IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF PENNSYLVANNIA
ASHLEY POPA, Plaintiff, Civil Action No. 2:19-cv-00450-WSS V. Hon. William S. Stickman IV HARRIET CARTER GIFTS, INC. et al., Defendants.
MEMORANDUM OPINION WILLIAM S. STICKMAN IV, District Judge Since the advent of online behavioral advertising (“OBA”) in the late 1990s, businesses have become increasingly adept at tracking users visiting their websites. E.g., Symposium, Vincent Toubiana et al., Adnostic: Privacy Preserving Targeted Advertising, NETWORK AND DISTRIBUTED SYSTEM SECURITY SYMPOSIUM 1, 1 (2010), https://www.ndss-symposium.org/wp- content/uploads/2017/09/toub.pdf. Electronic tracking has given rise to lawsuits under various wiretap and electronic surveillance statutes. These cases require courts to apply the general terms of the respective statutes to the developing technology of electronic tracking and surveillance in the context of electronic commerce and web-browsing. This is one of those cases. Plaintiff Ashley Popa’s (“Popa”) Amended Complaint (ECF No. 38) alleges that Defendants unlawfully collected her data while she shopped online. Defendant Harriet Carter Gifts, Inc. (“HCG”) is the owner of the website where Popa was shopping. Defendant Navistone Inc. (“Navistone”) is the third party who allegedly collected her data on HCG’s website. Both Defendants filed Motions to Dismiss. (ECF Nos. 42, 45). Navistone separately requested judicial
notice of the privacy policy published on HCG’s website. Navistone’s Request for Judicial Notice in Support of its Motion to Dismiss (ECF No. 43) (“Navistone’s Request for Jud. Notice”) at p. 1. The Court holds that it cannot, at this time, determine whether Popa’s Amended Complaint fails to plead a legally cognizable claim at Count I. The Court will deny the Motions to Dismiss as to Count I without prejudice to Defendants’ right to reassert their defenses after discovery develops a more complete factual record which better contextualizes Defendants’ alleged conduct in light of the claims asserted and the applicable law. Defendants’ Motions to Dismiss Count I will be granted because Popa cannot maintain her claim in light of the facts pled in her Amended Complaint. Navistone’s Request for Judicial Notice will be denied. FACTUAL AND PROCEDURAL BACKGROUND HCG is a gift merchant incorporated in Pennsylvania. Navistone is an Ohio company that tracks Internet Protocol (“IP”) addresses of visitors on its customers’ websites to procure commercially relevant information like names and mailing addresses. It stores the data on a server in Ohio. HCG contracted with Navistone to collect data from traffic on its website. HCG has an internet privacy policy disclaiming user tracking on its website, but the policy discloses neither Navistone’s identity nor its modus operandi for obtaining user data. Popa’s Amended Class Action Complaint (ECF No. 38) (“Popa’s Am. Compl.”) at pp. 4-8, 4 14-30. According to Popa, Navistone intercepted her Personal Identifiable Information (“PII”)'— her name, her residential address, and her email address——as she browsed HCG’s website for pet products. Popa pleads that Navistone recorded and relayed her every keystroke and mouse click
' PII can be defined as “information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.” Rules and Policies — Protecting PII — Privacy Act, GEN. SERV. ADMIN., https://www.gsa.gov/reference/gsa-privacy-program/rules-and-policies-protecting-pii- privacy-act (last visited on Sept. 25, 2019, 4:04 p.m.).
back to its server. She alleges that Navistone collected Popa’s data even though she never hit the “submit” button to make a purchase. Popa’s Am. Compl. at pp. 8-15, #9 31-74. On March 8, 2019, Popa, on her own behalf and as class representative, filed a two-count Complaint in the Court of Common Pleas of Lawrence County, Pennsylvania, alleging a violation of Pennsylvania’s wiretap statute (Count I) and an invasion of privacy—intrusion upon seclusion (Count I). Class Action Complaint (ECF No. 1-2) (‘Popa’s Compl.”) at p. 1. On April 18, 2019, Defendants filed a Notice of Removal, alleging diversity jurisdiction. Defendants’ Notice of Removal of Action under 28 U.S.C. § 1332, 1446(a) and 1453 (ECF No. 1) (“Def.’s Notice of Removal”) at p. 1. On June 24, 2019, Popa filed an Amended Complaint. Popa’s Am. Compl. at p. 1, 4 1. Defendants filed Motions to Dismiss on July 22, 2019. Navistone Inc.’s Motion to Dismiss First Amended Class Action Complaint Pursuant to F.R.C.P. 12(b)(6) (ECF No. 42) (‘“Navistone’s Mot. to Dismiss”) at p. 1; Harriet Carter Gifts, Inc.’s Motion to Dismiss Plaintiffs Amended Complaint (ECF No. 45) (‘“HCG’s Mot. to Dismiss”) at p. 1. The matter is now ripe for disposition. STANDARD OF REVIEW A motion to dismiss filed pursuant to Federal Rule of Civil Procedure 12(b)(6) tests the legal sufficiency of the complaint. Kost v. Kozakiewicz, 1 F.3d 176, 183 Gd Cir. 1993). A plaintiff must allege sufficient facts that, if accepted as true, state a claim for relief that is plausible on its face. See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007); see also Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A court must accept all well-pled factual allegations as true and view them in the light most favorable to the plaintiff. See Fowler v. UPMC Shadyside, 578 F.3d 203, 210 (3d Cir. 2009); see also DiCarlo y. St. Marcy Hosp., 530 F.3d 255, 262-63 (3d Cir. 2008).
The “plausibility” standard required for a complaint to survive a motion to dismiss is not akin to a “probability” requirement, but asks for more than sheer “possibility.” Jgbal, 556 U.S. at 678 (citing Twombly, 550 U.S. at 556). In other words, the complaint’s factual allegations must be enough to raise a right to relief above the speculative level, on the assumption that all the allegations are true even if doubtful in fact. Twombly, 550 U.S. at 555. Facial plausibility is present when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendants are liable for the misconduct alleged. Iqbal, 556 U.S. at 678. Even if the complaint’s well-pled facts give rise to a plausible inference, that inference alone will not entitle the plaintiff to relief. Jd at 682. The complaint must support the inference with facts to plausibly justify that inferential leap. Id. Generally, a court may not consider extraneous documents when considering a motion to dismiss. In re Burlington Coat Factory Sec. Litig., 114 F.3d 1410, 1426 (Gd Cir. 1997). Ifmatters outside the pleadings are presented to and not excluded by a court at a motion to dismiss, the motion must be treated as a motion for summary judgment. See Fed. R. Civ. P. 12(d). However, when reviewing the sufficiency of a complaint, a court may consider exhibits attached to it, which are incorporated within the complaint, without converting the motion into one for summary judgment. See In re Burlington, 114 F.3d at 1426 (A court may consider a “document integral to or explicitly relied upon in the complaint.” (citations omitted)); ALA, Inc. v. CCAIR, Inc., 29 F.3d 855, 859 (Gd Cir. 1994) (same); Fallon v. Mercy Catholic Medical Center of Southeastern Pennsylvania, 877 F.3d 487, 493 (3d Cir. 2017) (same); Fed. R. Civ. P. 10(c) (‘A copy ofa written instrument that is an exhibit to a pleading is a part of the pleading for all purposes.”); see also Pension Ben. Guar. Corp. v. White Consol. Indus., Inc., 998 F.2d 1192, 1196 (d Cir. 1993)
(holding that a court may consider an “undisputedly authentic document that a defendant attaches as an exhibit to a motion to dismiss if the plaintiffs claims are based on the document.”). “TA] motion to dismiss may be granted only if, accepting all well-pleaded allegations in the complaint as true and viewing them in the light most favorable to the plaintiff, a court finds that plaintiff's claims lack facial plausibility.” Warren Gen. Hosp. v. Amgen Inc., 643 F.3d 77, 84 (3d Cir. 2011). Although this Court must accept the allegations in the Complaint as true, it is “not compelled to accept unsupported conclusions and unwarranted inferences, or a legal conclusion couched as a factual allegation.” Baraka v. McGreevey, 481 F.3d 187, 195 (3d Cir. 2007) (citations omitted). ANALYSIS Count I of Popa’s Amended Complaint alleges that Defendants violated the Pennsylvania Wiretapping and Electronic Surveillance Control Act of 1978 (““WESCA”) Pub. L. 831, No. 164 (codified as amended at 18 Pa. C.S.A. §§ 5701 et seq.). Count II alleges that Defendants committed tortious intrusion upon seclusion. Defendants respond that this action should be dismissed for failure to state claims for which relief can be granted.” For the reasons set forth below, the Court will exercise subject matter jurisdiction over this matter. The Court denies Defendants’ Motions to Dismiss as to Count I, and it grants Defendants’ Motions to Dismiss as to Count II.
? HCG’s brief adopts by reference all Navistone’s filings. The Court will treat Navistone’s filings as representative of both parties’ positions. See Memorandum in Support of Defendant Harriet Carter Gifts, Inc.’s Motion to Dismiss Plaintiff's Amended Complaint (ECF No. 46) (“HCG’s Mem. in Supp.”) at p. 2.
I. Subject Matter Jurisdiction The Court must preliminarily address whether it ought to exercise jurisdiction. The Class Action Fairness Act (““CAFA”) of 2005 expanded the Court’s jurisdiction over class action lawsuits. Pub. L. 109-2, 119 Stat. 4-14 (codified as amended at 28 U.S.C. § 1332(d)). Section 1332(d) provides that the Court has subject matter jurisdiction over class action lawsuits when the amount in controversy exceeds $5,000,000.00, there are at least one hundred members of the putative class, and there is minimum diversity. 28 U.S.C. § 1332(d)(1)-(2). Popa is a citizen of Pennsylvania and represents a putative class of 5,001 visitors to HCG’s website. Every member of the putative class is a citizen of Pennsylvania. Popa seeks $1,000.00 in statutory damages per class member, punitive damages, and reasonable attorneys’ fees under 18 PA. C.S.A. § 5725(a). Every member of the putative class and HCG are citizens of Pennsylvania. Navistone is a citizen of Ohio. Thus, the amount in controversy, class size, and minimum diversity requirements are apparently satisfied. See Def.’s Notice of Removal at pp. 2-3, 4] 5. The Court declines to exercise discretionary remand permissible under Section 1332(d)() of CAFA because over two-thirds of the putative class are citizens of Pennsylvania. See 28 U.S.C. § 1332(d)(3). The Court also declines to remand this case under the locality exception set forth in Section 1332(d)(4). All the requirements that would warrant mandatory remand are satisfied save one. Section 1332(4)(A)(ii) states that “during the 3-year period preceding the filing of that class action, no other class action has been filed asserting the same or similar factual allegations against any of the defendants on behalf of the same or other persons. ...” 28 U.S.C. § 1332(4)(A)(@i). Defendants assert that there were at least six other class actions asserting similar factual allegations against Navistone nationwide in the past three years. Def.’s Notice of Removal at p. 3, { 6 (citing cases). These actions only involved Navistone, not HCG. There is a question, therefore, of whether
mandatory remand is required when there are actions in the past three years against less than all defendants. In Davenport v. Lockwood, Andrews & Newnam, Inc., 854 F.3d 905, 909 (6th Cir. 2017), one of multiple defendants had been sued in five previous class actions, therefore, the United States Court of Appeals for the Sixth Circuit determined that the local controversy exception did not apply. The Court finds Davenport instructive. The local controversy exception does not apply here for the same reason. Several plaintiffs with factually similar allegations sued Navistone during the last three years. Thus, CAFA authorizes the Court to exercise jurisdiction and it will do so. II. Count I—Violation of the Pennsylvania Wiretap Statute Popa’s first claim in her Amended Complaint is that Defendants violated WESCA. Popa’s Am. Compl. at p. 12, §§ 53-66. For the following reasons, the Court will deny Defendants’ Motions to Dismiss as to this claim. A, Application of WESCA to the conduct alleged in the Amended Complaint There is a threshold question of whether WESCA applies to the conduct of Defendants complained of by Popa. This is necessary because Navistone is located in Ohio and there is a question as to where the allegedly actionable conduct can be said to have occurred. If WESCA does not apply, Popa’s claims thereunder must fail. Thus, the Court must examine the applicability of WESCA where there is out-of-state conduct. Several Pennsylvania courts have addressed the extraterritorial application of WESCA. In Larrison vy. Larrison, 750 A.2d 895 (Pa. Super. 2000), the Pennsylvania Superior Court refused to extend WESCA to out-of-state conduct. It considered whether WESCA was implicated where a telephone conversation made from the Commonwealth was recorded in New York without the
knowledge and permission of the Pennsylvania caller. The Superior Court declined to extend WESCA to conduct occurring out of state, holding that: “we, as the courts of this Commonwealth, have no power to control the activities that occur within a sister state... Pennsylvania has no state interest in a recording of a telephone conversation placed in New York, even if the recording is later used in the Pennsylvania Courts.” Larrison, 750 A.2d at 898. Likewise, in Ball v. Ehlig, 70 Pa.D.&C.4" 160 (Ct. Common Pls. Montgomery Cty., Pa. 2005) and Broughal v. First Wachovia Corp., 14 Pa. D. & C. 4th 525 (Ct. Common Pls. Northampton Cnty., Pa. 1992), Pennsylvania Courts of Common Pleas refused to bestow extraterritorial effect on WESCA. In each of those cases, as in Larrison, the interception of the telephone calls at issue occurred in a different state. Pennsylvania courts refuse to extend WESCA to out-of-state intercepts. This Court will follow suit.? The next question that the Court must consider is where the actionable conduct occurred. Cases involving telephone calls are easy—the call is placed from one location and recorded in another. Here, the actionable conduct is collecting online consumer data. Determining where the
3 Under the Erie doctrine, this Court is obligated to apply the law of the Commonwealth of Pennsylvania. It is established that “[iJn the absence of a controlling opinion from a state’s highest court on an issue of state law, [federal courts] typically predict how that state court would decide the issue.” Pacific Employers Insurance Co. v. Global Reinsurance Corp. of America, 693 F.3d 417, 433 (d. Cir. 2012). “When predicting state law, we can give due regard, but not conclusive effect, to the decisional law of lower state court. But the opinions of intermediate appellate state courts are not to be disregarded by a federal court unless it is convinced by other persuasive data that the highest court of the state would decide otherwise.” Jd. at 433 (internal citations omitted). Where state law controls, Federal District Courts should apply the same rules of decision as their state court counterparts. This avoids forum shopping and gives due respect to coordinate judicial systems. Here, the Court recognizes that the Pennsylvania Supreme Court has not spoken on the issue of WESCA’s extraterritorial effect. However, the Court holds that the decision of the Superior Court in Larrison expresses the law of the Commonwealth on this issue. That decision would be binding in one of Pennsylvania’s Courts of Common Pleas and will be followed here.
intercept occurred in a scenario involving interstate data traffic and storage is not as straight forward as plotting the location of parties to a telephone call. The Amended Complaint, as well as the parties’ submissions on the Motion to Dismiss, do not provide the Court with the factual and technical background necessary to determine where the allegedly actionable conduct occurred. Did it occur in Pennsylvania, where HCG is located and where Plaintiff viewed the HCG website? Or did it occur in Ohio where Navistone and its servers are located? These are questions of fact. Only after a factual record is developed on these points can the Court determine whether WESCA applies to the conduct alleged at Count I of the Amended Complaint. As such, the Motions to Dismiss will be denied as to Count I and the parties will be provided the opportunity to develop the necessary factual record in discovery. B. Failure to State a Claim In addition to the threshold issue of whether WESCA applies, Defendants raised several substantive arguments for dismissal. They contend: 1) Defendants were direct parties to the communications, 2) neither HCG’s server nor Navistone’s code are “devices” under WESCA, 3) there was mutual consent, and 4) Popa’s allegation that “contents” were intercepted is implausible. Navistone’s Br. in Supp. pp. at 9-16; HCG’s Mem. in Supp. at pp. 2-3. Although the Court is denying the Motions to Dismiss as to Count I so that the parties can build a factual record on the extraterritorial application of the statute, the Court will briefly examine some of the substantive defenses to provide the parties with guidance as to questions that may be encountered on further dispositive motions or as this case proceeds to trial.4
4 The Court recognizes that, in light of its denial of the Motions to Dismiss based on the threshold applicability issue, its examination of the substantive issues raised by Defendants is dicta. While courts should generally avoid engaging in dicta, it may be useful in cases where, as here, issues are likely to reappear in later filings and/or after the disposition of a threshold issue. By briefly examining these issues, the Court hopes that the parties can focus their discovery efforts
1. Device or Apparatus Intercepting the Communication Defendants argue that HCG’s servers and Navistone’s code are not “devices,” and therefore their conduct does not fall within the sweep of WESCA. Navistone’s Br. in Supp. at p. 11. To the extent that this issue will be raised again, the Court believes that it warrants deeper factual exploration than was available at the motion to dismiss stage. WESCA defines the term “device” broadly, Any device or apparatus, including, but not limited to, an induction coil or a telecommunication identification interception device, that can be used to intercept a wire, electronic or oral communication other than: (1) Any telephone or telegraph instrument, equipment or facility, or any component thereof, furnished to the subscriber or user by a provider of wire or electronic communication service in the ordinary course of its business, or furnished by such subscriber or user for connection to the facilities of such service and used in the ordinary course of its business, or being used by a communication common carrier in the ordinary course of its business, or by an investigative or law enforcement officer in the ordinary course of his duties. (2) A hearing aid or similar device being used to correct subnormal hearing to not better than normal. (3) Equipment or devices used to conduct interceptions under section 5704(15) (relating to exceptions to prohibition of interception and disclosure of communications). 18 PA. C.S.A. § 5702. The term “electronic communication” is defined as “any transfer of signs, signals, writing, images, sounds, data or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photo-optical system....” Jd. Different
accordingly so that, if raised again, there is an adequate factual record for the Court to use in its consideration. 10
components of the same statutory scheme are construed in pari materia. 1 PA. C.S.A. § 1932; Stivason y. Timberline Post & Beam Structures Co., 947 A.2d 1279 (Pa. Super. 2008) (citing Com. v. Mayhue, 639 A.2d 421, 439 (Pa. 1994)). The relationship between these two definitions is critical to the analysis. The use of the word “any” before the phrase “device or apparatus” in Section 5702 implies that the class of technology contemplated by WESCA is broad. Compare Any, OXFORD ENGLISH DICTIONARY (3d ed. 2016), https://www.oed.com/view/Entry/8973 ?redirected From=any#eid (“With singular noun in affirmative contexts, frequently with emphatic force: used to refer to a member of a particular group or class without distinction or limitation (hence implying every member of the class or group, since every one may in turn be taken as a representative).”), with St. Ignatius Nursing Home v. Dep’t of Pub. Welfare, 918 A.2d 838 (Pa. Comwlth. 2007) (“Moreover, in ascertaining the common and approved usage or meaning of a word, we may resort to the dictionary.”). So too for the kinds of “electronic communications” that are within WESCA’s purview. Id. Exceptions to WESCA’s definition of “devices” must be construed narrowly and none of them seemingly apply here. Compare 1 PA. C.S.A. § 1924 (“Exceptions expressed in a statute shall be construed to exclude all others.”), with 18 PA. C.S.A. §§ 5702, 5704(15) (identifying three inapplicable exceptions to the definition of “devices.”). For example, neither HCG’s server nor Navistone’s code can be tossed aside under the telephone exception. Com. v. Diego, 119 A.3d 370, 375 (Pa. Super. 2015) (“The Spence decision did not in any way broaden the telephone exception to the definition of what constitutes an “electronic, mechanical, or other device” under the Wiretap Act.” (citing Com. v. Spence, 91 A.3d 44 (Pa. 2014)).
While the statutory definitions of “device” and “electronic communication” are broad, they are not limitless. They may or may not include the type of electronic data collection complained of by Popa. To prevail on a claim under WESCA, it is Popa’s burden to prove that the allegedly actionable conduct falls under the purview of the statute. The nature of the conduct involved makes it less than clear at this stage. Indeed, whether the interplay between Defendants’ servers and Navistone’s code qualifies as a “device” or “apparatus” is a fact intensive inquiry that implicates novel questions. The discovery process will give the parties an opportunity to develop a record that contextualizes the conduct at issue in light of this statutory language. 2. Consent to the Interception Defendants argue that mutual consent bars Popa’s WESCA claim. Navistone’s Br. in Supp. at pp. 12-14. They chiefly rely on Commonwealth v. Proetto, 771 A.2d 823 (Pa. Super. 2001), for the proposition that the act of sending an electronic communication over the internet implies consent to it being recorded. The Proetto court emphasized the difference between telephonic communications and internet activity: This situation is unlike one in which a party is engaging in a conversation over the telephone. While engaging in a conversation over the telephone, a party would have no reason to believe that the other party was taping the conversation. Any reasonably intelligent person, savvy enough to be using the Internet, however, would be aware of the fact that messages are received in a recorded format, by their very nature, and can be downloaded or printed by the party receiving the message. By the very act of sending a communication over the Internet, the party expressly consents to the recording of the message. Proetto, 771 A.2d at 829. Defendants’ argument is that because Popa used HCG’s website, she voluntarily exposed her identity. This is a legal argument that the Court will not address at this stage.
Defendants also argue at length that the privacy policy on HCG’s website (the “Privacy Statement”) imputes consent to the allegedly actionable conduct and, thus, precludes Popa’s WESCA claim. A court must consider the scope of the alleged consent when evaluating a privacy statement. Opperman v. Path, Inc., 84 F. Supp. 3d 962, 992 (N.D. Cal. 2015) (citing In re Yahoo Mail Litig., 7 F. Supp. 3d 1016, 1028 (N.D. Cal. 2014)). Even if a privacy statement discloses some kinds of tracking, a defendant can still be liable for other kinds of tracking that the privacy statement does not disclose. Jd. at 1028 & n.17 (“Here, in sum, the Court does not find it implausible that, while App users were aware that “Find Friends’-type features would scan the address book information stored on their iDevices for the sole purpose of finding friends, they were not aware that those features and the Apps with which they were associated used their address book information in other, unauthorized ways.”). As the United States Court of Appeals for the Ninth Circuit noted in Neuyen v. Barnes & Noble Inc., 763 F.3d 1171, 1175 (9th Cir. 2014), there are two predominant types of privacy contracts formed on the internet: clickwrap agreements and browserwrap agreements. Clickwrap agreements require users to click on an “I agree” box after being presented with the terms and conditions of visiting the site. Browserwrap agreements, on the other hand, do not require affirmative consent. They simply provide the website’s terms of use on a particular page or at the bottom of a screen. Courts consistently enforce browserwrap agreements when users have actual notice. Jd. at 1176 (citing Register.com, Inc. v. Verio, Inc., 356 F.3d 393, 401 (2d Cir. 2004); then citing Sw. Airlines Co. v. Boardfirst, L.L.C., Civ. Action No. 3:06-cv-0891-B, 2007 4823761, at (N.D. Tex. Sept. 12, 2007); and then citing Ticketmaster Corp. v. Tickets.Com, Inc., No. CV997654HLHVBKX, 2003 WL 21406289, at *1 (C.D. Cal. Mar. 7, 2003)). If there is no evidence of actual knowledge, the validity of a browserwrap agreement turns on whether the
website put a reasonably prudent user on inquiry notice of its terms. Jd. at 1177 (citing Specht v. Netscape Commcn’s Corp., 306 F.3d 17, 30 (2d Cir. 2002)). The content of a webpage and agreement page determines whether a defendant adequately provides inquiry notice. Jd. (citing Be In, Inc. v. Google, Inc., Case No.: 12-cv-03373-LHK, 2013 WL 5568706, at *1 (N.D. Cal. Oct. 9, 2013)). The Privacy Statement at issue here appears to be a browserwrap agreement. See id. at 1176; Harriet Carter Privacy Statement (ECF No. 27-2) (“HCG Privacy Statement”) at pp. 2-5. Popa takes issue with the fact that the Privacy Agreement never explicitly states that user PII is being collected in real time by embedded Navistone code. Popa’s Br. in Opp. to Navistone’s Mot. to Dismiss at p. 12. The code is not visible on the website. Popa’s Am. Compl. at pp. 3, 7, {€ 13, 26 (citing Surya Mattu & Kashmir Hill, Before You Hit ‘Submit,’ This Company has Already Logged Your Personal Data, GIZMODO (June 20, 2017, 2:23 p.m.), https://gizmodo.com/before- you-hit-submit-this-company-has-already-logge-1795906081). Whether the agreement provided actual notice or inquiry notice are important questions of fact. Neither Defendant adequately briefed these sub-issues nor proffered compelling evidence that can justify dismissal based on “mutual consent” at this stage. On a similar note, Popa made no allegations about her actual or constructive knowledge of the Privacy Statement. Compare Garcia v. Enterprise Holdings, Inc., 78 F. Supp. 3d 1125, 1137 (N.D. Cal. 2015) (“In this case, there are no allegations in the pleadings regarding Plaintiff's actual or constructive knowledge of Zimride's Privacy Policy.”), with Popa’s Br. in Opp. to Navistone’s Mot. to Dismiss at p. 12 (“Nowhere in that section, or anywhere else in the Privacy Statement, does Harriet Carter inform online customers that their keystrokes, navigation, and other private information is being collected
in real-time by a third party using embedded code.”). The Court cannot determine if Defendants afforded Popa actual or inquiry notice without a more developed record and additional briefing. 3. Interception of “Contents” of Popa’s Communication Defendants also argue that Plaintiff's WESCA claim cannot stand because they did not intercept the contents of any communication. Defendants identify two categories of data that Popa purportedly shared by visiting the HCG website: the PII she entered into form fields on the website, as well as her clicks and keystrokes as she navigated the site. Their response is twofold. First, they contend that Popa never entered PII into a form field on HCG’s website to begin with, therefore, they cannot be culpable for “intercepting” it. Second, they contend that they cannot be liable for recording Popa’s other clicks and keystrokes because data associated with her navigating the HCG website is not “content” for the purposes of WESCA. Navistone’s Br. in Supp. at pp. 14-15. Whether Navistone intercepted and transmitted Popa’s data, including PII, to its server in Ohio is ultimately a question of fact the Court will not rule on at this stage. Compare Navistone’s Br. in Supp. at pp. 14-15 (alleging no PII was intercepted), with Popa’s Br. in Opp. to Navistone’s Mot. to Dismiss at p. 13 (alleging that Navistone’s code intercepted Popa’s PII entered in the form fields on HCG’s website). Furthermore, the Court is not disposed to rule on whether any of it constituted “content” under WESCA as a matter of law at this juncture. The Court will be better equipped to do so after a record is developed that places the alleged conduct of Defendants into context vis-a-vis the nature of “content” for a claim under WESCA. I. Count Il—Intrusion Upon Seclusion Count II of Popa’s Amended Complaint asserts a common law intrusion upon seclusion claim against the Defendants. For the following reasons, the Court holds that Popa cannot maintain
such a claim in light of the facts pled and will, therefore, dismiss Count II of her Amended Complaint. Choice of law on Count II of Popa’s Amended Complaint is a non-issue. Both Ohio and Pennsylvania follow the Second Restatement of Tort’s formulation of intrusion upon seclusion. Compare Burger v. Blair Med. Assocs., 964 A.2d 374, 379 & n.5 (Pa. 2009) (adopting the final draft of the Second Restatement of Torts formulation of privacy torts), and Vogel v. W. T. Grant C., 327 A.2d 133, 135-36 & n.9 (Pa. 1974) (approving a tentative draft of the Second Restatement of Torts formulation of privacy torts), with Sustin v. Fee, 431 N.E.2d 992, 993-94 (Ohio 1982) (following Second Restatement of Torts’ definition of intrusion upon seclusion); see also O’Donnell v. United States, 891 F.2d 1079, 1083 (3d Cir. 1989) (“Pennsylvania courts have consistently followed the Restatement in this area of tort law.”).> As there is no conflict, the Second Restatement’s definition of intrusion upon seclusion applies. Section 652 of the Second Restatement provides: One who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person. RESTATEMENT (SECOND) OF TORTS § 652B (Am. Law Inst. 1972). Defendants raise two arguments in support of dismissal. First, Defendants argue that they lacked the requisite intent to
> This Court has previously stated that the Pennsylvania Supreme Court has not adopted the Second Restatement of Tort’s definition of intrusion upon seclusion. In doing so, it relied on a similar statement by the Superior Court of Pennsylvania. Gabriel v. Giant Eagle, Inc., 124 F. Supp. 3d 550, 571 (W.D. Pa. 2015) (citing Tagouma vy. Investigative Consultant Svcs., Inc., 4 A.3d 170, 174 (Pa Super. 2010)); see also Muhammad v. United States, 884 F. Supp. 2d 306, 317 (E.D. Pa. 2012) (relying on a Third Circuit decision from 1989 “predicting” how the Pennsylvania Supreme Court would define the tort of intrusion upon seclusion.”’). The Superior Court’s decision, however, never referenced the Supreme Court of Pennsylvania’s decision applying the Second Restatement’s definition of intrusion upon seclusion in Burger, 964 A.2d at 379 & n.5 (Pa. 2009). The Supreme Court of Pennsylvania adopted the Second Restatement’s definition in Burger. 16
commit intrusion upon seclusion. Second, Defendants contend that their conduct was not highly objectionable to a reasonable person. A, Intentional Conduct The relevant portion of Popa’s Amended Complaint pled the intent element as follows: ‘Defendants intentionally intruded on Plaintiffs and class members’ private life [sic], seclusion, or solitude, without consent.” Popa’s Am. Compl. at p. 14, § 72. “Intent,” as the word is used in Section 8A of the Second Restatement, denotes “that the actor desires to cause consequences of his act, or that he believes that the consequences are substantially certain to result from it.” RESTATEMENT (SECOND) OF TORTS, supra, at 8A. The Supreme Court of Pennsylvania has yet to define “intent” in the context of intrusion upon seclusion. The Third Circuit has predicted, however, that the Supreme Court of Pennsylvania would find intent apparent when an alleged tortfeasor believes or is substantially certain that he lacks legal or personal permission to commit an intrusive act. O’Donnell v. United States, 891 F.2d 1079, 1083 (3d Cir. 1989). Federal cases engaging intrusion of seclusion allegations in the realm of digital privacy have found that intent of one party turns on the consent of the other. Jn re Nickelodeon Consumer Privacy Litig., 827 F.3d 262, 293-94 & n.198 (3d Cir. 2016) (citing Gabriel 124 F. Supp. 3d at 572; then citing Muhammad v. United States, 884 F. Supp. 2d 306, 317 (E.D. Pa. 2012); and then citing Jevic v. Coca Cola Bottling Co. of N.Y., No. 89-cv-4431 (NHP), 1990 WL 109851, at **1, 9 (D.N.J. June 6, 1990)). Hence the maxim, “[O]ne cannot intrude when one has permission.” Jevic, 1990 WL 109851, at
Popa asserts that both Defendants tracked her online activity without her permission. Popa’s Am. Compl. at p. 14, § 72. The question of consent turns on the nature and implications of the privacy statement on the HCG website. As explained above, this issue cannot be determined
without factual development. Thus, the Court cannot dismiss Popa’s intrusion upon seclusion claim for failure of the “intent” element. B. Highly Objectionable Conduct Defendants’ last contention is that their conduct was not highly objectionable to a reasonable person. Navistone’s Br. in Supp. at p. 19. Popa’s Amended Complaint alleges, to the contrary, that Defendants’ conduct was “highly objectionable to a reasonable person and constitut[ed] an egregious breach of social norms underlying the privacy right.” Popa’s Am. Compl. at p. 14, § 73. The ubiquity of cookies,° in Defendants’ view, renders the tracking it allegedly employed inoffensive and unobjectionable. As an initial matter, the Court may, taking all of the Amended Complaint’s averments as true, determine whether Popa has sufficiently pled highly objectionable conduct sufficient to maintain a claim for invasion upon seclusion as articulated by the Restatement. See Jn re Nickelodeon Consumer Privacy Litig., 827 F.3d at 295 n.205 (“courts may decide the “highly offensive” issue as a matter of law at the pleading stage when appropriate”). Indeed, there are numerous cases from state and federal courts examining claims under Section 652B of the Restatement where the courts determine that, as pled, a complaint failed to aver sufficiently objectionable conduct to permit a claim to stand. In In re Nickelodeon Consumer Privacy Litig., the Third Circuit held that allegations of consumer tracking through a third party’s (Google’s) use of cookies were not offensive enough to
6 “37 | cookie: a small file or part of a file stored on a World Wide Web user's computer, created and subsequently read by a website server, and containing personal information (such as a user identification code, customized preferences, or a record of pages visited).” Cookie, MERRIAM WEBSTER’S DICTIONARY, https://www.merriam-webster.com/dictionary/cookie (last visited Oct. 31, 2019, 9:54 a.m.). 18
survive a motion to dismiss.’ Jd. Plaintiffs did not challenge the defendant’s proposition that the use of cookies was generally acceptable—they merely argued that using cookies to track children was highly offensive. The Third Circuit rejected the distinction, holding: As Google fairly points out, courts have long understood that tracking cookies can serve legitimate commercial purposes. The plaintiffs do not challenge the proposition that the use of cookies on websites geared toward adults is generally acceptable, instead falling back on the claim that the use of cookies to track children is particularly odious. We are not so sure. Google used third-party cookies on Nick.com in the same way that it deploys cookies on myriad other websites. Its decision to do so here does not strike us as sufficiently offensive, standing alone, to survive a motion to dismiss. Id. at 294—95 (internal citations omitted). The Pennsylvania Superior Court provided guidance on the type of conduct that may be considered sufficiently offensive as to give rise to an actionable claim for invasion of seclusion. The invasion must be “of the sort which would cause mental suffering, shame or humiliation to a person of ordinary sensibilities.” Chicarella v. Passant, 494 A.2d 1109, 1114 (Pa. Super. 1985) (quoting Hull v. Curtis Publishing Co., 125 A.2d 644, 646 (Pa. Super. 1956) (emphasis added)). An examination of cases where courts have found that the parties did not plead sufficiently offensive conduct are illustrative of the extreme nature of the conduct needed to establish an invasion of privacy claim. In Chicarella, the Superior Court held that private investigators did not commit a sufficiently offensive intrusion into the plaintiffs privacy where they obtained his hospital records and disclosed them to his opponent in personal injury litigation. Similarly, in McNemar v. The
Inre Nickelodeon Consumer Privacy Litig. was decided under New Jersey law. It is instructive here, though, because like Pennsylvania, New Jersey uses the formulation for invasion of privacy articulated by Second Restatement Section 652B. 19
Disney Store, Inc., 91 F.3d 610, 622 (3d. Cir. 1996), the court held that a co-worker’s inquiry of the plaintiff's HIV status was not “highly offensive to a reasonable person.” The Pennsylvania Superior Court’s decision in Nagy v. Bell Telephone Co. of PA, 436 A.2d 701 (Pa. Super. 1981) is more analogous to this case. In Nagy, the plaintiffs sued the defendant telephone company for disclosing numbers dialed from their line to a third party—the estranged husband of the plaintiff wife’s sister. Because her sister was in hiding for her own safety, the plaintiff wife contacted the telephone company and specifically “requested that the records of the telephone calls made from the plaintiff’ s telephone, including telephone numbers, not be disclosed to third parties.” Jd at 702. Despite the demand for privacy, the estranged husband of wife- plaintiffs sister “deliberately persuaded” a Bell employee to reveal the long-distance numbers called from the plaintiffs’ telephone in order to locate the telephone number of his estranged wife. The Superior Court held that, even in the context of that case, the disclosure to a third party of a list of telephone numbers called from a certain subscriber’s telephone was not the type of highly offensive or objectionable conduct that could lead to tort liability. It noted that a tortious invasion of privacy must be committed “in such a manner as to outrage or cause mental suffering, shame or humiliation to a person of ordinary sensibilities,” and that the defendant’s alleged conduct fell far short of the standard. Id. at 704—0S (citations omitted). Popa alleges that Navistone intercepted her name, residential address, and email address as she browsed HCG’s website. Popa pled that Navistone recorded and relayed her every keystroke and mouse click back to its server. She also alleges that Navistone collected her data even though she never hit the “submit” button to make a purchase. Popa’s Am. Compl. at pp. 8-15, {J 31-74. The Court holds that Popa has failed to plead a substantial and highly offensive intrusion and cannot, therefore, maintain a claim for invasion of privacy.
The act of collecting Popa’s keystrokes, mouse clicks, and PII is simply not the type of highly offensive act to which liability can attach. The surreptitious gathering of this type of information may cause concern, even deep concern, about electronic privacy. Consumers may be troubled that their trip to an electronic marketplace may feature surveillance of their every behavior that is far more intrusive than a trip to the local mall, and that the data garnered from even causal browsing may be used by retailers—and others—for marketing or more sinister purposes. But even well-founded concern is not enough to give rise to tort liability. Such liability requires conduct that may outrage or cause mental suffering, shame or humiliation to a person of ordinary sensibilities. Popa has not alleged any such conduct. As such, she has not pled a cognizable claim at Count IT. CONCLUSION AND NOW, this 6" day of December 2019, IT IS HEREBY ORDERED that Navistone Inc.’s Motion to Dismiss First Amended Class Action Complaint Pursuant to F.R.C.P. 12(b)(6) (ECF No. 42) and Harriet Carter Gifts, Inc.’s Motion to Dismiss Plaintiff's Amended Complaint (ECF No. 45) are DENIED as to Count | and GRANTED as to Count II. It is further ORDERED that Navistone’s Request for Judicial Notice in Support of its Motion to Dismiss (ECF No. 43) is DENIED.
WILLIAM S.STICKMANIV UNITED STATES DISTRICT JUDGE