Popa v. PSP Group LLC

Opinion

1 2

3 4 5 6 7 UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON 8 AT SEATTLE

9 10 ASHLEY POPA, CASE NO. C23-0294JLR 11 Plaintiff, ORDER v. 12 PSP GROUP, LLC, et al., 13 Defendants. 14

16 Before the court are motions to dismiss filed by Defendants PSP Group, LLC, 17 doing business as Pet Supplies Plus (“PSP”) and Microsoft Corporation (“Microsoft”) 18 (together, “Defendants”). (PSP Mot. (Dkt. # 54); PSP Reply (Dkt. # 66); MSFT Mot. 19 (Dkt. # 55); MSFT Reply (Dkt. # 65).) Plaintiff Ashley Popa opposes both motions. 20 (PSP Resp. (Dkt. # 64-11); MSFT Resp. (Dkt. # 63).) The court has considered the 21

1 Ms. Popa filed a praecipe to correct certain errors in her original response. (Praecipe 22 (Dkt. # 64).) 1 motions, all materials submitted in support of and in opposition to the motions, and the 2 governing law. Being fully advised,2 the court GRANTS PSP’s motion to dismiss;

3 DISMISSES this matter for lack of subject matter jurisdiction; and DENIES Microsoft’s 4 motion to dismiss as moot. 6 This case is one of dozens of proposed class actions being litigated in federal 7 courts across the country challenging the use of “Session Replay Code” to record, save, 8 analyze, and replay internet users’ interactions with consumer websites.3 In this case,

9 Ms. Popa alleges that PSP has “procure[d] third-party vendors” to embed Session Replay 10 Code on its website, www.petsuppliesplus.com, 11 for the purpose [of] intercepting and recording the website visitor’s electronic communications with the PSP website, including their mouse 12 movements, clicks, keystrokes (such as text being entered into an information field or text box), URLs of web pages visited, and/or other 13 electronic communications in real-time.

14 (Am. Compl. (Dkt. # 26) ¶¶ 1-4.) Ms. Popa describes the use of Session Replay Code as 15 “the electronic equivalent of ‘looking over the shoulder’ of each visitor to the PSP 16 website for the entire duration of their website interaction.” (Id. ¶ 5; see also id. ¶¶ 28-47 17

18 2 Defendants and Ms. Popa request oral argument. (PSP Mot. at 1; PSP Resp. at 1; MSFT Mot. at 1; MSFT Resp. at 1.) The court, however, concludes that oral argument would 19 not be helpful to its disposition of the motion. See Local Rules W.D. Wash. LCR 7(b)(4).

20 3 See, e.g., In re Zillow Grp., Inc. Session Replay Software Litig., No. C22-1282JLR (W.D. Wash.); Mikulsky v. Noom, Inc., No. 3:23-cv-00285-H-MSB (S.D. Cal.); Valenzuela v. Keurig Green Mountain Inc., No. 3:22-cv-09042-JSC (N.D. Cal.); Adams v. PSP Grp., LLC, No. 21 4:22-cv-1210-RLW (E.D. Mo.); Cook v. GameStop, Inc., No. 2:22-cv-1292 (W.D. Pa.); Straubmuller v. Jetblue Airways Corp., No. 8:23-cv-00384-DKC (D. Md.); Massie v. Gen. 22 Motors LLC, No. 1:21-cv-00787-RGA (D. Del.). 1 (describing, in general terms, how Session Replay Code works).) One of the third-party 2 Session Replay Code vendors that PSP has “procured” is Microsoft, which, according to

3 Ms. Popa, has provided its Session Replay Code system, Clarity, “to a vast number of 4 website clients.” (Id. ¶ 6; see also id. ¶¶ 53-62 (describing, in general terms, how Clarity 5 operates and Clarity’s data-collection capabilities).) According to Ms. Popa, “[d]ata 6 collected by Clarity is . . . stored in the Microsoft Azure cloud service, and Microsoft has 7 access to that information.” (Id. ¶ 62.) 8 Ms. Popa alleges that she visited www.petsuppliesplus.com “and certain of its

9 subpages” while in Pennsylvania. (Id. ¶ 63.) During her visits to the website, she 10 “brow[s]ed for pet supplies,” and “communicated with PSP’s website by using her mouse 11 to hover and click on certain products.” (Id. ¶ 66.) While she engaged in these 12 interactions, Clarity was “operative on PSP’s website and subpages” and 13 “instantaneously captured” her communications with the website without her knowledge

14 or consent. (Id. ¶¶ 65, 67-68.) Ms. Popa does not describe what information, if any, she 15 shared on PSP’s website, nor does she allege that she made any purchases using the 16 website. (See generally id. ¶¶ 63-81 (describing “Plaintiff’s and Class Members’ 17 Experience” with PSP’s website).) Although she alleges that “if a user enters their 18 address for delivery, that information is captured by Microsoft Clarity embedded on the

19 website,” Ms. Popa does not allege that she entered her own address during her visits to 20 PSP’s website. (Id. ¶ 69; see id. ¶¶ 63-66 (describing Ms. Popa’s interactions with the 21 website).) Ms. Popa includes in her amended complaint, however, a screenshot 22 “[d]epicting information sent to” Microsoft through Clarity “after entering an address to a 1 text box.” (Id. ¶ 69.) The screenshot shows that address information sent to Microsoft 2 through Clarity is redacted to include only the street, city, state, and country entered in

3 the text box—it does not include the street number or zip code. (Id.) 4 Ms. Popa filed her original complaint in the United States District Court for the 5 Western District of Pennsylvania on September 22, 2022. (Compl. (Dkt. # 1).) She 6 amended her complaint on February 7, 2023. (Am. Compl.) Ms. Popa alleges claims on 7 behalf of herself and two proposed Pennsylvania classes against PSP and Microsoft for 8 violation of the Pennsylvania Wiretapping and Electronic Surveillance Control Act

9 (“WESCA”), 18 Pa. Cons. Stat. § 5701 et seq. (Am. Compl. ¶¶ 94-131) and for “invasion 10 of privacy – intrusion upon seclusion” under Pennsylvania common law (id. ¶¶ 132-59 11 (capitalization altered); see also id. ¶ 85 (proposed class definitions)). On February 27, 12 2023, the Western District of Pennsylvania court granted Microsoft’s motion to transfer 13 this case to this District over Ms. Popa’s opposition. (2/27/23 Order (Dkt. # 33).)

14 Defendants filed their motions to dismiss on June 6, 2023. (PSP Mot.; MSFT 15 Mot.; see 3/30/23 Order (Dkt. # 50) (granting the parties’ stipulated motion to set the 16 deadline for Defendants to answer or respond to Ms. Popa’s amended complaint on June 17 6, 2023).) In accordance with the parties’ agreed briefing schedule, Ms. Popa responded 18 to the motions on August 4, 2023, and Defendants filed their replies on September 15,

19 2023. (See 6/21/23 Order (Dkt. # 58) (granting stipulation regarding briefing schedule); 20 7/31/23 Order (Dkt. # 61) (same).) Defendants’ motions are now ripe for decision. 21 22 2 PSP moves to dismiss Ms. Popa’s amended complaint under Federal Rule of Civil

3 Procedure 12(b)(1) for lack of standing under Article III of the United States Constitution 4 and under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim. (See 5 generally PSP Mot.) Microsoft moves to dismiss only under Rule 12(b)(6) for failure to 6 state a claim. (See generally MSFT Mot.) Because whether Ms. Popa has Article III 7 standing to proceed with this lawsuit implicates the court’s subject matter jurisdiction, 8 see Warth v. Seldin, 422 U.S. 490, 498 (1975) (stating that standing is jurisdictional), the

9 court must begin by considering PSP’s standing argument. For the reasons set forth 10 below, the court concludes that Ms. Popa has failed to establish that she has Article III 11 standing to pursue her claims in federal court. 12 A. Standing 13 To establish standing under Article III of the United States Constitution, a plaintiff

14 must “clearly . . . allege facts demonstrating” that she “(1) suffered an injury in fact, (2) 15 that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to 16 be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 17 (2016) (quoting Warth, 422 U.S. at 518). “To establish injury in fact, a plaintiff must 18 show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete

19 and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Id. at 339 20 (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)). “Article III standing 21 requires a concrete injury even in the context of a statutory violation.” TransUnion LLC 22 v. Ramirez, --- U.S. ---, 141 S. Ct. 2190, 2205 (2021) (quoting Spokeo, 578 U.S. at 341). 1 A plaintiff does not “automatically satisf[y] the injury-in-fact requirement whenever a 2 statute grants a person a statutory right and purports to authorize that person to sue to

3 vindicate that right” because “an injury in law is not an injury in fact.” Id. (citing 4 Spokeo, 578 U.S. at 341). Instead, “[o]nly those plaintiffs who have been concretely 5 harmed by a defendant’s statutory violation may sue that private defendant over that 6 violation in federal court.” Id. (emphasis in original). 7 Courts considering cases that challenge the use of Session Replay Code on 8 consumer websites have dismissed claims for violations of state wiretapping statutes and

9 invasion of privacy for lack of standing where the plaintiffs failed to allege that the 10 defendants’ tracking of their website interactions resulted in a concrete harm. These 11 courts have required the plaintiffs to plead facts demonstrating that the defendants’ 12 interception of their information amounts to “an invasion of privacy interests that have 13 been historically protected” to satisfy the injury-in-fact element of Article III standing.

14 Cook v. GameStop, Inc., --- F. Supp. 3d ---, 2:22-cv-1292, 2023 WL 5529772, at *3-4 15 (W.D. Pa. Aug. 28, 2023), appeal filed, Aug, 29, 2023 (citing TransUnion, 141 S. Ct. at 16 2204); see also Adams v. PSP Grp., LLC, --- F. Supp. 3d ---, No. 4:22-CV-1210 RLW, 17 2023 WL 5951784, at *7-8 (E.D. Mo. Sept. 13, 2023) (dismissing for lack of Article III 18 standing where plaintiff did not allege that PSP “intercepted her private communications

19 or personal information”); Mikulsky v. Noom, Inc., No. 3:23-CV-00285-H-MSB, 2023 20 WL 4567096, at *5 (S.D. Cal. July 17, 2023) (“To survive a motion to dismiss, a plaintiff 21 must identify the ‘specific personal information she disclosed that implicates a 22 protectable privacy interest.’” (quoting Byars v. Sterling Jewelers, Inc., No. 1 5:22-CV-01456-SB-SP, 2023 WL 2996686, at *3 (C.D. Cal. Apr. 5, 2023))). Where 2 plaintiffs have not alleged an invasion of protectable privacy interests, courts have found

3 that the plaintiffs failed to plead an injury in fact and therefore lack Article III standing. 4 See, e.g., Straubmuller v. JetBlue Airways Corp., No. DKC 23-384, 2023 WL 5671615, 5 at *4 (D. Md. Sept. 1, 2023) (dismissing for lack of standing where plaintiff alleged only 6 that defendant captured his “electronic communications”); Cook, 2023 WL 5529772, at 7 *3-4 (holding that allegations that defendant intercepted data regarding “mouse 8 movements, clicks, keystrokes (such as text being entered into an information field or

9 text box), URLs of web pages visited, and/or other electronic communications in real 10 time” did not rise to the level of concrete harm); Lightoller v. Jetblue Airways Corp., No. 11 23-CV-00361-H-KSC, 2023 WL 3963823, at *4 (S.D. Cal. June 12, 2023) (concluding 12 that allegations that defendant monitored and recorded plaintiff’s interactions on the 13 website and that plaintiff obtained information on flight pricing were insufficient to

14 confer standing); see also Massie v. Gen. Motors LLC, No. CV 21-787-RGA, 2022 WL 15 534468, at *5 (D. Del. Feb. 17, 2022) (“I agree that Plaintiffs have a legally cognizable 16 interest in controlling their personal information and that intrusion upon that interest 17 would amount to a concrete injury. The fact of the matter remains, however, that none of 18 Plaintiffs’ personal information is implicated by the allegations they make.”).

19 Cook v. GameStop, Inc. is instructive.4 In that case, like this one, the plaintiff 20

21 4 Cook was decided by the Honorable J. Nicholas Ranjan, United States District Judge for the Western District of Pennsylvania, who presided over this case before transferring it to this 22 District. See Cook, 2023 WL 5529772, at *1; (2/27/23 Order at 8). 1 alleged claims for violation of WESCA and the tort of intrusion upon seclusion under 2 Pennsylvania common law. 2023 WL 5529772, at *1. The plaintiff alleged—just as Ms.

3 Popa does here—that the defendant used session replay technology to track “mouse 4 movements, clicks, keystrokes (such as text being entered into an information field or 5 text box), URLs of web pages visited, and/or other electronic communications in 6 real-time.” Id.; (see Am. Compl. ¶ 3). She also alleged that she visited the defendant’s 7 website, “browsed for different products for sale,” “used her mouse to hover and click on 8 certain products and typed search words into the search bar,” “selected a product to add

9 to her shopping cart by clicking ‘add to cart,’ but ultimately did not purchase anything,” 10 and the defendant’s session replay code “instantaneously captured her website browsing 11 activities.” Cook, 2023 WL 5529772, at *1 (cleaned up). 12 The key issue for the Cook court was whether the plaintiff had shown an injury in 13 fact sufficient to confer Article III standing. Id. at *2. The court rejected the plaintiff’s

14 argument that because wiretapping statutes have historically protected people from 15 invasions of privacy caused by wiretaps, the court need not analyze “the sensitivity of the 16 information” the defendant allegedly intercepted. Id. at *3. The court concluded that this 17 argument was “no longer viable” because, under TransUnion, a state legislature’s 18 creation of a statutory prohibition and cause of action “‘does not relieve courts of their

19 responsibility to independently decide whether a plaintiff has suffered a concrete harm 20 under Article III.’” Id. (quoting Lightoller, 2023 WL 3963823, at *3 (citing TransUnion, 21 141 S. Ct. at 2205)). In other words, “a bare statutory violation by itself is insufficient to 22 1 demonstrate Article III injury in fact.” Id. (quoting Lightoller, 2023 WL 3963823, at *3) 2 (cleaned up).

3 Mindful of the TransUnion Court’s holding that concrete harm exists where the 4 alleged injury bears a “close relationship to harms traditionally recognized as providing a 5 basis for lawsuits in American courts,” such as “disclosure of private information” and 6 “intrusion upon seclusion,” id. at *4 (quoting TransUnion, 141 S. Ct. at 2204), the Cook 7 court then considered the information that the defendant allegedly intercepted to 8 determine “whether the interception of that kind of information amounts to an invasion of

9 privacy interests that have been historically protected,” id. The court observed that the 10 tort of “public disclosure of private information” requires the disclosure of “private facts” 11 that the plaintiff “does not leave open to the public eye.’” Id. (quoting Rest. 2d Torts 12 652D cmt. b) (cleaned up). The tort of intrusion upon seclusion similarly requires a 13 plaintiff to show that the defendant “intentionally intruded ‘upon the solitude or seclusion

14 of another or his private affairs or concerns,’ and that ‘the intrusion would be highly 15 offensive to a reasonable person.’” Id. (quoting Popa v. Harriet Carter Gifts, Inc., 426 F. 16 Supp. 3d 108, 120 (W.D. Pa. 2019)). Because these traditional torts require the plaintiff 17 to show an invasion of private facts or private affairs, the court concluded that 18 “‘eavesdropping on communications that do not involve personal information, personally

19 identifiable information, or information over which a party has a reasonable expectation 20 of privacy does not amount to a concrete injury.’” Id. (quoting Massie, 2022 WL 21 534468, at *5) (cleaned up). Thus, because the plaintiff “did not enter any personally 22 identifying information at any point during her interaction” with the defendant’s website, 1 her allegations did not set forth a concrete harm and she lacked Article III standing to 2 proceed with her claims. Id.; see also id. at *5 (noting that even if the information could

3 have been connected to plaintiff, it revealed nothing more than her product preferences, 4 which are “not personal information”). 5 Here, Ms. Popa alleges only that she “brow[s]ed for pet supplies,” and 6 “communicated with PSP’s website by using her mouse to hover and click on certain 7 products.” (Am. Compl. ¶ 66.) This information, like the information at issue in Cook, 8 reveals nothing more than the products that interested Ms. Popa and thus is not the type

9 of private information that the law has historically protected. See Cook, 2023 WL 10 5529772, at *5 (analogizing browsing a product website to browsing the inventory in a 11 brick-and-mortar store); TransUnion, 141 S. Ct. at 2204. As a result, the court concludes 12 that Ms. Popa has not alleged a concrete harm and lacks Article III standing to pursue her 13 claims in federal court.

14 Ms. Popa relies primarily on two Ninth Circuit cases to support her argument that 15 she has adequately alleged that she suffered a concrete harm: In re Facebook, Inc. 16 Internet Tracking Litigation, 956 F.3d 589 (9th Cir. 2020) and Eichenberger v. ESPN, 17 Inc., 876 F.3d 979 (9th Cir. 2017). (See PSP Resp. at 3-11.) She argues that these and 18 other Ninth Circuit cases have “squarely held” that “statutes protecting privacy

19 interests—such as anti-wiretapping and anti-disclosure laws” codify a substantive right to 20 privacy and thus the violation of such statutes necessarily gives rise to a concrete injury 21 sufficient to confer standing. (Id. at 4-5 (citing In re Facebook, 956 F.3d at 598-99; 22 1 Campbell v. Facebook, Inc., 951 F.3d 1106, 1116-19 (9th Cir. 2020); and Eichenberger, 2 876 F.3d at 983-84).) The court is not persuaded.

3 In re Facebook and Eisenberger both pre-date the Supreme Court’s 2021 decision 4 in TransUnion, see 141 S. Ct. at 2190, and the court disagrees with Ms. Popa’s assertion 5 that TransUnion “did not break any new ground” and did no more than “merely 6 reaffirm[] the conclusion already reached in Spokeo” (PSP Resp. at 4 n.2). Although 7 Spokeo announced a framework for determining whether a plaintiff has standing to sue 8 based on an alleged statutory violation, it did not apply the rules it prescribed. See

9 Spokeo, 578 U.S. at 343 (taking no position as to whether plaintiff adequately alleged an 10 injury in fact). TransUnion expanded upon Spokeo by addressing how a court should 11 apply those rules in a specific case when faced with whether a plaintiff adequately 12 alleged an injury in fact resulting from a statutory violation. See TransUnion, 141 S. Ct. 13 at 2204-07 (discussing Spokeo); id. at 2208-14 (determining whether, based on the facts

14 of the case, each set of class members had demonstrated that they suffered a concrete 15 harm bearing a “‘close relationship’ to a harm traditionally recognized as providing a 16 basis for a lawsuit in American courts”). Thus, the court is not persuaded by Ms. Popa’s 17 argument that In re Facebook and Eisenberger continue to stand, post-TransUnion, for 18 the proposition that a plaintiff sufferes an injury in fact simply by alleging a violation of a

19 privacy statute. 20 Ms. Popa also asserts that under In re Facebook and Eisenberger, “the question of 21 Plaintiff’s standing does not entail a qualitative assessment of the sensitivity of the 22 communications allegedly intercepted.” (Resp. at 6.) Contrary to this assertion, 1 however, the In re Facebook court analyzed whether the plaintiffs had alleged that the 2 specific statutory violation at issue “caused real harm or a material risk of harm” to the

3 plaintiffs’ privacy interests before concluding that the plaintiffs had Article III standing to 4 proceed. See 956 F.3d at 598 (first determining whether plaintiffs adequately alleged a 5 violation of a legally protected interest, then determining whether plaintiffs had 6 adequately alleged harm to those interests). In that case, the plaintiffs alleged that 7 Facebook captured extensive information about their browsing activity on third-party 8 websites—even after they had logged out of Facebook—and used that information to

9 create detailed, personally-identifiable profiles that described the plaintiffs and revealed 10 their “likes, dislikes, interests, and habits over a significant amount of time.” Id. at 11 598-99. The Ninth Circuit concluded that the plaintiffs had adequately alleged that 12 Facebook’s practices would cause harm or a material risk of harm to their interest in 13 controlling their personal information and thus “sufficiently alleged a clear invasion of

14 the historically recognized right to privacy.” Id. at 599. It was only after reaching this 15 conclusion that the court held that the plaintiffs had standing to pursue their claims. Id. 16 Here, unlike the plaintiffs in In re Facebook, Ms. Popa does not allege that she 17 entered any personally identifiable information into PSP’s website, that such information 18 was captured by Defendants, or that Defendants were able to connect the information

19 Clarity collected to her identity. (See generally Am. Compl.) Because she has not 20 alleged that Defendants engaged in conduct that invaded historically protected privacy 21 interests, she has not alleged an injury in fact that is sufficient to confer Article III 22 standing. TransUnion, 141 S. Ct. at 2205; see also Cook, 2023 WL 5529772, at *4-5. 1 Therefore, the court DISMISSES this action without prejudice for lack of subject matter 2 jurisdiction pursuant to Federal Rule of Civil Procedure 12(b)(1).5 See Mo. ex rel. Koster

3 v. Harris, 847 F.3d 646, 656 (9th Cir. 2017) (“In general, dismissal for lack of subject 4 matter jurisdiction is without prejudice.”). The court DENIES Microsoft’s motion for 5 summary judgment as moot. 6 B. Leave to Amend 7 Ms. Popa has not requested leave to amend. (See generally PSP Resp.; MSFT 8 Resp.) In addition, she has already amended her complaint. (See Compl.; Am. Compl.)

9 The Ninth Circuit, however, applies a generous standard for granting leave to amend. 10 United States v. Corinthian Colls., 655 F.3d 984, 995 (9th Cir. 2011); see Lopez v. Smith, 11 203 F.3d 1122, 1130 (9th Cir. 2000) (“[A] district court should grant leave to amend even 12 if no request to amend the pleading was made, unless it determines that the pleading 13 could not possibly be cured by the allegation of other facts.” (quoting Doe v. United

14 States, 58 F.3d 494, 497 (9th Cir. 1995))). Because it is possible that Ms. Popa may be 15 able to allege additional information that would establish that she suffered a cognizable 16 injury in fact, the court GRANTS her leave to further amend her complaint. 17 // 18 //

19 // 20 5 Because the court does not have subject matter jurisdiction over this action, it need not consider whether dismissal is also appropriate under Federal Rule of Civil Procedure 12(b)(6). 21 The court notes, however, that the Cook court held that even if the plaintiff in that case had standing, dismissal would still be warranted because the plaintiff failed to state claims for 22 violation of WESCA and intrusion upon seclusion. Cook, 2023 WL 5529772, at *6-10. 2 For the foregoing reasons, the court GRANTS PSP’s motion to dismiss this matter

3 for lack of subject jurisdiction (Dkt. # 54) and DISMISSES this action without prejudice 4 and with leave to amend. Ms. Popa shall file her amended complaint, if any, by no later 5 than November 14, 2023. The court DENIES Microsoft’s motion to dismiss (Dkt. # 55) 6 as moot. 7 Dated this 24th day of October, 2023. 8 A 9 United States District Judge 11 12 13 14 15 16 17 18

19 20 21 22