Popa v. PSP Group LLC

Opinion

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON AT SEATTLE

ASHLEY POPA, CASE NO. C23-0294JLR Plaintiff, ORDER v. PSP GROUP, LLC, et al., Defendants.

Before the court are motions to dismiss filed by Defendants PSP Group, LLC, doing business as Pet Supplies Plus (“PSP”) and Microsoft Corporation (“Microsoft”) (together, “Defendants”). (PSP Mot. (Dkt. # 54); PSP Reply (Dkt. # 66); MSFT Mot. (Dkt. # 55); MSFT Reply (Dkt. # 65).) Plaintiff Ashley Popa opposes both motions. (PSP Resp. (Dkt. # 64-11); MSFT Resp. (Dkt. # 63).) The court has considered the

1 Ms. Popa filed a praecipe to correct certain errors in her original response. (Praecipe (Dkt. # 64).) motions, all materials submitted in support of and in opposition to the motions, and the governing law. Being fully advised,2 the court GRANTS PSP’s motion to dismiss;

DISMISSES this matter for lack of subject matter jurisdiction; and DENIES Microsoft’s motion to dismiss as moot. This case is one of dozens of proposed class actions being litigated in federal courts across the country challenging the use of “Session Replay Code” to record, save, analyze, and replay internet users’ interactions with consumer websites.3 In this case,

Ms. Popa alleges that PSP has “procure[d] third-party vendors” to embed Session Replay Code on its website, www.petsuppliesplus.com, for the purpose [of] intercepting and recording the website visitor’s electronic communications with the PSP website, including their mouse movements, clicks, keystrokes (such as text being entered into an information field or text box), URLs of web pages visited, and/or other electronic communications in real-time.

(Am. Compl. (Dkt. # 26) ¶¶ 1-4.) Ms. Popa describes the use of Session Replay Code as “the electronic equivalent of ‘looking over the shoulder’ of each visitor to the PSP website for the entire duration of their website interaction.” (Id. ¶ 5; see also id. ¶¶ 28-47

2 Defendants and Ms. Popa request oral argument. (PSP Mot. at 1; PSP Resp. at 1; MSFT Mot. at 1; MSFT Resp. at 1.) The court, however, concludes that oral argument would not be helpful to its disposition of the motion. See Local Rules W.D. Wash. LCR 7(b)(4).

3 See, e.g., In re Zillow Grp., Inc. Session Replay Software Litig., No. C22-1282JLR (W.D. Wash.); Mikulsky v. Noom, Inc., No. 3:23-cv-00285-H-MSB (S.D. Cal.); Valenzuela v. Keurig Green Mountain Inc., No. 3:22-cv-09042-JSC (N.D. Cal.); Adams v. PSP Grp., LLC, No. 4:22-cv-1210-RLW (E.D. Mo.); Cook v. GameStop, Inc., No. 2:22-cv-1292 (W.D. Pa.); Straubmuller v. Jetblue Airways Corp., No. 8:23-cv-00384-DKC (D. Md.); Massie v. Gen. Motors LLC, No. 1:21-cv-00787-RGA (D. Del.). (describing, in general terms, how Session Replay Code works).) One of the third-party Session Replay Code vendors that PSP has “procured” is Microsoft, which, according to

Ms. Popa, has provided its Session Replay Code system, Clarity, “to a vast number of website clients.” (Id. ¶ 6; see also id. ¶¶ 53-62 (describing, in general terms, how Clarity operates and Clarity’s data-collection capabilities).) According to Ms. Popa, “[d]ata collected by Clarity is . . . stored in the Microsoft Azure cloud service, and Microsoft has access to that information.” (Id. ¶ 62.) Ms. Popa alleges that she visited www.petsuppliesplus.com “and certain of its

subpages” while in Pennsylvania. (Id. ¶ 63.) During her visits to the website, she “brow[s]ed for pet supplies,” and “communicated with PSP’s website by using her mouse to hover and click on certain products.” (Id. ¶ 66.) While she engaged in these interactions, Clarity was “operative on PSP’s website and subpages” and “instantaneously captured” her communications with the website without her knowledge

or consent. (Id. ¶¶ 65, 67-68.) Ms. Popa does not describe what information, if any, she shared on PSP’s website, nor does she allege that she made any purchases using the website. (See generally id. ¶¶ 63-81 (describing “Plaintiff’s and Class Members’ Experience” with PSP’s website).) Although she alleges that “if a user enters their address for delivery, that information is captured by Microsoft Clarity embedded on the

website,” Ms. Popa does not allege that she entered her own address during her visits to PSP’s website. (Id. ¶ 69; see id. ¶¶ 63-66 (describing Ms. Popa’s interactions with the website).) Ms. Popa includes in her amended complaint, however, a screenshot “[d]epicting information sent to” Microsoft through Clarity “after entering an address to a text box.” (Id. ¶ 69.) The screenshot shows that address information sent to Microsoft through Clarity is redacted to include only the street, city, state, and country entered in

the text box—it does not include the street number or zip code. (Id.) Ms. Popa filed her original complaint in the United States District Court for the Western District of Pennsylvania on September 22, 2022. (Compl. (Dkt. # 1).) She amended her complaint on February 7, 2023. (Am. Compl.) Ms. Popa alleges claims on behalf of herself and two proposed Pennsylvania classes against PSP and Microsoft for violation of the Pennsylvania Wiretapping and Electronic Surveillance Control Act

(“WESCA”), 18 Pa. Cons. Stat. § 5701 et seq. (Am. Compl. ¶¶ 94-131) and for “invasion of privacy – intrusion upon seclusion” under Pennsylvania common law (id. ¶¶ 132-59 (capitalization altered); see also id. ¶ 85 (proposed class definitions)). On February 27, 2023, the Western District of Pennsylvania court granted Microsoft’s motion to transfer this case to this District over Ms. Popa’s opposition. (2/27/23 Order (Dkt. # 33).)

Defendants filed their motions to dismiss on June 6, 2023. (PSP Mot.; MSFT Mot.; see 3/30/23 Order (Dkt. # 50) (granting the parties’ stipulated motion to set the deadline for Defendants to answer or respond to Ms. Popa’s amended complaint on June 6, 2023).) In accordance with the parties’ agreed briefing schedule, Ms. Popa responded to the motions on August 4, 2023, and Defendants filed their replies on September 15,

2023. (See 6/21/23 Order (Dkt. # 58) (granting stipulation regarding briefing schedule); 7/31/23 Order (Dkt. # 61) (same).) Defendants’ motions are now ripe for decision. PSP moves to dismiss Ms. Popa’s amended complaint under Federal Rule of Civil

Procedure 12(b)(1) for lack of standing under Article III of the United States Constitution and under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim. (See generally PSP Mot.) Microsoft moves to dismiss only under Rule 12(b)(6) for failure to state a claim. (See generally MSFT Mot.) Because whether Ms. Popa has Article III standing to proceed with this lawsuit implicates the court’s subject matter jurisdiction, see Warth v. Seldin, 422 U.S. 490, 498 (1975) (stating that standing is jurisdictional), the

court must begin by considering PSP’s standing argument. For the reasons set forth below, the court concludes that Ms. Popa has failed to establish that she has Article III standing to pursue her claims in federal court. A. Standing To establish standing under Article III of the United States Constitution, a plaintiff

must “clearly . . . allege facts demonstrating” that she “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (quoting Warth, 422 U.S. at 518). “To establish injury in fact, a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete

and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Id. at 339 (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)). “Article III standing requires a concrete injury even in the context of a statutory violation.” TransUnion LLC v. Ramirez, --- U.S. ---, 141 S. Ct. 2190, 2205 (2021) (quoting Spokeo, 578 U.S. at 341). A plaintiff does not “automatically satisf[y] the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to

vindicate that right” because “an injury in law is not an injury in fact.” Id. (citing Spokeo, 578 U.S. at 341). Instead, “[o]nly those plaintiffs who have been concretely harmed by a defendant’s statutory violation may sue that private defendant over that violation in federal court.” Id. (emphasis in original). Courts considering cases that challenge the use of Session Replay Code on consumer websites have dismissed claims for violations of state wiretapping statutes and

invasion of privacy for lack of standing where the plaintiffs failed to allege that the defendants’ tracking of their website interactions resulted in a concrete harm. These courts have required the plaintiffs to plead facts demonstrating that the defendants’ interception of their information amounts to “an invasion of privacy interests that have been historically protected” to satisfy the injury-in-fact element of Article III standing.

Cook v. GameStop, Inc., --- F. Supp. 3d ---, 2:22-cv-1292, 2023 WL 5529772, at *3-4 (W.D. Pa. Aug. 28, 2023), appeal filed, Aug, 29, 2023 (citing TransUnion, 141 S. Ct. at 2204); see also Adams v. PSP Grp., LLC, --- F. Supp. 3d ---, No. 4:22-CV-1210 RLW, 2023 WL 5951784, at *7-8 (E.D. Mo. Sept. 13, 2023) (dismissing for lack of Article III standing where plaintiff did not allege that PSP “intercepted her private communications

or personal information”); Mikulsky v. Noom, Inc., No. 3:23-CV-00285-H-MSB, 2023 WL 4567096, at *5 (S.D. Cal. July 17, 2023) (“To survive a motion to dismiss, a plaintiff must identify the ‘specific personal information she disclosed that implicates a protectable privacy interest.’” (quoting Byars v. Sterling Jewelers, Inc., No. 5:22-CV-01456-SB-SP, 2023 WL 2996686, at *3 (C.D. Cal. Apr. 5, 2023))). Where plaintiffs have not alleged an invasion of protectable privacy interests, courts have found

that the plaintiffs failed to plead an injury in fact and therefore lack Article III standing. See, e.g., Straubmuller v. JetBlue Airways Corp., No. DKC 23-384, 2023 WL 5671615, at *4 (D. Md. Sept. 1, 2023) (dismissing for lack of standing where plaintiff alleged only that defendant captured his “electronic communications”); Cook, 2023 WL 5529772, at *3-4 (holding that allegations that defendant intercepted data regarding “mouse movements, clicks, keystrokes (such as text being entered into an information field or

text box), URLs of web pages visited, and/or other electronic communications in real time” did not rise to the level of concrete harm); Lightoller v. Jetblue Airways Corp., No. 23-CV-00361-H-KSC, 2023 WL 3963823, at *4 (S.D. Cal. June 12, 2023) (concluding that allegations that defendant monitored and recorded plaintiff’s interactions on the website and that plaintiff obtained information on flight pricing were insufficient to

confer standing); see also Massie v. Gen. Motors LLC, No. CV 21-787-RGA, 2022 WL 534468, at *5 (D. Del. Feb. 17, 2022) (“I agree that Plaintiffs have a legally cognizable interest in controlling their personal information and that intrusion upon that interest would amount to a concrete injury. The fact of the matter remains, however, that none of Plaintiffs’ personal information is implicated by the allegations they make.”).

Cook v. GameStop, Inc. is instructive.4 In that case, like this one, the plaintiff

4 Cook was decided by the Honorable J. Nicholas Ranjan, United States District Judge for the Western District of Pennsylvania, who presided over this case before transferring it to this District. See Cook, 2023 WL 5529772, at *1; (2/27/23 Order at 8). alleged claims for violation of WESCA and the tort of intrusion upon seclusion under Pennsylvania common law. 2023 WL 5529772, at *1. The plaintiff alleged—just as Ms.

Popa does here—that the defendant used session replay technology to track “mouse movements, clicks, keystrokes (such as text being entered into an information field or text box), URLs of web pages visited, and/or other electronic communications in real-time.” Id.; (see Am. Compl. ¶ 3). She also alleged that she visited the defendant’s website, “browsed for different products for sale,” “used her mouse to hover and click on certain products and typed search words into the search bar,” “selected a product to add

to her shopping cart by clicking ‘add to cart,’ but ultimately did not purchase anything,” and the defendant’s session replay code “instantaneously captured her website browsing activities.” Cook, 2023 WL 5529772, at *1 (cleaned up). The key issue for the Cook court was whether the plaintiff had shown an injury in fact sufficient to confer Article III standing. Id. at *2. The court rejected the plaintiff’s

argument that because wiretapping statutes have historically protected people from invasions of privacy caused by wiretaps, the court need not analyze “the sensitivity of the information” the defendant allegedly intercepted. Id. at *3. The court concluded that this argument was “no longer viable” because, under TransUnion, a state legislature’s creation of a statutory prohibition and cause of action “‘does not relieve courts of their

responsibility to independently decide whether a plaintiff has suffered a concrete harm under Article III.’” Id. (quoting Lightoller, 2023 WL 3963823, at *3 (citing TransUnion, 141 S. Ct. at 2205)). In other words, “a bare statutory violation by itself is insufficient to demonstrate Article III injury in fact.” Id. (quoting Lightoller, 2023 WL 3963823, at *3) (cleaned up).

Mindful of the TransUnion Court’s holding that concrete harm exists where the alleged injury bears a “close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts,” such as “disclosure of private information” and “intrusion upon seclusion,” id. at *4 (quoting TransUnion, 141 S. Ct. at 2204), the Cook court then considered the information that the defendant allegedly intercepted to determine “whether the interception of that kind of information amounts to an invasion of

privacy interests that have been historically protected,” id. The court observed that the tort of “public disclosure of private information” requires the disclosure of “private facts” that the plaintiff “does not leave open to the public eye.’” Id. (quoting Rest. 2d Torts 652D cmt. b) (cleaned up). The tort of intrusion upon seclusion similarly requires a plaintiff to show that the defendant “intentionally intruded ‘upon the solitude or seclusion

of another or his private affairs or concerns,’ and that ‘the intrusion would be highly offensive to a reasonable person.’” Id. (quoting Popa v. Harriet Carter Gifts, Inc., 426 F. Supp. 3d 108, 120 (W.D. Pa. 2019)). Because these traditional torts require the plaintiff to show an invasion of private facts or private affairs, the court concluded that “‘eavesdropping on communications that do not involve personal information, personally

identifiable information, or information over which a party has a reasonable expectation of privacy does not amount to a concrete injury.’” Id. (quoting Massie, 2022 WL 534468, at *5) (cleaned up). Thus, because the plaintiff “did not enter any personally identifying information at any point during her interaction” with the defendant’s website, her allegations did not set forth a concrete harm and she lacked Article III standing to proceed with her claims. Id.; see also id. at *5 (noting that even if the information could

have been connected to plaintiff, it revealed nothing more than her product preferences, which are “not personal information”). Here, Ms. Popa alleges only that she “brow[s]ed for pet supplies,” and “communicated with PSP’s website by using her mouse to hover and click on certain products.” (Am. Compl. ¶ 66.) This information, like the information at issue in Cook, reveals nothing more than the products that interested Ms. Popa and thus is not the type

of private information that the law has historically protected. See Cook, 2023 WL 5529772, at *5 (analogizing browsing a product website to browsing the inventory in a brick-and-mortar store); TransUnion, 141 S. Ct. at 2204. As a result, the court concludes that Ms. Popa has not alleged a concrete harm and lacks Article III standing to pursue her claims in federal court.

Ms. Popa relies primarily on two Ninth Circuit cases to support her argument that she has adequately alleged that she suffered a concrete harm: In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589 (9th Cir. 2020) and Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017). (See PSP Resp. at 3-11.) She argues that these and other Ninth Circuit cases have “squarely held” that “statutes protecting privacy

interests—such as anti-wiretapping and anti-disclosure laws” codify a substantive right to privacy and thus the violation of such statutes necessarily gives rise to a concrete injury sufficient to confer standing. (Id. at 4-5 (citing In re Facebook, 956 F.3d at 598-99; Campbell v. Facebook, Inc., 951 F.3d 1106, 1116-19 (9th Cir. 2020); and Eichenberger, 876 F.3d at 983-84).) The court is not persuaded.

In re Facebook and Eisenberger both pre-date the Supreme Court’s 2021 decision in TransUnion, see 141 S. Ct. at 2190, and the court disagrees with Ms. Popa’s assertion that TransUnion “did not break any new ground” and did no more than “merely reaffirm[] the conclusion already reached in Spokeo” (PSP Resp. at 4 n.2). Although Spokeo announced a framework for determining whether a plaintiff has standing to sue based on an alleged statutory violation, it did not apply the rules it prescribed. See

Spokeo, 578 U.S. at 343 (taking no position as to whether plaintiff adequately alleged an injury in fact). TransUnion expanded upon Spokeo by addressing how a court should apply those rules in a specific case when faced with whether a plaintiff adequately alleged an injury in fact resulting from a statutory violation. See TransUnion, 141 S. Ct. at 2204-07 (discussing Spokeo); id. at 2208-14 (determining whether, based on the facts

of the case, each set of class members had demonstrated that they suffered a concrete harm bearing a “‘close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit in American courts”). Thus, the court is not persuaded by Ms. Popa’s argument that In re Facebook and Eisenberger continue to stand, post-TransUnion, for the proposition that a plaintiff sufferes an injury in fact simply by alleging a violation of a

privacy statute. Ms. Popa also asserts that under In re Facebook and Eisenberger, “the question of Plaintiff’s standing does not entail a qualitative assessment of the sensitivity of the communications allegedly intercepted.” (Resp. at 6.) Contrary to this assertion, however, the In re Facebook court analyzed whether the plaintiffs had alleged that the specific statutory violation at issue “caused real harm or a material risk of harm” to the

plaintiffs’ privacy interests before concluding that the plaintiffs had Article III standing to proceed. See 956 F.3d at 598 (first determining whether plaintiffs adequately alleged a violation of a legally protected interest, then determining whether plaintiffs had adequately alleged harm to those interests). In that case, the plaintiffs alleged that Facebook captured extensive information about their browsing activity on third-party websites—even after they had logged out of Facebook—and used that information to

create detailed, personally-identifiable profiles that described the plaintiffs and revealed their “likes, dislikes, interests, and habits over a significant amount of time.” Id. at 598-99. The Ninth Circuit concluded that the plaintiffs had adequately alleged that Facebook’s practices would cause harm or a material risk of harm to their interest in controlling their personal information and thus “sufficiently alleged a clear invasion of

the historically recognized right to privacy.” Id. at 599. It was only after reaching this conclusion that the court held that the plaintiffs had standing to pursue their claims. Id. Here, unlike the plaintiffs in In re Facebook, Ms. Popa does not allege that she entered any personally identifiable information into PSP’s website, that such information was captured by Defendants, or that Defendants were able to connect the information

Clarity collected to her identity. (See generally Am. Compl.) Because she has not alleged that Defendants engaged in conduct that invaded historically protected privacy interests, she has not alleged an injury in fact that is sufficient to confer Article III standing. TransUnion, 141 S. Ct. at 2205; see also Cook, 2023 WL 5529772, at *4-5. Therefore, the court DISMISSES this action without prejudice for lack of subject matter jurisdiction pursuant to Federal Rule of Civil Procedure 12(b)(1).5 See Mo. ex rel. Koster

v. Harris, 847 F.3d 646, 656 (9th Cir. 2017) (“In general, dismissal for lack of subject matter jurisdiction is without prejudice.”). The court DENIES Microsoft’s motion for summary judgment as moot. B. Leave to Amend Ms. Popa has not requested leave to amend. (See generally PSP Resp.; MSFT Resp.) In addition, she has already amended her complaint. (See Compl.; Am. Compl.)

The Ninth Circuit, however, applies a generous standard for granting leave to amend. United States v. Corinthian Colls., 655 F.3d 984, 995 (9th Cir. 2011); see Lopez v. Smith, 203 F.3d 1122, 1130 (9th Cir. 2000) (“[A] district court should grant leave to amend even if no request to amend the pleading was made, unless it determines that the pleading could not possibly be cured by the allegation of other facts.” (quoting Doe v. United

States, 58 F.3d 494, 497 (9th Cir. 1995))). Because it is possible that Ms. Popa may be able to allege additional information that would establish that she suffered a cognizable injury in fact, the court GRANTS her leave to further amend her complaint. // //

// 5 Because the court does not have subject matter jurisdiction over this action, it need not consider whether dismissal is also appropriate under Federal Rule of Civil Procedure 12(b)(6). The court notes, however, that the Cook court held that even if the plaintiff in that case had standing, dismissal would still be warranted because the plaintiff failed to state claims for violation of WESCA and intrusion upon seclusion. Cook, 2023 WL 5529772, at *6-10. For the foregoing reasons, the court GRANTS PSP’s motion to dismiss this matter

for lack of subject jurisdiction (Dkt. # 54) and DISMISSES this action without prejudice and with leave to amend. Ms. Popa shall file her amended complaint, if any, by no later than November 14, 2023. The court DENIES Microsoft’s motion to dismiss (Dkt. # 55) as moot. Dated this 24th day of October, 2023. A United States District Judge