CFDBPA Limited to Consumer Transactions; Cybersecurity Risk Fear Alone Lacks Article III Standing; Utility Disconnection Process Satisfies Due Process When Meaningful Review Exists

Case: Gordon Ackley v. Virgin Islands Water and Power Authority, Nos. 25-1916 & 25-3435 (3d Cir.)
Court: U.S. Court of Appeals for the Third Circuit
Date: June 8, 2026
Disposition: Nonprecedential opinion (not binding under I.O.P. 5.7); judgment affirmed

1. Introduction

This appeal arose from a putative class action brought by Virgin Islands electricity ratepayers against the Virgin Islands Water and Power Authority (“VIWAPA”) and two private entities involved in VIWAPA’s metering system: Tantalus Systems, Inc. (“Tantalus”) (system provider) and Itron, Inc. (“Itron”) (manufacturer). Plaintiffs attributed alleged overbilling, disconnection threats, and metering malfunctions to the system’s performance and to VIWAPA’s billing practices.

The case presented three clusters of issues:

• Territorial consumer-protection scope: whether the CFDBPA applies to the sale of a metering system to a public utility.
• Article III standing in a risk-of-harm theory: whether alleged vulnerability to cyberattack—without an attack—supports a failure-to-warn tort claim.
• Procedure and proof: (i) whether appellate review was preserved regarding a magistrate-ordered discovery stay; (ii) whether the district court properly struck undisclosed witness declarations at summary judgment; and (iii) whether VIWAPA provided constitutionally adequate process before potential service termination.

2. Summary of the Opinion

The Third Circuit affirmed across the board. It held:

• The CFDBPA claim against Tantalus and Itron failed because the statute targets consumer transactions, and VIWAPA’s procurement of grid metering equipment is a commercial/public-utility acquisition outside the Act’s definitions.
• Plaintiffs lacked Article III standing to press the failure-to-warn tort theory premised on cybersecurity vulnerability because they pleaded neither an actual cyberattack nor an imminent one; their asserted harms were fear and anxiety about speculative future events.
• Plaintiffs forfeited any challenge to the magistrate judge’s stay of discovery by not seeking district-judge review under Rule 72(a), and no exceptional circumstances warranted overlooking forfeiture; the issue was also moot after dismissal of the relevant claims.
• The district court did not abuse discretion in striking certain witness declarations under Rule 37(c)(1) for Rule 26 disclosure failures, and VIWAPA was entitled to summary judgment on the procedural due process claim because customers received notice and meaningful channels to contest bills and avert termination (including PSC review), satisfying Memphis Light.

3. Analysis

3.1 Precedents Cited

(A) Pleading and Rule 12(b)(6) framing

• Mayer v. Belichick — Cited for the de novo standard of review and the plausibility requirement on a motion to dismiss. The opinion uses Mayer as the baseline lens: accept well-pleaded facts as true, but require sufficient factual allegations to state a facially plausible claim.

(B) CFDBPA scope and “consumer transaction” limitation

• Gov't of U.S.V.I. v. Takata Corp. — The court relied on Takata’s interpretation that “usually sold directly to the consumer” limits the CFDBPA to consumer (not general commercial) transactions. That interpretive move was decisive: a utility’s purchase of metering infrastructure is not “merchandise” sold directly to household consumers, so the statute does not apply.
• Ndungu v. Att'y Gen. United States, Singh v. Att'y Gen., and Keeley v. Loomis Fargo & Co. — These cases supplied the methodology for treating a territorial trial-court decision as persuasive authority absent “persuasive data” that the highest local court would disagree. They supported the panel’s use of Takata as persuasive, non-binding guidance on Virgin Islands law.
• Laurel Gardens, LLC v. Mckenna and In re Google Inc. Cookie Placement Consumer Priv. Litig. — Cited for the appellate principle that a judgment may be affirmed on any ground supported by the record. This allowed the court to resolve the CFDBPA issue on statutory scope without reaching alternative disputes noted in the footnotes (including certain exemptions/forfeiture arguments).
• Banks v. Int'l Rental & Leasing Corp. — Mentioned in passing as an argument the panel did not need to reach. The reference signals that Virgin Islands courts sometimes apply a structured approach to adopting common-law rules; here, the panel avoided that terrain because the consumer-fraud claim failed at the threshold statutory-definition stage.

(C) Article III standing and risk-of-harm allegations

• Food & Drug Admin. v. All. for Hippocratic Med. — Provided the modern, tightly framed requirements for injury-in-fact: concrete, particularized, and actual or imminent. The court used this to reject a “vulnerability” theory unaccompanied by an actual or imminent cyber event.
• Reilly v. Ceridian Corp. — Served as the analog for rejecting standing where injury depends on a speculative chain of events. The panel’s reasoning closely tracked Reilly: fear of future harm and increased risk, without more, is not enough when the triggering event has not happened and is not plausibly imminent.
• Russell v. DeJongh — Explained why Article III standing applies in the District Court of the Virgin Islands (an Article IV court with Article III-like jurisdictional prerequisites). This prevented plaintiffs from avoiding federal standing requirements by invoking the territorial setting.

(D) Preservation/forfeiture of discovery-order challenges and mootness

• Simko v. U.S. Steel Corp. — Established that failure to appeal a magistrate judge’s nondispositive order to the district judge under Rule 72(a) forfeits the issue on appeal, absent “truly exceptional circumstances.” This was the controlling authority on forfeiture.
• Chafin v. Chafin — Cited for mootness: a court cannot grant effectual relief when the underlying dispute is no longer live. The panel used it to bolster the conclusion that, given dismissal of the complaint, even a discovery-stay error would not change anything.

(E) Summary judgment standards and discovery sanctions

• Jutrowski v. Township of Riverdale — Supplied the de novo standard of review for summary judgment decisions.
• Nicholas v. Pa. State Univ. and Konstantopoulos v. Westvaco Corp. — Anchored the abuse-of-discretion standard for discovery sanctions and provided the familiar Nicholas factors (prejudice/surprise, ability to cure, disruption, and bad faith/willfulness). The court’s analysis hewed to these factors to uphold exclusion of undisclosed witness declarations.

(F) Procedural due process for utility termination and exhaustion-like principles

• Memphis Light, Gas, and Water Div. v. Craft — The keystone due process precedent. The panel applied Memphis Light’s requirement that customers facing termination receive notice and an opportunity to present disputes to an empowered employee who can correct errors. The described VIWAPA process—disconnection notice, contact options, customer service review, forms, and PSC appeal—was held to satisfy this standard.
• Alvin v. Suzuki — Used to reject plaintiffs’ attempt to bypass available procedures on futility grounds. The court emphasized Alvin’s rule: unless procedures are “unavailable or patently inadequate” (or a “sham”), plaintiffs must use them and cannot “skip that process and use the federal courts” as the first resort.
• Gagliardo v. Connaught Lab'ys, Inc. — Cited to reject emotional-distress assertions that were not tied to a due process violation with a “reasonable probability” of damages having been incurred because of that violation.

3.2 Legal Reasoning

(A) CFDBPA: definitional gatekeeping over policy intuitions

The court’s CFDBPA analysis was definition-driven. It walked through the statute’s textual components—“deceptive trade acts,” “consumer goods or services,” “consumer,” and “merchandise”—and treated them as limiting principles rather than broad remedial language. The central move was characterizing the relevant transaction correctly: not the downstream relationship between ratepayers and electric service, but the upstream procurement contract between VIWAPA and the metering vendors.

Because a metering system sold to a utility for grid deployment is not “an article of commerce usually sold directly to the consumer,” plaintiffs could not fit the transaction into the Act’s consumer-protection architecture. The opinion thereby reinforces a common statutory boundary: consumer-fraud statutes often do not convert commercial procurement disputes into consumer claims merely because end-users are affected.

(B) Standing: vulnerability and anxiety are not “imminent injury”

Plaintiffs alleged a failure to warn about cybersecurity vulnerabilities that could lead to outages (lost power). The court treated that as a risk-of-harm theory and applied the Supreme Court’s and Third Circuit’s standing framework: injury must be real and not abstract, and “actual or imminent” rather than speculative.

The complaint did not allege a cyberattack, nor facts making one likely to occur “soon.” As a result, the causal chain depended on multiple contingencies (an attacker, a successful exploitation, operational impact, and service loss), and the only current harm asserted was fear/anxiety. Under the logic of Food & Drug Admin. v. All. for Hippocratic Med. and Reilly v. Ceridian Corp., that is insufficient for Article III.

(C) Discovery stay: Rule 72(a) as a strict preservation requirement

The court enforced appellate preservation rules rigorously: a magistrate judge’s nondispositive discovery order must be challenged by timely objection/appeal to the district judge under Rule 72(a). Failure to do so forfeits the issue, and only “truly exceptional circumstances” justify review.

The panel also pointed out a practical constraint: once the underlying claims were dismissed, a discovery-stay dispute became incapable of providing meaningful relief (mootness), reinforcing why procedural preservation matters early.

(D) Witness exclusions: Rule 37(c)(1) as a real summary-judgment gate

The court upheld the exclusion of witness declarations offered in opposition to summary judgment because plaintiffs failed to timely and properly disclose witnesses under Rule 26. This is significant because it illustrates how Rule 37(c)(1) operates as a potent evidentiary gate at the dispositive-motion stage—not only at trial.

Applying the Nicholas factors, the district court found prejudice (no meaningful chance to depose or conduct targeted discovery), limited ability to cure without disrupting the schedule (because declarations appeared inside the summary judgment opposition), and lack of harmlessness. The attempted “rebuttal/impeachment” characterization failed because the declarations were used substantively to create fact disputes, not to impeach a defense witness’s credibility.

(E) Due process: adequate procedures defeat a procedural due process claim absent evidence of sham or inadequacy

On the merits, the court treated the due process claim as procedural, not a vehicle to litigate the correctness of the underlying bills. Under Memphis Light, the constitutional minimum is notice plus an opportunity to present disputes to someone empowered to correct errors before termination.

VIWAPA’s system—disconnection notice instructing immediate contact, customer service representatives available to work toward resolution, dispute forms, and escalation to the Public Services Commission with statutory oversight—was deemed constitutionally sufficient. Plaintiffs’ failure to use these channels (by claiming futility) was rejected under Alvin v. Suzuki absent evidence the procedures were a sham or patently inadequate.

3.3 Impact

(A) Consumer protection in the Virgin Islands: narrowing by transaction-type

Even though the opinion is nonprecedential, its reasoning signals a restrictive approach to CFDBPA scope in federal court: upstream utility procurement and vendor-to-utility equipment sales are not easily reframed as consumer transactions. Future litigants seeking CFDBPA remedies will likely need to plead a direct consumer-facing sale or marketing practice, not merely downstream consumer impact.

(B) Cybersecurity litigation: pleading “imminence” matters

The standing holding aligns with a demanding view of risk-based injuries. Plaintiffs alleging exposure to cyber risk must plead more than vulnerability plus fear; they must allege facts supporting an actual compromise or a plausible, imminent threat producing concrete harm. The decision thus raises the bar for “failure to warn about cyber vulnerabilities” claims in federal court when no incident has occurred.

(C) Civil procedure: preservation and disclosure discipline

The opinion underscores two practical litigation imperatives:

• Preserve discovery disputes: magistrate orders must be timely challenged under Rule 72(a) or the issue is effectively lost on appeal.
• Disclose witnesses early and specifically: late or absent Rule 26 disclosures risk exclusion of declarations, which can be case-determinative at summary judgment.

(D) Utility due process: focus on process availability, not billing accuracy

For public utilities, the decision reinforces that due process claims will rise or fall on whether meaningful dispute-resolution procedures exist and are accessible. For customers, it indicates that courts may expect use of internal dispute processes and regulator review before framing a constitutional procedural claim—unless there is evidence those processes are illusory.

4. Complex Concepts Simplified

• CFDBPA coverage (“consumer transaction”): The Act is aimed at deceptive practices in consumer buying/selling. A company selling equipment to a utility (not to households) is typically a business-to-business/public procurement deal, not “merchandise usually sold directly to the consumer.”
• Article III standing / “injury-in-fact”: To sue in federal court, you need a real, personal harm that already happened or is very likely to happen soon. Being worried about a possible future cyberattack, without facts showing it is imminent, is not enough.
• Rule 72(a) forfeiture: If a magistrate judge issues a discovery order, you generally must object to the district judge promptly. If you do not, you usually cannot complain about it later on appeal.
• Rule 26 disclosures and Rule 37(c)(1) exclusion: Parties must disclose witnesses and information in time for the other side to investigate. If you fail to do that, the court can bar you from using those witnesses, including at summary judgment, unless the failure is justified or harmless.
• Procedural due process in utility shutoffs: The Constitution requires fair procedures before cutting off essential services—typically notice and a real chance to dispute the bill with someone who can fix errors. It does not guarantee that bills will never be wrong; it guarantees a fair way to challenge them.
• “Sham” procedures / futility: You can sometimes skip a grievance or dispute process if it is fake or obviously inadequate. But you need evidence of that; mere belief that complaining won’t help is usually insufficient.

5. Conclusion

The Third Circuit’s decision—though nonprecedential—offers a tightly structured roadmap for disposing of multi-claim utility-and-vendor litigation: (1) consumer-fraud statutes are limited by their definitions and may not reach utility procurement; (2) speculative cyber-risk fears do not establish Article III standing absent actual or imminent harm; (3) appellate review of discovery management requires Rule 72(a) preservation; (4) Rule 26 compliance is essential to using witness evidence at summary judgment; and (5) procedural due process claims fail where the utility provides notice and meaningful, empowered review mechanisms, and plaintiffs cannot show those mechanisms are a sham or patently inadequate.