Malinda Smidga v. Spirit Airlines Inc

Opinion

NOT PRECEDENTIAL

UNITED STATES COURT OF APPEALS FOR THE THIRD CIRCUIT

________________

No. 24-1757

________________

MALINDA A. SMIDGA,

KAYLA MANDENG,

FRANCES CURD,

individually and on behalf of all others similarly situated, Appellants

v.

SPIRIT AIRLINES, INC.

________________

Appeal from the United States District Court for the Western District of Pennsylvania (D.C. No. 2:22-cv-01578)

District Judge: Honorable Marilyn J. Horan

________________

Submitted under Third Circuit L.A.R. 34.1(a)

on September 11, 2025

Before: CHAGARES, Chief Judge, PORTER and ROTH, Circuit Judges (Opinion filed: May 26, 2026)

________________

OPINION *

________________

*

This disposition is not an opinion of the full Court and pursuant to I.O.P. 5.7 does not constitute binding precedent.

ROTH, Circuit Judge Appellants Malinda Smidga, Frances Curd, and Kayla Mandeng, as representatives for class action members, filed a class action against Spirit Airlines, Inc. (Spirit) for its alleged use of a third-party software, Session Replay Code (SRC), to record and intercept the communications of its website visitors. The District Court granted Spirit’s motion to dismiss for lack of subject matter jurisdiction, finding that the class representatives failed to establish an injury-in-fact necessary for standing to file suit. Because Appellants’ allegations do not support their claim that they suffered concrete injury to their privacy interests, we conclude that the District Court is correct. We will therefore affirm the District Court’s dismissal, but modify its order, so that the dismissal will be without prejudice.

I. 1

Appellants—hailing from Pennsylvania (Smidga), Maryland (Curd), and California (Mandeng)—each visited Spirit’s website to browse flights. Only Mandeng purchased flight tickets through the website, and she specifically alleged that she inputted the names, addresses, and ages of herself and her children when doing so. Appellants brought a consolidated amended complaint (First Consolidated Amended Complaint), claiming that unbeknownst to website users, Spirit’s SRC recorded the users’ interactions with the

1 Because we write for the parties, we recite only those facts necessary to our disposition.

3

website in real time, including text entries, mouse clicks, and geolocation. 2 Spirit filed a motion to dismiss under Federal Rule of Civil Procedure 12(b)(1) for lack of standing, and attached a declaration of Spirit’s Senior Vice President and Chief Information Officer disputing Appellants’ allegations that Spirit uses the relevant software to collect personal information from site visitors. 3 The declaration specified that Spirit has “never enabled” the software functions that could be used to collect such information and that any data Spirit collects is “not traceable to any specific [w]ebsite user.” 4 The District Court dismissed the complaint with leave to request jurisdictional discovery and again amend the complaint. Appellants did neither. The District Court then dismissed the complaint with prejudice, and this appeal followed.

2 The operative complaint brought claims for (i) violation of the Pennsylvania Wiretap Act; (ii) invasion of privacy and intrusion upon seclusion in violation of Pennsylvania law; (iii) violation of the Maryland Wiretap Act; (iv) invasion of privacy and intrusion upon seclusion in violation of Maryland law; (v) violation of the California Invasion of Privacy Act; (vi) violation of California’s statutory larceny provision; (vii) violation of California’s Unfair Competition Law; (viii) trespass to chattels; and (ix) conversion of chattels. 3 In the alternative, Spirit argued Appellants failed to state a claim under Federal Rule of Civil Procedure 12(b)(6). 4 Appendix (Appx.) at 149 ¶¶ 3–4.

4

II. 5

To establish Article III standing, plaintiffs must show: (i) that they suffered an “injury in fact;” (ii) a “causal connection between the injury and the conduct complained of,” where the injury is “fairly traceable to the challenged action of the defendant, and not the result of the independent action of some third party not before the court;” and (iii) a likelihood that the injury will be “redressed by a favorable decision.” 6 An “injury in fact” must be concrete even where the alleged harm, as here, is intangible. 7 In this circumstance, we consider “whether the asserted harm has a ‘close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit in American courts[.]” 8 Our recent holding in Cook v. GameStop, Inc. 9 plainly resolves Appellants’ standing challenge. There, we found that GameStop’s use of SRC to collect information about an individual’s interactions with its website did not constitute an intangible injury. 10 While our analysis in Cook applies to the nearly identical arguments Appellants advance, we

5 The District Court had jurisdiction under 18 U.S.C. § 1332(d)(2). We have appellate jurisdiction under 28 U.S.C. § 1291. When reviewing dismissals for lack of standing, we exercise de novo review and accept “the facts alleged in the complaint as true” while “construing the complaint in the light most favorable to the non-moving party.” Barclift v. Keystone Credit Servs., LLC, 93 F.4th 136, 141 (3d Cir. 2024) (cleaned up). An abuse of discretion standard applies in reviewing the District Court’s dismissal of the complaint with prejudice. United States ex rel. Zizic v. Q2Administrators, LLC, 728 F.3d 228, 234 (3d Cir. 2013). 6 Lujan v. Defenders of Wildlife, 504 U.S. 555, 560–61 (1992) (cleaned up). 7 Spokeo, Inc. v. Robins, 578 U.S. 330, 340 (2016). 8 Barclift, 93 F.4th at 145 (quoting TransUnion LLC v. Ramirez, 594 U.S. 413, 417 (2021)). 9 148 F.4th 153 (3d Cir. 2025). 10 Id. at 162.

5

briefly explain why Appellants have not met their burden to establish a concrete injury necessary to confer standing under Article III.

First, neither of the comparator torts Appellants raise—disclosure of private information and intrusion upon seclusion—share a “close relationship” to the harm alleged in the complaint. Smidga and Curd do not allege that Spirit’s SRC collected their personal information, and although Mandeng claims she inputted personal information when using Spirit’s website, the tort of disclosure of private information requires an allegation of resulting embarrassment or humiliation, which the complaint lacks. 11 Similarly, the complaint falls short for an intrusion upon seclusion claim. Such a claim requires allegations that Spirit, through its SRC software, intentionally disturbed Appellants’ private affairs or concerns. 12 Yet Appellants voluntarily provided the information on Spirit’s website in order to browse flights, the “private” information Spirit allegedly intercepted was completely anonymized, and in any event, “[m]ost of us understand that what we do on the Internet is not completely private.” 13 For standing purposes, Appellants’ conclusory claims that Spirit recorded their website communications are at most an attempt to fit a square peg into a round hole.

Second, Appellants’ contention that violations of privacy statutes confer standing misconstrues both our precedent and the Supreme Court’s holding in TransUnion.14 Appellants are correct that Congress may “elevate” injuries that were “previously

11 Cook, 148 F.4th at 159. 12 Borse v. Piece Goods Shop, Inc., 963 F.2d 611, 622 (3d Cir. 1992). 13 In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 266 (3d Cir. 2016). 14 TransUnion, 594 U.S. at 426–27.

6

inadequate in law” to the “status of [a] legally cognizable injur[y];” 15 however, TransUnion instructs us to focus on the “concrete harm” as alleged by Appellants instead of “the statutory cause of action.” 16 Appellants also cite a handful of our pre-TransUnion holdings in which we found that the unlawful collection of plaintiffs’ electronic data caused concrete harm. These cases are distinguishable, as we based our holdings not on the relevant statutory violations, but on the plaintiffs’ specific allegations that the defendants intentionally and, in some cases, deceptively tracked and then disclosed their non- anonymous, personal information without authorization. 17 Here, Appellants’ allegations do not indicate such unauthorized dissemination.

Finally, we are hard-pressed to find that a de facto invasion of privacy exists where a website makes no express promise to refrain from collecting site visitors’ information. 18 As we explained in Cook, there is a material difference between an allegation that a website merely failed to ask for visitors’ consent to data collection and an allegation that a website

15 Appellants’ Br. at 24 (citing In re Horizon Healthcare Servs. Data Breach Litig., 846 F.3d 625, 637 (3d Cir. 2017); TransUnion, 594 U.S. at 425). 16 TransUnion, 594 U.S. at 426–27. 17 See, e.g., Cook, 148 F.4th at 162 (explaining that Nickelodeon, 827 F.3rd at 274 and In re: Google Inc. Cookie Placement Consumer Priv. Litig., 934 F.3d 316, 321 (3d Cir. 2019)—two cases that Appellants rely on—were “not controlling” because the allegations “materially” differed). 18 Id.

7

expressly promised it would not collect information but secretly did so anyway. 19 The complaint contains no allegations that Spirit made such a promise.

III.

Our precedent also resolves Appellants’ second challenge regarding the District Court’s consideration of the declaration submitted alongside Spirit’s 12(b)(1) motion. Appellants allege they have standing because they suffered concrete harm from Spirit’s collection, aggregation, and use of personal information through the SRC software. Spirit’s declaration directly challenges the possibility of such harm occurring, as it attests that Spirit’s SRC has never recorded or otherwise collected personal information from site visitors. “When a factual challenge is made, the plaintiff will have the burden of proof that jurisdiction does in fact exist, and the court is free to weigh the evidence and satisfy itself as to the existence of its power to hear the case.” 20 Indeed, “no presumptive truthfulness attaches to the plaintiff’s allegations.” 21 Appellants failed to request any discovery to respond to Spirit’s clear factual challenge after the District Court provided the opportunity to do so, and the District Court properly found that their “boilerplate averments” alone could not rebut Spirit’s external evidence. 22 As such, the District Court did not err in considering the declaration when determining whether Appellants had sufficient standing.

19 Id. The plaintiff there only alleged that “GameStop [did] not ask website visitors . . . for prior consent before” collecting web browsing activity, while in Nickelodeon, 827 F.3d at 269, the defendant’s website gave the following assurance to parents registering their children for online accounts: “We don’t collect ANY personal information about your kids . . . we couldn’t share it even if we wanted to!” Id. 20 Davis v. Wells Fargo, 824 F.3d 333, 346 (3d Cir. 2016) (cleaned up). 21 Id. (cleaned up). 22 Appx. at 10.

8

Still, because we have recognized that “dismissals ‘with prejudice’ for lack of [Article III] standing are generally improper” and should instead be “without prejudice,” 23 we will modify the District Court’s order to dismiss the amended complaint without prejudice.

III.

For the foregoing reasons, we affirm as modified the District Court’s dismissal of the First Amended Consolidated Complaint.

23 Cook, 148 F.4th at 163; Barclift, 93 F.4th at 148.