A Pennsylvania federal district court overseeing a multi-district litigation recently dismissed various privacy and wiretapping claims against two online retailers, finding that allegations of interception and disclosure of mere “browsing activity” on those retailers’ websites is not “sufficiently personal or private” to confer Article III standing. 

In In re: BPS Direct, LLC, and Cabela’s, LLC, Wiretapping Litigation, 2:23-cv-04008-MAK (E.D. Pa. Dec. 5, 2023), the district court consolidated six proposed class actions involving eight plaintiffs, with each alleging that BPS Direct, LLC and Cabela’s, LLC, who operate retail stores known as Bass Pro Shops and Cabela’s, unlawfully intercepted and disclosed their private information through the use of session replay software on their websites.  The district court dismissed most of the plaintiffs’ claims, holding that they failed to adequately allege a concrete harm sufficient to support Article III standing.

Consistent with the Supreme Court’s reasoning in TransUnion v. Ramirez, 141 S. Ct. 2090 (2021), the district court examined the nature of the information allegedly intercepted and disclosed to determine if it amounted to an invasion of a historically protected privacy interest.  In doing so, the district court distinguished between a website user’s “browsing activity,” such as mouse and scroll movements, keystrokes, search terms, substantive information inputted, or pages viewed, and a website user’s “highly sensitive personal information,” such as medical or financial information.  The district court held that the alleged interception and disclosure of “browsing activity” was insufficient to establish a concrete injury, reasoning that such activity “is no different than what Bass Pro Shops and Cabela’s employees would have been able to observe if website users had gone into a brick-and-mortar store and began browsing the inventory.”  Thus, the court held that a website user had no privacy interest in “browsing activity” sufficient to confer Article III standing.

Because six of the plaintiffs had twice failed to allege anything more than the interception and disclosure of their “browsing activity,” the district court dismissed their claims with prejudice.  The district court dismissed the claims of the other two plaintiffs without prejudice to the extent they could truthfully allege that Bass Pro Shops and Cabela’s intercepted and disclosed their highly sensitive personal information under Rule 11.