Duane Morris Takeaways: On August 7, 2025, in an opinion authored by Circuit Judge D. Michael Fisher, the United States Court of Appeals for the Third Circuit issued a precedential decision in Cook v. GameStop, Inc., 148 F.4th 153 (3d Cir. 2025), affirming the U.S. District Court for the Western District of Pennsylvania's dismissal for lack of standing of a putative class action asserting privacy causes of action against a website operator monitoring clicks. The Third Circuit found that merely tracking internet users' browsing time and website interactions ' without recording or disclosing sensitive or personal information ' fails to constitute the type of concrete injury required to confer Article III standing. The decision is instructive for corporate counsel dealing with privacy issues and defense of class action litigation.
Case Background
Plaintiff Amber Cook ("Cook" or "Plaintiff") was an internet user that visited GameStop's website in Pennsylvania. See Cook, 148 F.4th 153, 156. Through third-party vendor Microsoft and its programming script called Clarity, GameStop was tracking internet user's browsing history and interaction with its website. Id. The script Clarity creates is known as a "session replay code" that aggregates data about how long the user browsed the website, mouse movement, links clicked, scrolling, search bar entries, and products added and removed from the "cart." Id. The script creates a unique id and profile for each user and recaptures each user's session through a video which GameStop could review to improve functionality and user experience. Id. The unique ids and profiles do not utilize personally identifying information such as names, addresses, and the like. Id. at 160. GameStop's website has a privacy policy describing the script and information collected but this policy is "buried at the very bottom of the website." Id. at 156.
Cook sued GameStop for its use of the Clarity script, alleging that it violated the Pennsylvania Wiretapping and Electronic Surveillance Control Act ("WESCA") and asserting a common law cause of action for intrusion upon seclusion. Cook alleged that the WESCA and privacy tort for intrusion upon seclusion prohibit the interception of electronic communications without prior consent and she suffered an injury in fact "''when her communications with . . . GameStop's website were intercepted' by the session replay code." GameStop moved to dismiss the First Amended Complaint at the District Court level pursuant to Federal Rule of Civil Procedure 12(b)(6) and 12(b)(1). See Case No. 2:22-CV-01292, ECF No. 25-27. The District Court granted GameStop's motion under Rule 12(b)(1) with prejudice and, in the alternative, held that Cook failed to "plead the necessary facts to support her claims for violation of [WESCA] or intrusion upon seclusion." See Case No. 2:22-CV-01292, ECF No. 45-46. Specifically, the District Court concluded that Cook's harms were not analogous to the traditional intangible harms recognized by privacy torts because none of the data gathered "could connect her browsing activity to her." See Case No. 2:22-cCV01292, ECF No. 46, at 8 (emphasis in the original). Cook appealed the District Court's decision on standing to the Third Circuit.
The Third Circuit's Ruling
Reviewing whether Cook's allegations met the Article III standing threshold de novo, the Third Circuit...
