text entry, and numerous other forms of a user’s navigation and interaction through the website.” Id.

The information is intercepted—without the user’s knowledge or consent—the moment he accesses the website. And text entries on the website are captured even if the user fails “to click . . . ‘submit’ or ‘enter.’” Id. at 30. Users’ internet protocol addresses and location information can also be identified. Vendors and website operators use the data to recreate a user’s entire browsing session on that website. FullStory receives and analyzes the harvested data for its clients, who use the information to improve website functionality and user experience.

The question presented in both cases is whether the deployment of Session Replay Code in Pennsylvania makes FullStory and Papa Johns amenable to jurisdiction there. The parties agree that the claims implicate only specific, not general, jurisdiction. See O’Connor v. Sandy Lane Hotel Co., 496 F.3d 312, 317 (3d Cir. 2007) (citing Helicopteros Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 414–15 & n.9 (1984)).

Specific jurisdiction exists when the “plaintiff’s cause of action is related to or arises out of the defendant’s contacts with the forum.” Pinker v. Roche Holdings Ltd., 292 F.3d 361, 368 (3d Cir. 2002) (citation omitted). A district court sitting in diversity can exercise personal jurisdiction over an out-of-state defendant to the extent permitted by the law of the forum state.

4 Metcalfe v. Renaissance Marine, Inc., 566 F.3d 324, 330 (3d Cir. 2009); see also Fed. R. Civ. P. 4(k)(1)(A). Pennsylvania’s long-arm statute permits personal jurisdiction “based on the most minimum contact with th[e] Commonwealth allowed under the Constitution of the United States.” 42 Pa. Cons. Stat. § 5322(b).

The Supreme Court has articulated two tests for specific jurisdiction: (1) the “traditional” test—also called the “minimum contacts” or purposeful availment test, Burger King Corp. v. Rudzewicz, 471 U.S. 462, 474 (1985) (quoting Int’l Shoe Co. v. State of Wash., Off. of Unemployment Comp. & Placement, 326 U.S. 310, 316 (1945)); and (2) the “effects” test, see Calder v. Jones, 465 U.S. 783, 787 & n.6 (1984).

Under the traditional test, the plaintiff must show that the defendant has “minimum contacts” with the forum such that it “purposefully avail[ed] itself of the privilege of conducting activities within the forum” and “invoke[ed] the benefits and protections of [the forum’s] laws.” Toys “R” Us, Inc. v. Step Two, S.A., 318 F.3d 446, 451 (3d Cir. 2003) (quoting Asahi Metal Indus. Co. v. Superior Court of California, 480 U.S. 102, 109 (1987)). Second, the plaintiff’s claims must “arise out of or relate to” at least some of those contacts, O’Connor, 496 F.3d at 317 (quoting Helicopteros, 466 U.S. at 414), evidencing “a strong relationship among the defendant, the forum, and the litigation,” Hepp v. Facebook, 14 F.4th 204, 208 (3d Cir. 2021) (internal quotations omitted) (citing Ford Motor Co. v. Montana Eighth Jud. Dist. Ct., 592 U.S. 351, 365 (2021)). Finally, the exercise of jurisdiction over the defendant must “comport[] with traditional notions of fair play and substantial justice” such that “the defendant ‘should reasonably anticipate being haled into court’ in that forum.” Toys, 318 F.3d at 451 (quoting World–Wide Volkswagen Corp.

5 v. Woodson, 444 U.S. 286, 297 (1980)).

Direct in-forum activities are not the only means of establishing personal jurisdiction over an out-of-state defendant. For example, in Calder v. Jones, the Supreme Court confronted tortfeasors who—despite minimal contacts in California—intentionally caused harm there. See 465 U.S. 783 (1984). Though the defendant news editors had few “relevant contacts” with California, id. at 786, the Court emphasized that the editors “impugned . . . an entertainer . . . centered in California[,]” “dr[ew] from California sources, and the brunt of the harm . . . was suffered in California” such that “California [was] the focal point both of the story and of the harm suffered,” id. at 788–89. Thus, the Court held that “[j]urisdiction over [the defendants] [was] . . . proper in California based on the ‘effects’ of their . . . conduct in California.” Id. at 789.

Courts have applied Calder’s “effects” test to assess personal jurisdiction over an intentional tortfeasor whose “contacts with the forum . . . otherwise [do] not satisfy the requirements of due process” under the traditional test. IMO Indus., Inc. v. Kiekert AG, 155 F.3d 254, 265 (3d Cir. 1998). In such cases, personal jurisdiction may be proper if the forum is the “focus” of the defendant’s tortious conduct. Id. (quoting Keeton v. Hustler Mag., Inc., 465 U.S. 770, 780 (1984)). Unlike the traditional test, the Calder “effects” test requires a plaintiff to plead facts establishing that: (1) the defendant committed an intentional tort; (2) the plaintiff felt the brunt of the harm in the forum; and (3) the defendant expressly aimed his tortious conduct at the forum. See Remick v. Manfredy, 238 F.3d 248, 258 (3d Cir. 2001).

A

6 In the first appeal, Hasson alleged that FullStory’s use of Session Replay Code violated Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (“WESCA”), 18 Pa. Cons. Stat. § 5701, et seq., and invaded his privacy in violation of the common law. Hasson alleged that while he browsed Mattress Firm’s website, FullStory’s Session Replay Code “instantaneously captured his [w]ebsite [c]ommunications” “without his consent,” including “information about his device, browser, and geolocation,” while also “creat[ing] a unique ID and profile for him.” Hasson App. 40. He claims the code allowed FullStory to collect “his personal information . . . including name, address, email address, and payment information.” Hasson App. 44.

FullStory moved to dismiss Hasson’s complaint under Rule 12(b)(2) of the Federal Rules of Civil Procedure for lack of personal jurisdiction because, although Hasson is a resident of Pennsylvania, FullStory is a Delaware corporation with its principal place of business in Georgia. Hasson opposed the motion and sought jurisdictional discovery to determine whether FullStory had sufficient contacts with Pennsylvania to satisfy the requirements of personal jurisdiction.

The District Court denied Hasson’s motion for jurisdictional discovery and granted FullStory’s motion to dismiss. It concluded that Hasson failed to satisfy the “effects” test for specific personal jurisdiction under Calder because he “pled insufficient facts to demonstrate that FullStory expressly aimed its conduct at Pennsylvania through the Mattress Firm website.” Hasson v. FullStory, Inc., 2023 WL 4745961, at *2 (W.D. Pa. July 25, 2023). Hasson filed this timely appeal asking us to reverse the District Court’s order or, in the alternative, to vacate and remand with instructions to order jurisdictional discovery.

7 B

In the second appeal, Schnur, a Pennsylvania resident, filed a class action against Papa Johns, a Delaware corporation with its principal place of business in Georgia. Schnur filed wiretapping and invasion of privacy claims like those Hasson brought against FullStory. Unlike Hasson, who sued the company that produced the code that attached to his browser, Schnur sued the company operating the website that deployed the code onto his browser.

Papa Johns maintains “approximately 85 brick-and- mortar locations in Pennsylvania” and “regularly markets and advertises its goods and services within Pennsylvania.” Schnur App. 29 (footnote omitted). Schnur alleged that, while in Pennsylvania, he visited Papa Johns’ website on his computer to order food. In doing so, he “communicated with Papa John’s by entering a delivery address[,] . . . searching for a nearby carryout location in Pennsylvania[,]” and selecting “what type of pizza he wanted to order.” Schnur App. 43.

Papa Johns moved to dismiss for lack of personal jurisdiction. The District Court granted the motion, finding that because Papa Johns’ website was “generally available to everyone, no matter where they are located,” Schnur failed to allege that the company expressly aimed Session Replay Code at Pennsylvania. Schnur v. Papa John’s Int’l, Inc., 2023 WL 5529775, at *3 (W.D. Pa. Aug. 28, 2023). The District Court also held that Schnur’s complaint failed to establish specific personal jurisdiction under the “traditional” test because Schnur’s wiretapping claims did not arise out of or relate to Papa Johns’ marketing and sale of pizza in Pennsylvania.

Hasson and Schnur filed timely appeals and we joined

8 the cases for argument and disposition. 1

II

We turn first to Schnur’s claims against Papa Johns. Schnur argues the District Court erred when it dismissed for lack of jurisdiction under the Calder “effects” test without first considering whether jurisdiction was proper under the traditional purposeful availment test. He contends jurisdiction is proper under the “effects” test or, alternatively, under the traditional test—which he views as the appropriate test given Papa Johns’ extensive business contacts in Pennsylvania. Stated simply, Schnur argues that the Calder test cannot be invoked to deny personal jurisdiction over a suit that otherwise satisfies the traditional test.

The District Court held that Schnur’s allegations could not satisfy Calder because Papa Johns did not expressly aim Session Replay Code at Pennsylvania and Schnur did not suffer the brunt of his alleged harm in Pennsylvania. See Schnur, 2023 WL 5529775, at *2–3. Schnur counters that the District

1 The District Courts had subject matter jurisdiction over Hasson’s and Schnur’s claims under 28 U.S.C. § 1332(d)(2). We review de novo the orders dismissing for lack of personal jurisdiction. See O’Connor, 496 F.3d at 316. Where, as here, the District Courts did not hold evidentiary hearings on personal jurisdiction, we take the Plaintiffs’ factual allegations as true. See Miller Yacht Sales, Inc. v. Smith, 384 F.3d 93, 97 (3d Cir. 2004) (citation omitted).

9 Court erred because the traditional test is the proper jurisdictional standard while Calder is “typically invoked where,” unlike here, “the conduct . . . form[ing] the basis for the controversy occurs entirely out-of-forum.” Schnur Br. 47 (citation omitted). Because Papa Johns has extensive business contacts in Pennsylvania and deployed Session Replay Code into the forum, Schnur contends that the District Court should have applied the traditional test first. Under that test, Schnur argues, jurisdiction is proper because Papa Johns purposefully availed itself of the privilege of doing business in Pennsylvania and Schnur’s wiretapping claims arise out of the company’s contacts there.

In sum, Schnur contends that courts need not apply the “effects” test to all intentional tort claims and, even if the District Court did so, personal jurisdiction still lies here because Calder’s “effects” test is more plaintiff-friendly than the traditional test. Papa Johns counters that courts must apply the “effects” test to intentional tort claims, and that the District Court correctly held that Schnur could not satisfy Calder’s express aiming prong. We agree that Schnur’s allegations do not satisfy the requirements for personal jurisdiction under Calder.

While the “effects” test and the traditional test “are cut from the same cloth,” they have distinct requirements. Marten v. Godwin, 499 F.3d 290, 297 (3d Cir. 2007). As we explained:

[T]he effects test . . . require[s] that the tortious actions of the defendant have a forum-directed purpose[—a requirement that] is not applicable in the more traditional specific jurisdiction analysis. . . . Unlike th[e] express requirement in the effects test, the traditional specific jurisdiction analysis simply requires

10 that the plaintiff’s claims arise out of or relate to the defendant’s forum contacts. We do not agree with the argument that this traditional requirement is the equivalent of the more demanding relatedness requirement of the effects test.

Miller Yacht Sales, Inc. v. Smith, 384 F.3d 93, 99 (3d Cir. 2004) (emphasis added) (cleaned up).

Schnur incorrectly asserts that the “effects” test imposes a universally lower jurisdictional hurdle. As Miller Yacht demonstrates, it requires plaintiffs to show that the defendant “sufficiently directed his tortious conduct at the state,” id.—a burden that differs in key respects from the traditional test. Because specific jurisdiction is “claim specific,” Remick, 238 F.3d at 255, it is not uncommon for a court to dismiss intentional tort claims for want of jurisdiction under the “effects” test while finding jurisdiction proper as to other claims under the traditional test. See, e.g., id. at 256‒57, 260. In sum, the “effects” test may be more lenient in some respects and stricter in others, depending on the facts and claims at issue.

That said, we are skeptical of Defendants’ assertion that our precedents require courts to apply Calder’s “effects” test exclusively to intentional tort claims. As Plaintiffs note, the Supreme Court applied a traditional jurisdictional analysis in Keeton v. Hustler Magazine, Inc., which concerned libel claims. 465 U.S. 770, 772–81 (1984). The Keeton Court noted that the defendant had “circulate[ed] magazines throughout the state” and transacted “regular monthly sales of thousands of magazines” there. Id. at 774. The Court applied a traditional “minimum contacts” analysis and concluded that jurisdiction was proper in New Hampshire because plaintiffs’ claims were

11 “based on” the magazine’s sales and subscriptions in the state. Id.

Indeed, while we have often applied the Calder framework in assessing personal jurisdiction over intentional tortfeasors, we have stressed that “Calder [did not] carve out a special intentional torts exception to the traditional specific jurisdiction analysis.” IMO Indus., 155 F.3d at 265. And as Plaintiffs accurately note, the “effects” test has often been applied where the alleged tortfeasor has de minimis contacts with the forum, see Marten, 499 F.3d at 297, or where the tortious conduct occurs primarily “outside the forum” but has an “effect . . . within the forum,” IMO Indus., 155 F.3d at 261. In any case, we agree with the District Court that Schnur’s complaint fails under both tests.

The District Court held that Schnur did not satisfy Calder’s “effects” test because he did not allege that Papa Johns expressly aimed Session Replay Code at Pennsylvania. We agree. Schnur alleged that Papa Johns “knowingly armed [its] website with software that initiates a broad-spectrum wiretap” and that this conduct “led to [his] lawsuit being filed.” Dist. Ct. Dkt. No. 31, at 10. But Schnur did not allege that Papa Johns’ website is accessible only in Pennsylvania, that the company deploys Session Replay Code only to users who access the site while in Pennsylvania, or that the website tailors its content in any meaningful way to Pennsylvanians. Rather, Schnur admits that Papa Johns targets a “national audience” “to drive customers to its website.” Schnur App. 39. And we, like several sister courts, have held that a defendant does not expressly target a forum merely by operating a website that is accessible there—even when the plaintiff alleges harm in that

12 forum arising out of his engagement with that website.

For instance, in Remick, a Pennsylvania plaintiff asserted intentional tort claims against an out-of-state website operator for posting a photo of the plaintiff on the site without permission. See 238 F.3d at 259. We reasoned that the “effects test’ [was] clearly not satisfied” because “the website was intended to provide information on [the defendant] and . . . was accessible worldwide.” Id. So “there [was] no basis to conclude that the defendants expressly aimed their allegedly tortious activity at Pennsylvania knowing that harm was likely to be caused there.” Id. Our reasoning in Remick applies to Schnur’s claims here.

By contrast, courts have found express aiming where, unlike here, the website is “targeted at a particular jurisdiction.” Toys, 318 F.3d at 452 (cleaned up). Such targeting can be evidenced by content bearing a particular nexus to that forum or location-specific advertisements. See Advanced Tactical Ordnance Sys., LLC v. Real Action Paintball, Inc., 751 F.3d 796, 803 (7th Cir. 2014); Shrader v. Biddinger, 633 F.3d 1235, 1241 (10th Cir. 2011). For example, in Mavrix Photo, Inc. v. Brand Techs., Inc., the Ninth Circuit held that California had specific jurisdiction over a Florida- based celebrity photo website that had “specific[ally] focus[ed] on the California-centered celebrity and entertainment industries” and featured photos of Californians. 647 F.3d 1218, 1230 (9th Cir. 2011). The Ninth Circuit took a contrary view in a copyright infringement case brought by a California plaintiff against a foreign pornography website. See AMA Multimedia, LLC v. Wanat, 970 F.3d 1201 (9th Cir. 2020). The court contrasted the California-centric content in Mavrix with the pornography website, determining that the latter “lack[ed] a forum-specific focus” because “the market for adult content

13 is global.” Id. at 1210 (cleaned up).

The distinctions made by the Ninth Circuit in these cases support the District Court’s dismissal order here. Schnur neither alleged that Papa Johns’ website advertises a product or service bearing any special significance to Pennsylvania, nor that it features Pennsylvania-centric content. Indeed, pizza has national appeal. 2 So Papa Johns did not expressly aim its Session Replay Code at Pennsylvania by operating a website that was accessible in the forum.

Our conclusion is not undercut simply because, as Schnur alleges, Papa Johns: (1) deployed Session Replay Code into the forum and harmed Pennsylvanians there; (2) allows website users to filter restaurant locations geographically; and (3) operates 85 restaurants and conducts other business activities in the Commonwealth.

First, we assume, as Schnur claims, that the alleged wiretapping occurred on browsers in Pennsylvania. Cf. Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121, 131–32 (3d Cir. 2022). And we have held “the exercise of personal jurisdiction over a nonresident” for “an allegedly tortious act committed within the forum . . . conforms with due process.” Carteret Sav. Bank, FA v. Shushan, 954 F.2d 141, 148 (3d Cir. 1992). But while

2 Pizza “is recognized as a high consumption food . . . of public significance in the American diet” with “13% of the U.S. population . . . consum[ing] pizza on any given day.” Donna G. Rhodes et al., Dietary Data Brief No. 11—Consumption of Pizza, Nat’l Library of Med. (2014), https://perma.cc/R5F7- MBPZ.

14 Schnur argues “Papa Johns purposefully entered Pennsylvania and knowingly wiretapped its customers there,” he did not allege that the transmission of Session Replay Code onto his browser constituted a physical entry into the forum. Reply Br. 13. Even if he had, “intentional torts . . . committed via the Internet or other electronic means” “present . . . . very different questions [of] whether and how a defendant’s virtual ‘presence’ and conduct translate into ‘contacts’ with a particular State.” Walden v. Fiore, 571 U.S. 277, 290 n.9 (2014). So we decline to hold that Papa Johns’ use of Session Replay Code constitutes a physical entry into Pennsylvania sufficient to support the exercise of jurisdiction.

We also reject the argument that Papa Johns expressly targeted Pennsylvania simply because the data interception allegedly occurred in the forum. “[T]he effects test prevents a defendant from being haled into a jurisdiction solely because the defendant intentionally caused harm that was felt in the forum state if the defendant did not expressly aim [its] conduct at that state.” Marten, 499 F.3d at 297 (emphasis added). And we are not persuaded that transmitting computer code to a browser that happens to be in Pennsylvania is an intentional physical entry into the forum sufficient to establish express aiming under Calder. Cf. Carefirst of Maryland, Inc. v. Carefirst Pregnancy Ctrs., Inc., 334 F.3d 390, 401 (4th Cir. 2003) (Defendant “did not . . . direct electronic activity into [the forum] with the manifest intent of engaging in business or other interactions within that state in particular” by “set[ting] up its generally accessible, semi-interactive Internet website.”) (emphasis added).

At a minimum, Schnur had to allege that Papa Johns knew that a given user was in Pennsylvania before it sent the code to that user’s browser. See Rosenthal v.

15 Bloomingdales.com, LLC, 101 F.4th 90, 98 (1st Cir. 2024). The First Circuit recently held that Massachusetts did not have personal jurisdiction over an out-of-state department store chain for similar wiretapping claims. Though the court did not analyze the plaintiff’s allegations under Calder, it concluded that specific jurisdiction was not proper because, inter alia, the plaintiff failed to prove that “Bloomingdales purposefully deployed [Session Replay Code] to intentionally target users in Massachusetts” or that “Bloomingdales knew that it was targeting [the plaintiff] in Massachusetts” at the time of the alleged wiretapping. Id. at 97 (cleaned up). We conclude that Schnur’s allegations fail to satisfy Calder’s express aiming prong for similar reasons. Schnur did not allege that Papa Johns knows that a given user is in Pennsylvania before the code is dispatched to his browser or that Papa Johns specifically sends the code because the user is located in Pennsylvania. Rather, Schnur alleged that Session Replay Code was sent to his browser the instant he accessed Papa Johns’ website. He did not allege that Papa Johns knew that he was in Pennsylvania and subsequently deployed the code based on that knowledge.

And while Schnur asserts that Papa Johns’ collection of users’ geolocation data shows that the company “inevitab[ly] . . . knows it is capturing . . . the [w]ebsite [c]ommunications of Pennsylvania residents,” Schnur App. 42, “ultimately learn[ing]” of the Plaintiffs’ location after the fact does not, in this case, satisfy the “effects” test’s “intentionality requirement,” Toys, 318 F.3d at 454–55 nn. 5, 6. Because “Calder requires more,” a “defendant accused of an intentional tort” is not “subject to personal jurisdiction in the plaintiff’s home state as soon as the defendant learns what that state is.” Mobile Anesthesiologists Chicago, LLC v. Anesthesia Assocs. of Houston Metroplex, P.A., 623 F.3d 440, 447 (7th Cir. 2010).

16 Furthermore, Papa Johns did not expressly aim Session Replay Code at Pennsylvania simply by permitting web users to search for nearby restaurants. Schnur did not allege that this feature is “exclusively available to people in [Pennsylvania]” or that Session Replay Code is deployed only to users who search for Pennsylvania locations. Bryan v. United States, 2017 WL 781244, at *10 (D.V.I. Feb. 28, 2017), aff’d, 913 F.3d 356 (3d Cir. 2019). Nor did he allege that users who filter for Pennsylvania locations receive uniquely forum-centric content. See Mavrix, 647 F.3d at 1230. So Papa Johns’ “Find Your Store” filter does not constitute express aiming at Pennsylvania. Cf. Fidrych v. Marriott Int’l, Inc., 952 F.3d 124, 143 (4th Cir. 2020) (website’s state “drop-down menu[] d[id] not[] . . . strengthen [defendant’s] jurisdictionally relevant connections”); NexLearn, LLC v. Allen Interactions, Inc., 859 F.3d 1371, 1378 (Fed. Cir. 2017) (same).

Finally, Papa Johns’ in-forum business activities, including its operation of 85 restaurants, do not establish that the company expressly aimed its Session Replay Code at Pennsylvania. “[T]he Calder ‘effects test’ can only be satisfied if the plaintiff can point to contacts which demonstrate that the defendant expressly aimed its tortious conduct at the forum, and thereby made the forum the focal point of the tortious activity.” IMO Indus., 155 F.3d at 265 (emphasis added). As Schnur admits, Session Replay Code would have wiretapped him regardless of whether he purchased pizza via the website, so Papa Johns’ other commercial activities do not demonstrate express aiming under Calder. For example, in Wanat, the Ninth Circuit held that a website operator’s “other contacts with the [forum],” including service contracts with in-forum users, “fail[ed] to establish express aiming” because the plaintiff’s suit “d[id] not allege violations of the” contracts.

17 970 F.3d at 1212. Simply stated, Papa Johns’ other in-forum commercial activities—operating restaurants and selling pizza—do not show that it expressly aimed Session Replay Code at Pennsylvania.

For all these reasons, the District Court did not err when it held that Schnur failed to plead facts sufficient to render Papa Johns amenable to personal jurisdiction in Pennsylvania under the Calder “effects” test. 3

B

Schnur also contends that jurisdiction over Papa Johns is proper under the traditional test as articulated in Ford Motor. That test requires Schnur to show that Papa Johns “purposefully avail[ed] itself of the privilege of conducting activities” in Pennsylvania and that his claims “arise out of or relate to the defendant’s contacts with the forum.” Ford Motor, 592 U.S. at 359 (cleaned up). There is no doubt that Papa Johns purposefully availed itself of the Pennsylvania market. As Schnur alleged, Papa Johns “maintains approximately 85 brick-and-mortar locations in Pennsylvania and regularly markets and advertises its goods and services within Pennsylvania.” Schnur App. 29. It also regularly “conducts business with [Pennsylvania] residents” to sell pizza and other products “via [its] [web]site.” Toys, 318 F.3d at 452.

But Schnur’s complaint founders at step two, which

3 Because we conclude that Schnur failed to satisfy Calder’s “express aiming” prong, we need not address whether Schnur adequately pled that he suffered the brunt of the alleged harm in Pennsylvania. See Marten, 499 F.3d at 297.

18 requires a “strong relationship among the defendant, the forum, and the litigation.” Hepp, 14 F.4th at 208 (citing Ford Motor, 592 U.S. at 364). As the District Court held, Schnur’s complaint lacks “a specific connection between Pennsylvania, Papa Johns, and the deployment of Session Replay Code on [Papa Johns’] website.” Schnur, 2023 WL 5529775, at *5.

To be sure, whether Schnur’s claims “arise out of or relate to” Papa Johns’ activities in Pennsylvania is a close call. Ford Motor, 592 U.S. at 359 (citation omitted). As the Supreme Court recently clarified, while “[t]he first half of that standard asks about causation . . . the back half . . . contemplates that some relationships will support jurisdiction without a causal showing.” Id. at 362. And “[t]he degree of relatedness required in a given case is inversely proportional to the overall intensity of the defendant’s forum contacts.” O’Connor, 496 F.3d at 320 (cleaned up). At first glance, this would seem to tip the jurisdictional scales in Schnur’s favor given Papa Johns’ considerable contacts in Pennsylvania. But when we scrutinize those contacts in the context of Schnur’s wiretapping claims, we conclude that the “connection is too weak.” Hepp, 14 F.4th at 208.

Consider Ford Motor. In that case, Montana and Minnesota residents sued Ford in their respective states, alleging that defective Ford parts injured them. 592 U.S. at 356. Ford argued that the plaintiffs’ claims did not arise out of or relate to Ford’s contacts in those states because Ford had not designed, manufactured, or sold the defective vehicles in either state. Id. The Supreme Court disagreed, noting that “Ford had advertised, sold, and serviced those two car models in both States for many years” and “systematically served a market in [those states] for the very vehicles that the plaintiffs allege[d] malfunctioned and injured them in those States.” Id. at 365.

19 Those facts demonstrated the “strong relationship among the defendant, the forum, and the litigation” required for the state courts to exercise jurisdiction. Id. (cleaned up). The defendant, the forum, and the plaintiffs’ claims all shared a common link: defective Ford Explorers and Crown Victorias. As the Court stressed, Ford had, “at all relevant times,” sold, advertised, and serviced those models in Montana and Minnesota, the plaintiffs were injured by those models in those states, and the lawsuits arose out of the injuries caused by those models. Id. at 365.

In Schnur’s case, Papa Johns’ website is analogous to the defective vehicles in Ford Motor, and Session Replay Code is like the defective parts contained within those vehicles. And although Schnur alleged Papa Johns “heavily markets its online ordering platform in order to drive customers to its website,” which “is a central focus point of [its] business model,” Schnur App. 39, he did not allege any facts regarding the company’s promotion of its website in Pennsylvania. Cf. Johnson v. TheHuffingtonPost.com, Inc., 21 F.4th 314, 321 (5th Cir. 2021) (no jurisdiction over New York website in Texas because plaintiffs failed to show that the defendant “reached beyond the site to attract Texans to it” or “solicited Texan visits”) (emphasis added).

Schnur notes that Papa Johns aired a commercial during a Philadelphia Eagles’ Super Bowl game, but he did not allege that Papa Johns’ website was promoted or featured in the commercial. So unlike the plaintiffs in Ford Motor, Schnur’s complaint lacks a “strong relationship” between Pennsylvania and Papa Johns’ use of Session Replay Code. Ford Motor, 592 U.S. at 365 (cleaned up).

Furthermore, even if Papa Johns’ website allows

20 visitors to order food “from nearby stores[,] . . . including in Pennsylvania,” Schnur App. 39, we are not persuaded that the website’s accessibility in Pennsylvania establishes the strong connection between the forum and the litigation that Due Process requires, especially given the unique “doctrinal questions” that “internet transactions” raise. Ford Motor, 592 U.S. at 366 n.4. While the Ford Motor Court noted that the defective vehicle models were “available for sale” in Montana and Minnesota, it also emphasized Ford’s extensive marketing of those models in the two states through “billboards, TV and radio spots, print ads, and direct mail” and its efforts to maintain, service, and repair those models in those states. Id. at 365. Here, while Schnur details Papa Johns’ promotion of its products in Pennsylvania, he did not, as the Ford Motor plaintiffs did, allege facts regarding Papa Johns’ in-forum promotion of the device that allegedly harmed him—the website. 4

We do not hold, as the dissent suggests, that personal jurisdiction lies only where the out-of-state defendant’s forum activities closely resemble Ford Motor’s. See Dissent 4. But because the traditional test’s “relate to” requirement “incorporates real limits,” Schnur must offer facts regarding

4 Our dissenting colleague suggests that our holding hinges on the fact that Papa Johns has not advertised its website in Pennsylvania “to the same extent” that Ford advertised its vehicles in the forum states. Dissent 4. Not so. We simply note an important distinction between the two cases. While Ford Motor held that Ford’s extensive promotion of the harm- causing vehicles in the fora strengthened the connection among the defendant, the fora, and the litigation, Schnur does not allege that Papa Johns promoted its website in Pennsylvania.

21 Papa Johns’ efforts to specifically direct or connect Pennsylvanians to the alleged harm. Ford Motor, 592 U.S. at 362. And while the dissent correctly notes that the Supreme Court found jurisdiction proper over Ford Motor even though “Ford did not introduce the defective vehicles into the forum states[] and the claims related to actions that Ford took outside of the forum states,” Dissent 4, it overlooks the lengths the Court went to emphasize the many ways in which Ford promoted, serviced, and marketed the defective vehicle models in the fora. See id. at 365.

Our decision in Hepp is instructive as well. In that case, although a defendant had “targeted [its] advertising business to Pennsylvania” and sold merchandise to Pennsylvanians via its online store, we emphasized that “none of th[o]se contacts form[ed] a strong connection to [plaintiff’s] misappropriation of . . . likeness” claim. 14 F.4th at 208. We emphasized that the plaintiff “did not allege [that] the merchandise featured her photo,” or that the defendant “used her likeness to sell advertising.” Id. Likewise here, we conclude that Papa Johns’ in-state restaurant sales and marketing activities, as alleged in the complaint, are insufficiently related to Schnur’s wiretapping claims. In sum, we hold that Schnur’s complaint also fails under the traditional test. 5

5 We reject Schnur’s assertion that Herbal Brands, Inc. v. Photoplaza, Inc. compels us to reverse. See 72 F.4th 1085 (9th Cir. 2023), cert. denied, 144 S. Ct. 693 (2024). There, the Ninth Circuit held that Calder’s express aiming prong is satisfied “if

22 III

We turn next to the District Court’s order dismissing Hasson’s claims against FullStory and its order denying Hasson’s motion for jurisdictional discovery. We begin by noting that FullStory has fewer contacts with Pennsylvania than Papa Johns. FullStory is a Georgia software company with no Pennsylvania offices or employees. FullStory did, however, produce the Session Replay Code that allegedly wiretapped Hasson in Pennsylvania and received the data collected from his browsing session.

Hasson argues that Pennsylvania has specific personal jurisdiction over his wiretapping claims for several reasons. He notes that FullStory partnered with Pennsylvania companies whose websites are accessible there and other website

a defendant, in its regular course of business, sells a physical product via an interactive website and causes that product to be delivered to the forum.” Id. at 1093. We have not held that simply fulfilling an online sale and causing a product to be delivered in a forum suffices for personal jurisdiction. See id. at 1097 (noting the Third Circuit has “reached [a] different conclusion[] regarding whether sales to a plaintiff or its agents can be a source of jurisdiction”). In any event, Schnur’s case is distinguishable from Herbal Brands. There, Arizona plaintiffs sued the defendant for selling unauthorized products in that state via the internet. See id. at 1088–97. The court concluded that “Plaintiff’s claims . . . clearly ar[o]se out of and relate[d] to Defendants’ conduct of selling . . . products to Arizona residents.” Id. at 1096. But here, Schnur’s wiretapping claims neither involve a “physical” product nor arise out of (or relate to) Papa Johns’ brick-and-mortar operations in Pennsylvania.

23 operators who do business in the Commonwealth (like Mattress Firm). He also emphasizes that FullStory received communications intercepted from Pennsylvanians while they were in Pennsylvania and “commercializ[ed]” Pennsylvanians’ “geographical . . . data” by “sending [it] . . . to website operators in an analytically useful way.” Hasson Reply Br. 15. Hasson also argues that, because FullStory received users’ geolocation data, the company knows it is collecting communications from Pennsylvanians. He contends that all these contacts support the exercise of personal jurisdiction over FullStory under either the Calder test or the Ford Motor framework.

Starting with the Calder test, we agree with the District Court that FullStory did not expressly aim its allegedly tortious conduct at Pennsylvania. Hasson did not allege that Mattress Firm “intentionally targets [its] site to” Pennsylvania with forum-centric themes or ads. Toys, 318 F.3d at 452. And even had he done so, Hasson did not allege that FullStory knew about—or helped produce—any such forum-centric content. Indeed, if a retailer does not expressly target Pennsylvania merely by operating a website that is accessible there, neither does a software company simply by providing code for that website. Cf. Carefirst, 334 F.3d at 402 (no specific jurisdiction over Illinois company in Maryland “merely” because the company “utiliz[ed] servers owned by a Maryland-based company”). In short, FullStory did not expressly aim at Pennsylvania simply by providing code and other services to a Texas company whose website is accessible in the forum. See Remick, 238 F.3d at 259.

Nor are we persuaded that FullStory aimed its alleged

24 wiretapping at Pennsylvania just because it knew that Mattress Firm—or any other company it partnered with—conducted business in the forum or made its website accessible there. We have rejected the argument that “the ‘expressly aiming’ requirement is satisfied when the defendant is alleged to have engaged in wrongful conduct targeted at a plaintiff whom the defendant knows to be a resident of the forum state.” Budget Blinds, Inc. v. White, 536 F.3d 244, 264 (3d Cir. 2008) (cleaned up). Indeed, while a defendant’s “knowledge that the plaintiff is located in the forum is necessary to the application of Calder,” that “alone is insufficient to satisfy the targeting prong of the effects test.” IMO Indus., 155 F.3d at 266.

So Hasson had to do more than allege that FullStory “harmed him while he happened to be residing in Pennsylvania.” Marten, 499 F.3d at 299. He had to plead that FullStory “knew that . . . [he] would suffer the brunt of the harm caused by the tortious conduct in the forum.” Id. at 298 (emphasis added). But Hasson’s “allegations and evidence . . . do not affirmatively prove that [FullStory] knew that it was targeting him in” Pennsylvania when the code was dispatched to his browser. Rosenthal, 101 F.4th at 97. Hasson did not allege that FullStory knew that he—or any other user— was in Pennsylvania before Session Replay Code was dispatched to his browser. Compared to Papa Johns and Mattress Firm, FullStory is a degree removed from the alleged harm, as Mattress Firm’s website was responsible for “deliver[ing] session replay-enabling code to a user’s browser,” not FullStory. Hasson App. 29. Session Replay Code was sent to Hasson’s browser because of Mattress Firm’s decision to host the code on its website and Hasson’s decision to access the website while in Pennsylvania. But “jurisdiction over an out-of-state intentional tortfeasor must be based on

25 intentional conduct by the defendant that creates the necessary contacts with the forum,” not the “unilateral activity of a plaintiff,” Walden, 571 U.S. at 286 (emphasis added) (cleaned up), or a “third person,” Helicopteros, 466 U.S. at 417. We therefore conclude that the chain of events preceding Session Replay Code’s transmission to Hasson’s browser was too attenuated to satisfy that requirement.

We also reject that FullStory expressly aimed Session Replay Code at Pennsylvania simply because it knew, based on its collection of geolocation data, that the code was intercepting data from users there. As discussed above, a defendant’s post hoc discovery that the tortious conduct was received in the forum, without more, does not establish that the company “targeted (or “expressly aimed” [its] conduct at) the forum.” IMO Indus., 155 F.3d at 263; see Mobile Anesthesiologists, 623 F.3d at 447.

For these reasons, we agree with the District Court that Hasson’s complaint fails to establish that FullStory expressly aimed its alleged wiretapping at Pennsylvania. So we need not address whether the complaint satisfies Calder’s other prongs. See Marten, 499 F.3d at 297.

The District Court applied the Calder framework because Hasson alleged intentional torts. See Hasson, 2023 WL 4745961, at *2. But as Hasson persuasively argues, the “effects” test typically applies where the allegedly tortious conduct occurs outside the forum but is felt inside the forum. Here, by contrast, FullStory’s Session Replay Code allegedly wiretapped Hasson in Pennsylvania. Though we agree with its application of Calder, the District Court also should have

26 considered whether specific personal jurisdiction was proper under the traditional test as applied in Ford Motor. And while FullStory’s contacts with “other Pennsylvania clients who may be using [its] software” may be “irrelevant to establish[ing] specific jurisdiction” under Calder’s “express aiming” rubric, Hasson, 2023 WL 4745961, at *2, it is possible that Hasson’s claims “relate to” such contacts under the traditional test, Ford Motor, 592 U.S. at 362 (cleaned up).

As we noted above, in Ford Motor the Supreme Court emphasized that Ford had extensively advertised, sold, and serviced Explorers and Crown Victorias in the forum states. See id. at 355. Although those activities had no direct link to the specific vehicles that injured the plaintiffs, the Court held that those contacts still “relate[d] to” the plaintiffs’ claims because they involved the vehicle models that injured the plaintiffs. See id. at 361–66.

But rather than decide whether Hasson’s complaint alleges sufficient contacts to support jurisdiction under the traditional test, we will vacate and remand for the District Court to make this determination. 6 See Penguin Grp. (USA)

6 We reject FullStory’s contention that Hasson waived or forfeited his argument that the District Court should have applied the traditional test if it found jurisdiction lacking under Calder. Though Hasson noted in his opposition brief that the Supreme Court has articulated “an ‘effects test’” “[f]or specific jurisdiction in tort cases,” he did not argue that courts must apply only this test. Dist. Ct. Dkt. No. 34, at 5. Rather, he

27 Inc. v. Am. Buddha, 640 F.3d 497, 501 (2d Cir. 2011). In doing so, the District Court may consider whether FullStory’s other forum contacts—besides those related to Mattress Firm—alter its conclusion that litigating in the Western District of Pennsylvania “would place an undue burden upon FullStory” such that “[t]he interests of justice would not be served if FullStory were required to defend itself against this lawsuit in Pennsylvania.” Hasson, 2023 WL 4745961, at *3.

* * *

For the foregoing reasons, we will affirm the District Court’s order dismissing the case for lack of personal jurisdiction in Schnur v. Papa John’s Int’l, Inc., Appeal No. 23-2573. But we will vacate the order dismissing the case for lack of personal jurisdiction in Hasson v. FullStory, Inc., Appeal No. 23-2535, and remand for the District Court to apply the traditional test in accordance with Ford Motor. 7

argued that “jurisdiction is also proper under the traditional purposeful availment test.” Id. at 7 (typeface altered and capitalizations removed). 7 Because our decision addresses only personal jurisdiction, we do not consider Defendants’ other arguments that (1) Plaintiffs consented to the collection of their data when they visited the respective websites; and (2) that Plaintiffs’ allegations fail to state a claim under WESCA and the common law.

28 Hasson v. FullStory, Inc., No. 23-2535 & Schnur v. Papa John’s International, Inc., No. 23-2573

PHIPPS, Circuit Judge, concurring in part and dissenting in part.

I write separately with an observation about the Calder test and with an articulation of my dissenting position that Pennsylvania has specific personal jurisdiction over Papa Johns under the traditional test for the claims brought by Jordan Schnur.

1. Calder Sometimes Comes Up Short. I agree with the Majority Opinion that the Calder test for intentional torts is not met here. See Calder v. Jones, 465 U.S. 783 (1984). That test requires that the defendant aim the intentionally tortious conduct at the forum and that the brunt of the harm be experienced in that forum, see id. at 789, and here, neither Schnur nor Hasson sufficiently alleges that either Papa Johns or FullStory aimed their conduct at Pennsylvania. But there are limits to Calder: its test was developed in the context of a defamation claim in which allegedly false information from outside of the forum was transmitted into the forum. See id. at 785, 789–90. Unlike Calder, the claims in these cases are brought under Pennsylvania’s tort of intrusion upon seclusion and its wiretapping statute, 18 Pa. Cons. Stat. § 5725, and they concern the capture or extraction of information from the forum. Sometimes, the capture or extraction of data from the forum will also involve action aimed at the forum, and intentional-tort claims in those instances may satisfy the Calder test. See, e.g., MacDermid, Inc. v. Deiter, 702 F.3d 725, 730 (2d Cir. 2012) (holding that personal jurisdiction was proper in Connecticut after the defendant used her computer in Canada to access servers she knew to be in Connecticut to email herself files); CollegeSource, Inc. v. AcademyOne, Inc., 653 F.3d 1066, 1078–79 (9th Cir. 2011) (subjecting the defendant to personal jurisdiction in California for

1 misappropriating information from the website of a competitor it knew to be based in California). But other methods of capturing or extracting information from the forum, such as phishing, cloned websites, and spyware, may not necessarily be aimed at the forum, and if they are not, then they will not satisfy the Calder test. Although those types of capturing or extracting information may be equally as malicious and injurious to persons in the forum, a tortfeasor’s indifference to the location of the victim would prevent the exercise of personal jurisdiction under the Calder test. So as not to reward or incentivize such indifference by intentional tortfeasors and to allow states the opportunity to adequately protect their residents, courts, in developing personal-jurisdiction jurisprudence in a “common-law fashion,” J. McIntyre Mach., Ltd. v. Nicastro, 564 U.S. 873, 885 (2011) (plurality opinion), could recognize a conjugate to the Calder test that balances the interstate federalism principles underlying personal jurisdiction, see World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 293–94 (1980), with the due process considerations of “traditional notions of fair play and substantial justice,” Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945) (internal quotation omitted). Specifically, to hold accountable out-of-forum data pirates who seek to capture or extract data without regard to the location of its source, the companion doctrine would allow specific personal jurisdiction over intentional tort claims in which the brunt of the harm is experienced in the forum if data is captured or extracted from the forum – instead of requiring proof of aiming at the forum. While such a rule would likely result in Pennsylvania’s permissible exercise of personal jurisdiction over Papa Johns and FullStory in this case, neither Schnur nor Hasson has advocated for recognition of a companion doctrine to Calder.

2. Schnur’s Claims Against Papa Johns Satisfy the Traditional Test. My lone disagreement with the Majority Opinion is with respect to its holding that Schnur’s claims do not satisfy the traditional test for specific personal jurisdiction. Even so, I

2 take no issue with the Majority Opinion’s conclusion on the first prong of the traditional test, viz., that Papa Johns has formed contacts with and “‘purposefully availed’ itself of engaging in activity in” Pennsylvania through its website and the 85 physical storefronts that it uses to fulfill orders from that website. Toys “R” Us, Inc. v. Step Two, S.A., 318 F.3d 446, 451–52 (3d Cir. 2003); see also Burger King Corp. v. Rudzewicz, 471 U.S. 462, 475 (1985). But as to the second prong of the traditional test, see Bristol-Myers Squibb Co. v. Sup. Ct. of Cal., 582 U.S. 255, 262 (2017), I disagree with the conclusion that Schnur’s claims do not relate to those contacts that Papa Johns had with Pennsylvania. Rather, for those claims, there is a “strong ‘relationship among the defendant, the forum, and the litigation.’” Ford Motor Co. v. Mont. Eighth Jud. Dist. Ct., 592 U.S. 351, 366 (2021) (quoting Helicopteros Nacionales de Colom., S.A. v. Hall, 466 U.S. 408, 414 (1984)). As to the defendant, Papa Johns, it offers online ordering in Pennsylvania, uses a session replay code to record those orders, and sells pizzas ordered online from its restaurants located in Pennsylvania. The forum, Pennsylvania, is where Schnur used his browser to access Papa Johns’ website, which through the session replay code, recorded his ordering behavior. It is also where the fulfillment of the online order would take place by one of Papa Johns’ stores. The litigation complains of and seeks redress for the use of the session replay code to record Schnur’s online behavior while using his browser in Pennsylvania to access Papa Johns’ website to consider placing an order from one of Papa Johns’ stores in Pennsylvania. See Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121, 131 (3d Cir. 2022) (explaining that a wiretap occurs where the browser reroutes the communication). As I see it, the strong relationship is clear: the common thread between the defendant, the forum, and the litigation is Papa Johns’ use of a session replay code on its website to record online consumer activity from a browser in Pennsylvania that was used to place orders from Papa Johns’ locations in Pennsylvania.

3 In reaching a different conclusion, the Majority Opinion argues through analogy that this case differs from Ford Motor. It likens Papa Johns’ website to the vehicles at issue in Ford Motor and the session replay code to defective parts. From there, it reasons that because Papa Johns has not advertised its website in Pennsylvania to the same extent that Ford advertised its vehicles in the forum states, there must be a lack of the requisite strong relationship among Papa Johns, Pennsylvania, and Schnur’s claims. Embedded in that reasoning is the assumption that the strong relationship required by Ford Motor can be demonstrated only by facts closely akin to those in Ford Motor – a suit against an out-of-state manufacturer that advertises a product in the forum and has physical locations in the forum to service and supply the parts for the product, see Ford Motor, 592 U.S. at 365–66. But by articulating the strong relationship test in general terms, the Supreme Court did not limit it to any particular factual scenario. So, even if Papa Johns’ contacts with Pennsylvania are not factually analogous to those that Ford had with the forum states in that case, it could still be that the strength of Papa Johns’ other contacts with Pennsylvania coupled with the different claims brought by Schnur are enough to satisfy the traditional test.

And as recounted above, the relationship here, while not factually analogous to the one in Ford Motor, is stronger than the relationship in that case. There, Ford did not introduce the defective vehicles into the forum states, and the claims related to actions that Ford took outside of the forum states – the sale, design, and manufacture of the vehicles. See id. at 354. By contrast, Papa Johns chose to use its website to make sales in Pennsylvania, used the session replay code in Pennsylvania, and Schnur’s claims are based on Papa Johns’ recording his website behavior on his browser in Pennsylvania, see Popa, 52 F.4th at 131. With a much tighter nexus among the defendant, the forum, and the litigation, there is no need here, as there was in Ford Motor, for additional contacts with the forum, such as through advertising of the website or product

4 support of the website, to sustain the requisite strong relationship.

For these reasons, I believe that the traditional test for establishing specific personal jurisdiction is met with respect to Schnur’s claims against Papa Johns, and I respectfully dissent in part.