Shawn Delong v. PHE, Inc.

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA

SHAWN DELONG : CIVIL ACTION : v. : NO. 24-5212 : PHE, INC. :

MEMORANDUM

MURPHY, J. July 16, 2026

This is our second time reviewing a motion to dismiss in this case. Last time, we dismissed Mr. Delong’s complaint for lack of standing and, alternatively, lack of personal jurisdiction. He filed an amended complaint meant to address these problems. As a reminder, Mr. Delong is suing PHE, Inc. — the operator of the online adult-products store Adam & Eve — for collecting and sharing his shopping behavior with Google Analytics in violation of Pennsylvania law. Mr. Delong’s original complaint did not demonstrate a concrete injury sufficient to establish standing because ordinarily, online shoppers have no reasonable expectation of privacy in their shopping habits. Nor did Mr. Delong allege a sufficient connection between his lawsuit and PHE’s activities in Pennsylvania for personal jurisdiction. Mr. Delong’s amended complaint changes things. He now explains how PHE uses advertising to induce its customers to expect shopping privacy consistent with common law privacy rights. That is enough for standing. Furthermore, PHE’s advertisements in Pennsylvania establish a sufficiently clear connection between Mr. Delong’s alleged harm and PHE’s activities in the state. Therefore, we can now exercise personal jurisdiction over the defendant. Having resolved the jurisdictional questions, we continue on to consider PHE’s sufficiency arguments and conclude that Mr. Delong adequately states a claim under Pennsylvania law. This case will proceed into discovery. I. Background Much of the background of this case and the relevant law may be found in our opinion dismissing without prejudice Mr. Delong’s earlier complaint. See Delong v. PHE, Inc., 2025 WL 2447787 (E.D. Pa. Aug. 25, 2025). According to the amended complaint, which we must

accept as true for these purposes, PHE is the owner and operator of Adam & Eve, which sells sex toys and other adult products through an online retail website. DI 22 at ¶¶ 1, 12.1 PHE promises consumers privacy on Adam & Eve both through advertising and on its website. Id. at ¶ 16. In advertising, PHE “has promulgated numerous television commercials with the theme of privacy, touting the Website as a place where consumers can shop privately for adult products without worrying who sees.” Id. at ¶ 17. On its website, Adam and Eve “stat[es] directly on the homepage that it takes ‘privacy seriously.’” Id. at ¶ 24. Despite these reassurances of privacy, PHE shares its customers’ information with Google. Id. at ¶ 27. Specifically, “Adam & Eve adds or embeds a small piece of Google Analytics JavaScript measurement code into each page of its website that it wishes to track

information.” Id. at ¶ 32. This allows Google Analytics to “see and collect Adam & Eve Website users’ IP addresses along with information related to their sexual orientation, sexual preferences, and other intimate information.” Id. at ¶ 63. Users’ intercepted information is then “stored in the Google database for Google’s later use to generate reports to help analyze the data collected.” Id. at ¶ 36. “Google also uses the information . . . to maintain and improve Google’s own services, develop new services, measure the effectiveness of its advertising, and personalize content and ads that one sees on Google’s and its partners’ sites and applications.” Id. at ¶ 37.

1 We adopt the sequential pagination supplied by the CM/ECF docketing system. 2 Mr. Delong was a consumer who searched for and purchased adult products from Adam and Eve on numerous occasions. Id. at ¶ 88. Mr. Delong and his purported class allege that PHE violated Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (WESCA), 18 Pa. C.S. § 5701 et seq., by using Google Analytics to track the activities of visitors to the

Adam & Eve website. Id. ¶¶ 1-8. The proposed class seeks: (1) certification by order pursuant to Fed. R. Civ. P. 23; (2) designation of the plaintiff as representative of the proposed class and designation of his counsel as class counsel; (3) judgment in favor of the plaintiff and class members as against the defendant; (4) An award to each plaintiff and class member for statutory, actual and punitive damages, pursuant to 18 Pa. C.S. § 5725; (5) An award of attorneys’ fees and costs, including pre- and post-judgment interest; (6) An order holding that defendant’s disclosure of the plaintiff’s and class’s messages, reports and/or communications was in violation of the WESCA; and (7) such further relief that we deem proper. DI 22 at 30-31. II. Procedural History and Standard of Review Mr. Delong filed his original complaint against PHE in September 2024. DI 1. PHE

subsequently moved to dismiss Mr. Delong’s complaint on three grounds: lack of Article III standing, lack of personal jurisdiction, and failure to state a claim. DI 8. We agreed with PHE that Mr. Delong’s complaint did not establish standing or personal jurisdiction, and thus we dismissed Mr. Delong’s case without prejudice. Delong, 2025 WL 2447787.2 Mr. Delong then filed an amended complaint in September 2025. DI 22. PHE now moves to dismiss Mr. Delong’s complaint on the same three grounds as its

2 We declined to reach whether Mr. Delong’s complaint sufficiently stated a claim under the WESCA.

3 original motion: lack of Article III standing, lack of personal jurisdiction, and failure to state a claim. DI 23. Starting with standing, “[t]he burden to establish standing rests with the plaintiff[].” Finkelman v. Nat’l Football League, 810 F.3d 187, 194 (3d Cir. 2016). “The manner in which plaintiffs go about satisfying that burden depends on the posture of the case.”

Id. Thus, “[w]hen assessing standing on the basis of the facts alleged in a complaint, this means we apply the same standard of review we use when assessing a motion to dismiss for failure to state a claim . . . a plaintiff must allege facts that affirmatively and plausibly suggest that it has standing to sue. Id. (citation modified). As for personal jurisdiction, the plaintiff again bears the burden of alleging facts that demonstrate personal jurisdiction over the defendant is proper. Pinker v. Roche Holdings Ltd., 292 F.3d 361, 368 (3d Cir. 2002). However, “we must accept all of the plaintiff's allegations as true and construe disputed facts in favor of the plaintiff.” Id. (citation modified). Finally, in evaluating whether a plaintiff has sufficiently stated a claim, we must decide whether the complaint contains sufficient factual allegations, accepted as true, to state a plausible

claim for relief. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is facially plausible when the plaintiff pleads facts allowing the court to reasonably infer that the defendant is liable for the alleged misconduct. Id. Mere legal conclusions or threadbare recitals of the elements of a cause of action will not suffice. Twombly, 550 U.S. at 555. III. Analysis We deny PHE’s motion to dismiss in its entirety as follows. A. Mr. Delong pleads sufficient injury-in-fact to establish Article III standing Article III of the Constitution “confines the federal judicial power to the resolution of 4 ‘Cases’ and ‘Controversies.’” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021). “For there to be a case or controversy . . . the plaintiff must have a personal stake in the case—in other words, standing.” Id. (citation modified). This requires the plaintiff to show: (1) an injury-in-fact that is (2) traceable to the alleged conduct and (3) can be redressed by a favorable

judicial decision. Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). Only the first element of standing — injury in fact — is contested here. An injury-in-fact requires suffering “an invasion of a legally protected interest” that is “concrete and particularized,” as well as “actual or imminent, not conjectural or hypothetical.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992) (citation modified). Here, PHE argues that Mr. Delong’s injury was not sufficiently concrete. Concrete injuries must be “real” and not “abstract.” Spokeo, 578 U.S. at 340. “The most obvious concrete injuries result from traditional tangible harms, such as physical harms and monetary harms.” In re BPS Direct, LLC; Cabela's, LLC Wiretapping Litig., 175 F.4th 423, 429 (3d Cir. 2026) (citation modified). But “intangible harms can also be concrete. Chief among them are

injuries with a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts.” TransUnion, 594 U.S. at 425. “So when plaintiffs allege an intangible harm, we ask whether they have identified a close historical or common-law analogue for their asserted injury. We do so by comparing the kind of harm a plaintiff alleges with the kind of harm caused by a comparator tort at common law.” BPS Direct, 175 F.4th at 429 (citation modified). In this case, Mr. Delong analogizes the harm he faced to the common-law harm of intrusion upon seclusion. Intrusion upon seclusion is the intentional intrusion, “physical[] or

5 otherwise, upon the solitude or seclusion of another or his private affairs or concerns, . . . if the intrusion would be highly offensive to a reasonable person.” Borse v. Piece Goods Shop, Inc., 963 F.2d 611, 620 (3d Cir. 1992) (quoting Restatement (Second) of Torts § 652B). “Unlike the disclosure of private information, the harm caused by intrusion upon seclusion does not turn on

the exposure of personal or sensitive information.” Cook v. GameStop, Inc., 148 F.4th 153, 160 (3d Cir. 2025) (citation modified). Rather, “the tort consists solely of an intentional interference with the plaintiff's interest in solitude or seclusion, either as to his person or as to his private affairs or concerns.” Id. (citation modified). “The kind of harm vindicated by the intrusion-upon-seclusion tort is relatively broad.” BPS Direct, 175 F.4th at 432 (citation modified). “The common-law tort covers a range of injuries, from those caused by persistent, hounding telephone calls to those caused by surreptitious photographs taken up one's skirt.” Id. at 432. Other examples include “looking into [plaintiff’s] upstairs windows with binoculars, . . . opening [plaintiff’s] private and personal mail, searching his safe or his wallet, or examining his private bank account.” Id. (citation

modified). “Yet this kind of harm does not have an unlimited breadth. When the harm is based on an intrusion into a plaintiff's affairs, those affairs must (at least plausibly) be private.” Id. This burgeoning area of the law has developed significantly even during the life of this case. Two recent Third Circuit cases applying intrusion upon seclusion to the online sphere guide our thinking here. First, in GameStop, the plaintiff alleged that when she visited Gamestop’s retail website, her interactions on the website were captured by Clarity, a session replay code provided by Microsoft.3 148 F.4th at 156. Clarity’s interception of her data, she

3 Session replay code “is a script of computer code that enables a company to track how 6 argued, was analogous to the tort of intrusion upon seclusion because it was “the electronic equivalent of looking over the shoulder of each visitor to the GameStop website for the entire duration of their website interaction.” Id. at 160 (citation modified). However, the Third Circuit disagreed, explaining that “none of the information [plaintiff] entered on GameStop’s website

was personal or sensitive.” Specifically, “she did not share her name, contact information, address, or billing information while on GameStop's website.” Id. at 159. Almost a year after GameStop, the Third Circuit decided BPS Direct. That case involved very similar facts to GameStop: eight plaintiffs claimed that outdoor product retailers Bass Pro Shops and Cabela’s (collectively, BPS) used session replay code to capture their website interactions without their consent. 175 F.4th at 426-27. Two of the plaintiffs made purchases after browsing the defendants’ websites and during the checkout process entered their name, address, and payment and billing information. Id. at 428. The remaining six plaintiffs did not make purchases and thus did not enter their names, addresses, or any other personally identifying information while on the websites. Id.

The Third Circuit concluded that the six BPS plaintiffs who did not purchase anything on the websites lacked standing for the same reasons as the plaintiff in GameStop: They “could not plausibly allege that their clicks, scrolls, and searches for outdoor products on BPS’s websites were private[] [as] they entered no personal or sensitive information, and their electronic browsing for quotidian items was no more private than the physical browsing countless shoppers do daily in BPS’s brick-and-mortar stores.” Id. at 433 (citation modified). However, the Third Circuit reasoned that the plaintiffs who did purchase items suffered injuries analogous to the tort

internet users browse and interact with its website. It captures a user's mouse movements, clicks, keystrokes, and more.” GameStop, 148 F.4th at 156. 7 of intrusion upon seclusion. Id. at 434. This was because, “[a]mong other things, they entered their complete credit card or debit card numbers” which “is rightly viewed as highly sensitive.” Id. Therefore, they possessed standing. Id. Turning to Mr. Delong’s complaint, we think he — like the BPS plaintiffs who entered

their credit card information — plausibly alleges that he entered personal and sensitive information into PHE’s website, and thus he suffered harm closely analogous to intrusion upon seclusion when Google recorded his information. In particular, Mr. Delong alleges that he “searched for and purchased products from Defendant’s website on multiple occasions,” DI 22 at ¶ 88, and that his searches “reveal[ed] significant information about [his] sexual orientation, preferences, and habits.” Id. at ¶ 48. PHE meanwhile “embed[ed] a small piece of Google Analytics JavaScript measurement code into each page of its website” allowing “information about every category, page, and item that a consumer views [to be] sent to Google.” DI 22 at ¶¶ 32, 53. In the light most favorable to Mr. Delong, PHE allowed Google to spy on his sexual identity, which is a uniquely sensitive subject more similar to a credit card number than ordinary

product browsing. See Sterling v. Borough of Minersville, 232 F.3d 190, 196 (3d Cir. 2000) (“It is difficult to imagine a more private matter than one’s sexuality.”); Bloch v. Ribar, 156 F.3d 673, 685 (6th Cir. 1998) (“Our sexuality and choices about sex, in turn, are interests of an intimate nature which define significant portions of our personhood.”).4

4 Mr. Delong’s browsing patters also revealed more sensitive information than those at issue in similar district court cases where judges denied standing. For example, in Heaven v. Prime Hydration LLC, 761 F. Supp. 3d 812, 820 (E.D. Pa. 2025), Judge Quiñones Alejandro denied standing in a case where the plaintiff alleged that the defendant captured her searches for drink flavors such as “ice pop,” “meta moon,” and “blue raspberry,” reasoning that “[s]earches for drink products are not the kind of highly sensitive personal information that have historically provided a basis for privacy claims.” (citation modified). 8 PHE counters that regardless of the sensitivity of information at issue, Mr. Delong did not have a reasonable expectation of privacy while online shopping. We found this argument persuasive in PHE’s original motion to dismiss, as “[m]ost of us understand that what we do on the Internet is not completely private.” In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262,

266 (3d Cir. 2016). However, in Nickelodeon, the Third Circuit also recognized that a website operator can intrude upon the seclusion of its users “by collecting information using duplicitous tactics.” Id. at 295. Specifically in Nickelodeon, Viacom — the operator of Nick.com — asserted on its website that: “We don’t collect ANY personal information about your kids” id. at 269, while secretly using cookies to track children’s web browsing and video-watching habits. On these facts, the Court held that a reasonable jury could find the company violated the plaintiffs’ privacy. Id. at 295. Here, PHE did not break a promise as specific as that made by Viacom in Nickelodeon. However, Mr. Delong’s amended complaint plausibly alleges that the company fostered a false expectation among its users that it would keep their information private by “promulgat[ing]

numerous television commercials with the theme of privacy, touting the Website as a place where consumers can shop privately for adult products without worrying who sees.” See DI 22 at ¶¶ 17-23.5 And that once on the website, “[PHE] continue[d] to tout its dedication to privacy, stating directly on the homepage that it takes ‘privacy seriously.’” Id. at ¶ 24. We think these allegations remedy the deficiencies of the original complaint and place PHE’s conduct close enough to that of Viacom to survive a motion to dismiss. PHE’s strongest retort is that the company posts a privacy policy on its website (dating

5 As one example, a PHE ad says, “[G]o to adamandeve.com, where you shop privately for sexy items, delivered discretely to your door, free . . . .” DI 22 at ¶ 19. 9 back to February 1, 2020), that discloses its “use [of] non-invasive ‘cookies’ and other tracking technologies to collect information” and admits that “[w]hen visitors come to [PHE’s] Site, [PHE] collect[s] and aggregate[s] information indicating, among other things, which pages of the Site were visited, the order in which they were visited and which links on the site were clicked.”

See DI 28 at 7-8. However, Mr. Delong does not allege that he viewed this privacy statement, and we are hesitant to hold as a matter of law that a company that touts its privacy protections can automatically eliminate users’ reasonable expectations of privacy with messages on inconspicuous parts of its website. See James v. Glob. TelLink Corp, 852 F.3d 262, 267 (3d Cir. 2017) (“When terms are linked in obscure sections of a webpage that users are unlikely to see, courts have refused to find constructive notice.”).6 Therefore, Mr. Delong alleges a concrete harm sufficient to confer standing.7 B. Mr. Delong has alleged sufficient facts to establish personal jurisdiction over PHE We may exercise personal jurisdiction over an out-of-state defendant in diversity cases “to the extent permitted by the law of the forum state.” Hasson v. FullStory, Inc., 114 F.4th 181, 186 (3d Cir. 2024). The long-arm statute in Pennsylvania permits jurisdiction over defendants

6 We recognize that in denying the plaintiff standing in GameStop, the Third Circuit found it significant that GameStop “disclosed what information it would collect, albeit in an allegedly inconspicuous location on its website.” 148 F.4th at 162. But the plaintiff in GameStop did not allege, as Mr. Delong does here, that GameStop marketed its website as a place where users could shop privately, and thus there were no allegedly duplicitous tactics at issue in that case.

7 We acknowledge that standing in the online sphere presents novel issues and caselaw in this field is continuing to evolve. Thus, while Mr. Delong possesses standing now, PHE is welcome to raise this issue again in response to new developments in the caselaw. After all, we have a “continuing obligation to assure that we have jurisdiction.” Seneca Res. Corp. v. Twp. of Highland, Elk Cnty., Pennsylvania, 863 F.3d 245, 252 (3d Cir. 2017) (citation modified). 10 “based on the most minimum contact with th[e] Commonwealth allowed under the Constitution of the United States.” Id. (quoting 42 Pa. C.S. § 5322(b)). The Constitution — specifically the Due Process Clause of the Fourteenth Amendment — permits us to exercise general or specific jurisdiction over a defendant. Ford

Motor Co. v. Montana Eighth Jud. Dist. Ct., 592 U.S. 351, 358 (2021). We may exercise general jurisdiction “when a defendant is essentially at home in the State” and this jurisdiction “extends to any and all claims brought against a defendant.” Id. (citation modified). A corporation is at home in its place of incorporation and principal place of business. Id. at 359. For PHE, this is in North Carolina (see DI 7), and thus we, sitting in Pennsylvania, do not have general jurisdiction over the defendant.8 Contrastingly, we may exercise specific jurisdiction over “defendants less intimately connected with a State, but only as to a narrower class of claims.” Ford Motor, 592 U.S. at 359. “There are two prongs to the specific jurisdiction analysis.” Hepp v. Facebook, 14 F.4th 204, 207 (3d Cir. 2021). First, the defendant must have “minimum contacts” with the forum such that

it “purposefully avails itself of the privilege of conducting activities within the forum State, thus invoking the benefits and protections of its laws.” Asahi Metal Indus. Co. v. Superior Ct. of Cal., Solano Cnty., 480 U.S. 102, 109 (1987) (quoting Burger King Corp. v. Rudzewicz, 471 U.S. 462, 475 (1985)). Second, the plaintiff’s claims must “arise out of or relate to” at least some of those minimum contacts. Helicopteros Nat’l de Colom., S.A. v. Hall, 466 U.S. 408, 414 (1984). In other words, the defendant’s contacts in the forum should evidence “a strong relationship among

8 We note that Mr. Delong appears to concede that we cannot exercise general jurisdiction over PHE. See DI 26.

11 the defendant, the forum, and the litigation.” Hepp, 14 F.4th at 208 (3d Cir. 2021) (citation modified).9 Ford Motor Co. and Hasson guide our analysis. In Ford Motor, plaintiffs sued Ford on theories of product liability stemming from car accidents in Montana and Minnesota. The

Supreme Court concluded that the state courts could exercise personal jurisdiction over Ford because: (1) Ford purposefully availed itself of the two states’ markets by, among other things, “billboards, TV and radio spots, print ads, and direct mail” and (2) there was a strong relationship between Ford’s contacts in the states and the plaintiffs’ litigation as “Ford had systematically served a market in Montana and Minnesota for the very vehicles that the plaintiffs allege malfunctioned and injured them in those States.” 592 U.S. at 365-66. Meanwhile in Hasson, a plaintiff filed wiretapping and invasion of privacy claims against Papa Johns for its use of session replay code to intercept plaintiff’s online communications. 114 F.4th at 187-88. Similarly to the Supreme Court in Ford, the Third Circuit acknowledged that Papa Johns had purposefully availed itself of the Pennsylvania market by, among other things,

“regularly market[ing] and advertis[ing] its goods and services within Pennsylvania.” Id. at 193 (citation modified). But the Court found that these contacts did not sufficiently relate to the plaintiff’s litigation because plaintiff’s alleged harms centered on Papa Johns’ website — not its pizzas — and thus the plaintiff would have needed to allege facts “regarding the company's [in- forum] promotion of its website.” Id. at 194.

9 The Supreme Court has also articulated an “effects test” as an alternative means for determining whether we possess specific personal jurisdiction. See Hasson, 114 F.4th at 186 (3d Cir. 2024) (citing Calder v. Jones, 465 U.S. 783 (1984)). However, because we find that we can exercise personal jurisdiction over PHE through the traditional test, we decline to consider Mr. Delong’s allegations through the lens of the effects test. 12 Here, we think plaintiff’s amended complaint offers facts more similar to Ford Motor than Hasson and thus we can exercise personal jurisdiction over PHE. First, PHE purposefully availed itself of the Pennsylvania market by “advertising its website in Pennsylvania and by shipping products purchased on its website to customers in Pennsylvania.” DI 22 at ¶ 7. See

also Toys “R” Us, Inc. v. Step Two, S.A., 318 F.3d 446, 452 (3d Cir. 2003) (“If a defendant web site operator . . . knowingly conducts business with forum state residents via the site, then the purposeful availment requirement is satisfied.”). Second, while a closer call, Mr. Delong’s claims arise out of or relate to PHE’s purposeful contacts within the state. As in Hasson, Mr. Delong alleges PHE’s website — through its deployment of Google Analytics — harmed him, and thus Mr. Delong “must offer facts regarding [PHE’s] efforts to specifically direct or connect Pennsylvanians to the [website].” Hasson, 114 F.4th at 194. The amended complaint makes this connection: The complaint alleges that PHE “promulgated numerous television commercials [in Pennsylvania] with the theme of privacy, touting the Website as a place where consumers can shop privately for adult

products without worrying who sees.” DI 22 at ¶ 17 (emphasis added). The complaint then points to a few advertisements in particular which highlight the unique privacy afforded to consumers through online shopping and directs viewers to the Adam and Eve website. Id. at ¶¶ 18-23. As an example, one advertisement says in part, “We don’t need to hide anymore! Now, we can shop privately for adult products at adamandeve.com. . . . Private shopping starts at adamandeve.com.” Id. at ¶ 22. PHE counters that while its advertisements feature its website, the company is really promoting its products, which are not the focal point of this litigation. True enough. But the

13 Supreme Court has never required a perfect connection between the defendant’s in-state activity and the litigation. Ford Motor, 592 U.S. at 362; see also Bristol-Myers Squibb Co. v. Superior Ct. of California, San Francisco Cnty., 582 U.S. 255, 262 (2017). Rather, “our most common formulation of the rule demands that the suit arise out of or relate to the defendant’s contacts

with the forum.” Ford Motor, 592 U.S. at 362 (citation modified). Here, the amended complaint establishes the requisite relationship: Mr. Delong is from Pennsylvania, and he alleges he was harmed by PHE while navigating PHE’s website — a website that PHE expressly advertises to Pennsylvanians as an optimal method to purchase its products. See DI 22 at ¶¶ 11, 17-23. This is enough for us to exercise personal jurisdiction. C. Mr. Delong has alleged sufficient facts to make out a plausible claim under the WESCA

The WESCA “offers a private civil cause of action to ‘[a]ny person whose wire, electronic or oral communication is intercepted, disclosed or used in violation of [that statute]’ against ‘any person who intercepts, discloses or uses or procures any other person to intercept, disclose or use, such communication.’” Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121, 125 (3d Cir. 2022) (quoting 18 Pa. C.S. § 5725(a)). “In other words, [the WESCA] prohibits intercepting communications while allowing someone whose communications have been intercepted to sue the offender.” Id. PHE argues that Mr. Delong fails to state a claim under the WESCA for several reasons. First, PHE contends that Mr. Delong did not make a “communication” as defined under the statute. Second, PHE argues that Google did not capture the “contents” of Mr. Delong’s communications. Third, PHE argues that Google Analytics is not a “device” as construed under the statute. Finally, PHE contends that Mr. Delong’s “communications” were not captured in 14 Pennsylvania. DI 23-1 at 14. We reject these arguments.10 a. Mr. Delong has sufficiently alleged he made a “communication” under the WESCA WESCA defines an “electronic communication” as “any transfer of signs, signals, writing, images, sounds, data or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photo-optical system . . . .” 18 Pa. C.S. § 5702. Mr. Delong alleges that he sent an electronic communication when he “searched for and purchased products from [PHE’s] website on numerous occasions,” DI 22 at ¶ 88, and we think this could be considered an electronic communication. The statute’s use of the word any — i.e. “any transfer . . . of any nature” signifies the broad reach of the law, and we have been given no

persuasive reason to read it so narrowly as to preclude Mr. Delong’s allegations as a matter of law.11 See also Oliver v. Noom, Inc., No. 2:22-cv-1857, 2023 U.S. Dist. LEXIS 223965, at *18 (W.D. Pa. Aug. 22, 2023) (“The use of the word ‘any’ . . . indicates that the class of technology contemplated by WESCA is broad.”). Of course, Mr. Delong has the ultimate burden of showing that his browsing on PHE’s website constituted a “communication,” but discovery will provide both parties with a chance to further develop the record on this.

10 PHE also contends that Mr. Delong cannot state a claim under WESCA because his intercepted communications did not contain private information nor were the communications disclosed to the public at large. However, the statute does not require a plaintiff’s communications to be sufficiently private (whatever that means) nor that the communications be disclosed to the broader public.

11 See 1 Pa. Stat. § 1921(b) (“When the words of a statute are clear and free from all ambiguity,” a court must not “disregard[] [the words] under the pretext of pursuing its spirit.”); Nicole B. v. Sch. Dist. of Philadelphia, 237 A.3d 986, 994 (Pa. 2020) (“Thus, when the words of a statute have a plain and unambiguous meaning, it is this meaning which is the paramount indicator of legislative intent.”); see also Robert D. Mabe, Inc. v. OptumRx, 43 F.4th 307, 320 (3d Cir. 2022) (“If the statute’s plain language is unambiguous and expresses Congress’s intent with sufficient precision, we need not look further” (quotation omitted).). 15 b. Mr. Delong has sufficiently alleged that the “content” of his communications was intercepted

WESCA prohibits the interception of communications and defines “intercept” as “[a]ural or other acquisition of the contents of any wire, electronic or oral communication through the use of any electronic, mechanical or other device.” 18 Pa. C.S. § 5702 (emphasis added). Therefore, Mr. Delong must plead that Google acquired the contents of his communication. WESCA defines “contents” as “any information concerning the substance, purport, or meaning of that communication.” § 5702. The words “substance, purport, or meaning” are not further defined by the statute, but we find the Ninth Circuit’s analysis of these words persuasive in that they denote “a person’s intended message . . . i.e., the essential part of the communication.” In re Zynga Priv. Litig., 750 F.3d 1098, 1106 (9th Cir. 2014) (citation modified).12 A communication’s contents are distinct from its metadata (also known as record information). See In re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125, 137 (3d Cir. 2015). Here, Mr. Delong alleges that his interactions on PHE’s website were sent to Google in the form of uniform resource locators (URLs). DI 22 at ¶¶ 52-57. And whether a URL is content or record information is a context dependent inquiry. As the Third Circuit explains, “URLs may be . . . routing, addressing, or signaling information, but only when they are performing such a function. If an address, phone number, or URL is instead part of the substantive information conveyed to the recipient, then by definition it is content.” In re Google

12 The Ninth Circuit was interpreting the Federal Wiretap Act, 18 U.S.C. § 2510 et seq., but the federal statute defines “contents” identically to the WESCA. This makes sense because the WESCA “operates in conjunction with and as a supplement to the Federal Wiretap Act.” Popa, 52 F.4th at 125-26; see also St. Tammany Par., ex rel. Davis v. FEMA, 556 F.3d 307, 320 (5th Cir. 2009) (“[A]s a matter of statutory interpretation, in determining the meaning of a particular statutory provision, it is helpful to consider the interpretation of other statutory provisions that employ the same or similar language.” (quotation omitted)). 16 Inc., 806 F.3d at 137 (citation modified). A District of Massachusetts decision — referenced by the Third Circuit in Google — fleshes out the content/record distinction in URLs further, explaining: “[I]f the user [] enters a search phrase [into Google], that search phrase would appear in the URL after the first forward slash. This would reveal content . . . that the user is conducting a search for information on a particular topic.” Jn re Application of the U.S., 396 F. Supp. 2d 45, 49 (D. Mass. 2005); see also United States v. Forrester, 512 F.3d 500, 510 n.6 (9th Cir. 2008) (“A URL, unlike an IP address, identifies the particular document within a website that a person views and thus reveals much more information about the person's Internet activity.”). In this case, Mr. Delong alleges that Google captured users’ URLs revealing “the subjects searched, the categories browsed, the products viewed, and the products purchased.” DI 22 at 4.57. An example that Mr. Delong gave in the complaint is shown below:

Request URL: https: //www.google-analytics.com/j/collect?v=18&_v=]998a=7464180848t =page □□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□ search. aspxe3F □□□□□□□□□□□□□□□□□□□□□□□□□ l*he-il&de=UTF -8&dt=Sexk20Toysx20by%20adameve.come20-%20Adultk20Sexk20T oyse2Oab2RG0% □□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□ fear enseneg bitésr=1536x8644avp=/12x 697&je=O&_u-SCCAAEALAAAAAC □□□□□□□□□□□□□□□□□□□□□ Tota Tos. 16782098598t id-UA-1283698-1 & gid=106492676.16804254798_slc=1&z=567301132 Request Method: POST Status Code: @ 200 Remote Address: 142.250.1908 .143:443 Referrer Policy: strict-origin-when-cross-origin

Id. at 954. Therefore, we think Mr. Delong plausibly alleges that Google intercepted the contents of his communications; we may reexamine this issue at summary judgment with the benefit of a full record. See also Doe v. Post Acute Med., LLC, No. 1:24-CV-547, 2025 WL 511069, at *5 (M.D. Pa. Feb. 14, 2025) (“[T]he acquisition of at least some content may be properly inferred from a complaint that includes facts plausibly demonstrating a broad scheme in

which the defendants generally acquired and tracked the plaintiffs’ internet usage.”) (citation modified).13 c. Mr. Delong has sufficiently alleged that Google Analytics is a “device” under the WESCA The WESCA prohibits the interception of communications and defines “intercept” as “[a]ural or other acquisition of the contents of any wire, electronic or oral communication through the use of any electronic, mechanical or other device.” 18 Pa. C.S. § 5702 (emphasis added). Hence, Mr. Delong must plead that Google Analytics qualifies as a “device.” The WESCA defines an “electronic, mechanical, or other device” as: Any device or apparatus, including, but not limited to, an induction coil or a telecommunication identification interception device, that can be used to intercept a wire, electronic or oral communication other than:

(1) Any telephone or telegraph instrument, equipment or facility, or any component thereof, furnished to the subscriber or user by a provider of wire or electronic communication service in the ordinary course of its business, or furnished by such subscriber or user for connection to the facilities of such service and used in the ordinary course of its business, or being used by a communication common carrier in the ordinary course of its business, or by an investigative or law enforcement officer in the ordinary course of his duties.

(2) A hearing aid or similar device being used to correct subnormal hearing to not better than normal.

13 PHE cites the district court’s decision in GameStop to support its contention that Google did not capture the contents of Mr. Delong’s communication. See Cook v. GameStop, Inc., 689 F. Supp. 3d 58, 70 (W.D. Pa. 2023). But the Court in GameStop acknowledged that “whether a URL involves contents depends on how much information would be revealed by disclosure” and sided against the plaintiff because her amended complaint did not specify “what those [URL] searches were, whether she hit ‘enter’ after typing the searches, and whether that action generated a new URL that could be recorded by the Session Replay Code.” Id. at 71 (citation modified). Here, in contrast, Mr. Delong attaches screenshots in his amended complaint of the exact URLs that Google Analytics supposedly captured when users navigate through PHE’s website. See DI 22 at ¶¶ 52-57.

18 (3) Equipment or devices used to conduct interceptions under section 5704(15) (relating to exceptions to prohibition of interception and disclosure of communications).

§ 5702. Google Analytics may meet this definition. Specifically, Mr. Delong alleges that “Google Analytics (1) simultaneously communicates information to an external server while a user navigates a website; (2) tracks users across devices, meaning that a user’s actions on multiple devices all will be included in the information stored regarding that user; (3) is not easily disabled by users; and/or (4) creates a record of all of the information that users provide to and/or receive from the Website.” DI 22 at ¶ 69. That is sufficient at this stage. We also find the statute’s use of the phrase “any device” — similarly to how we reasoned with WESCA’s definition of “electronic communication” — as indicative of the statute’s broad reach. See again Oliver, 2023 U.S. Dist. LEXIS 223965, at *18. We also note that Google Analytics does not appear to fit into the list of enumerated exceptions to the statute’s definition of “device.” See 1 Pa. C.S.A. § 1924 (“Exceptions expressed in a statute shall be construed to exclude all others.”); see also Com. v. Shreffler, 201 A.3d 757, 764 (Pa. Super. 2018) (“[The WESCA] is to be strictly construed to protect individual privacy rights.”). Finally, PHE cites no caselaw nor any other authority for the proposition that a web-based analytics mechanism like Google Analytics cannot constitute a device. Like the other issues identified by PHE, this one also bears some development. d. Mr. Delong has sufficiently alleged that the alleged interception occurred in Pennsylvania Although WESCA does not set an explicit geographic limitation, “Pennsylvania courts have declined to extend the WESCA to cover conduct occurring wholly outside the Commonwealth . . . .” Popa, 52 F.4th at 130. The Third Circuit has clarified “that an 19 interception occurs where there is an act taken to gain possession of communications using a device.” Id. For electronic communications, this means “when software reroutes communications to an interceptor.” Id. Here, Mr. Delong alleges that Google Analytics — the software — reroutes communicates to the interceptor — Google — “[w]hen a user accesses a

website hosting Google Analytics.” DI 22 at ¶ 32. Thus, for Mr. Delong, the point of interception occurred where he accessed PHE’s website. See Popa, 52 F.4th at 131. Mr. Delong is a citizen of Pennsylvania, DI 22 at ¶ 11, and therefore it is plausible that Google’s interception of his records took place inside the Commonwealth. We may deny the motion on this ground as well.14 IV. Conclusion For the reasons explained above, we deny PHE’s motion to dismiss. An appropriate order follows this memorandum.

14 PHE highlights a section of Mr. Delong’s complaint where he writes that his “communications were transmitted or passed over a wire, line, or cable, and were sent and/or received within California.” DI 22 at ¶ 119 (emphasis added). This line certainly injects confusion into his allegations. However, Mr. Delong says that the inclusion of “California” was a scrivener’s error (DI 26 at 27), and we take Mr. Delong at his word rather than requiring him to produce a second amended complaint. 20