Session-Replay Capture of Complete Payment Card Data Confers Article III Standing Under Intrusion Upon Seclusion

I. Introduction

In re: BPS Direct, LLC; Cabela's, LLC Wiretapping Litigation (3d Cir. May 11, 2026) addresses whether website users have Article III standing to sue retailers Bass Pro Shops and Cabela’s (collectively, “BPS”) for embedding Session Replay Code—JavaScript that allegedly records users’ on-site interactions (mouse movements, clicks, keystrokes, text entries) and enables “video replay[s]” of visits.

Eight named plaintiffs brought a putative class action alleging that BPS’s session replay practices, implemented through third-party providers (e.g., Microsoft, Quantum Metric, Mouseflow), violated the Wiretap Act, the Computer Fraud and Abuse Act, and various state and common-law privacy theories. The key dispute on appeal was not the merits, but whether the plaintiffs alleged a sufficiently concrete injury to satisfy Article III.

The Third Circuit drew a sharp line between (a) users who merely browsed and (b) users who, during checkout, entered sensitive payment information. It also corrected the district court’s remedial error by reiterating that dismissals for lack of standing must generally be without prejudice.

II. Summary of the Opinion

  • Two plaintiffs (Heather Cornell and Peter Montecalvo) have standing: their allegations that Session Replay Code captured their “payment and billing information” during purchases—reasonably inferred to include a complete credit/debit card number with expiration date and security code—state an intangible injury closely analogous to intrusion upon seclusion.
  • Six plaintiffs lack standing: those who only browsed for products, entered no identifying or sensitive information, and alleged only routine website interactions (clicks, scrolls, search terms) did not plausibly allege an invasion of “private affairs” under the common-law analogues.
  • No plaintiff established a “public disclosure of private facts” analogue: sharing data with session replay providers, as alleged, remained “functionally internal” and not a “publicity” disclosure.
  • Procedural correction: the six non-standing plaintiffs’ claims should be dismissed without prejudice, not with prejudice.
  • Disposition: the court reversed dismissal as to Cornell and Montecalvo, modified the rest to dismissal without prejudice, affirmed as modified, and remanded.

III. Analysis

A. Precedents Cited

1. TransUnion LLC v. Ramirez and Spokeo, Inc. v. Robins: the “close relationship” framework

The opinion applies the Supreme Court’s now-standard approach for intangible harms: a plaintiff must allege an injury with a “close relationship” to a harm traditionally recognized at common law. The court quotes TransUnion LLC v. Ramirez and Spokeo, Inc. v. Robins to reiterate that “concrete” means “real,” and that statutory violations alone do not automatically supply Article III injury.

Practically, the Third Circuit treats TransUnion/Spokeo as requiring a disciplined tort-analogue comparison: not “privacy” in the abstract, but a match (or close kinship) between the kind of harm alleged and the kind of harm redressed by a recognized comparator tort.

2. Barclift v. Keystone Credit Servs., LLC: “functionally internal” sharing defeats public-disclosure analogy

Barclift v. Keystone Credit Servs., LLC supplies the decisive limitation on the plaintiffs’ “public disclosure of private facts” theory. There, disclosure to a “single ministerial intermediary” (a mailing vendor) was not “publicity,” so the harm did not resemble the tort’s humiliation-from-public-scrutiny core.

In BPS, the Third Circuit extends that logic: even if providers store session data on their servers, the pleaded use is to send the information back to BPS for business analytics. Without allegations that providers disseminated the data beyond BPS, the sharing remains “functionally internal”, foreclosing the public-disclosure analogue for all plaintiffs, including the purchasers.

3. Cook v. GameStop, Inc.: non-sensitive session replay capture is not an intrusion into private affairs

The court treats Cook v. GameStop, Inc. as the controlling Third Circuit template for session replay standing. In GameStop, the plaintiff alleged session replay capture of browsing interactions but did not enter identifying or billing information. The Third Circuit held there was no concrete injury under either:

  • public disclosure of private facts (no sensitive information disclosed), or
  • intrusion upon seclusion (no plausible intrusion into “private affairs” absent sensitive/personal content).

BPS largely tracks GameStop for the six browsing-only plaintiffs and then distinguishes it for Cornell and Montecalvo based on the alleged capture of highly sensitive payment-card data.

4. Additional standing and pleading authorities: In re Horizon Healthcare Servs. Inc. Data Breach Litig., Potter v. Cozen & O'Connor, Road-Con, Inc. v. City of Philadelphia, and Lutz v. Portfolio Recovery Assocs., LLC

The opinion relies on familiar circuit doctrine to frame review and inference:

  • In re Horizon Healthcare Servs. Inc. Data Breach Litig. and Potter v. Cozen & O'Connor support de novo review and the rule that a complaint must include sufficient factual matter that would establish standing if accepted as true.
  • Road-Con, Inc. v. City of Philadelphia restates standing as an “irreducible constitutional minimum.”
  • Lutz v. Portfolio Recovery Assocs., LLC supports drawing reasonable inferences—critical to construing “payment and billing information” to mean a complete payment-card number with associated credentials.

5. The common-law comparator tort: Restatement (Second) of Torts § 652D and § 652B

Rather than treating “privacy” as one monolith, the court uses specific Restatement formulations:

  • Restatement (Second) of Torts § 652D (1977) (“Second Restatement § 652D”) for public disclosure of private facts, emphasizing “publicity” and “highly offensive” private facts.
  • Restatement (Second) of Torts § 652B (1977) (“Second Restatement § 652B”) for intrusion upon seclusion, emphasizing an intentional intrusion into solitude/seclusion or private affairs that would be highly offensive.

6. Persuasive authority on privacy intrusions: Dickson v. Direct Energy, LP, Lupia v. Medicredit, Inc., Pileggi v. Washington Newspaper Publishing Company, LLC, and Perry v. Cable News Network, Inc.

To clarify the breadth (and limits) of intrusion upon seclusion, the court draws on other circuits:

  • Dickson v. Direct Energy, LP is cited for the point that the kind of harm vindicated by intrusion upon seclusion is broad, even though the liability boundary is narrowed by the “highly offensive” requirement.
  • Lupia v. Medicredit, Inc. reinforces the tort’s protection against intrusions into private solitude.
  • Pileggi v. Washington Newspaper Publishing Company, LLC is the key persuasive analogue: covert transmission of video-viewing information to Meta was deemed analogous to intrusion upon seclusion because media consumption can reveal sensitive, historically private interests.
  • Perry v. Cable News Network, Inc. is cited in support of treating disclosure of video-rental/purchase records as analogous to intrusion upon seclusion.

7. Payment data sensitivity: Jones v. Bloomingdales.com, LLC and Jeffries v. Volume Servs. Am., Inc.

While the court ultimately rejects a public-disclosure analogue for lack of “publicity,” it uses these cases to underscore the sensitivity of payment data:

  • Jones v. Bloomingdales.com, LLC is referenced for describing credit card information as “personal information.”
  • Jeffries v. Volume Servs. Am., Inc. is invoked to emphasize the gravity of exposing a full card number and expiration date—a “nightmare scenario”—illustrating why complete card credentials are inherently sensitive.

B. Legal Reasoning

1. The court’s central move: identifying the “kind of harm” and matching it to the right tort

The Third Circuit treats the standing inquiry as a taxonomy problem: plaintiffs must place their alleged injury into a recognized historical bucket. The plaintiffs proposed two: public disclosure of private facts and intrusion upon seclusion. The court’s analysis turns on what the technology captured and what happened (or is alleged to have happened) to the captured data.

2. Why the “public disclosure of private facts” analogue fails—even for purchasers

The opinion accepts that a complete credit/debit card number is the kind of sensitive fact whose unauthorized public revelation would be highly offensive. But it insists on the tort’s defining element: “publicity”.

Allegations that information was shared with session replay providers do not satisfy the comparator tort because the complaint does not allege dissemination beyond the BPS–provider relationship. Under Barclift v. Keystone Credit Servs., LLC, disclosure to an intermediary that functions as part of the defendant’s operational pipeline remains “functionally internal”—not “public disclosure.”

3. Why browsing-only plaintiffs fail under “intrusion upon seclusion”

The court acknowledges intrusion upon seclusion can be broad, but insists that an “intrusion into private affairs” requires plausibly private affairs.

For the six browsing-only plaintiffs, the alleged captured data—clicks, scrolls, routine product searches—was not plausibly private, particularly where they entered no sensitive or identifying information. Echoing Cook v. GameStop, Inc., the court analogizes such browsing to ordinary in-store window-shopping: observed behavior, but not an invasion into seclusion of private affairs.

4. Why Cornell and Montecalvo succeed: session replay capture of complete payment credentials is an “intrusion” into a private affair

Cornell and Montecalvo plausibly alleged they entered “payment and billing information” during checkout, and the Session Replay Code captured it. Giving the complaint the benefit of reasonable inferences (per Lutz v. Portfolio Recovery Assocs., LLC), the court interprets “payment and billing information” as including a complete credit/debit card number, plus associated credentials.

The court then maps the alleged conduct to classic intrusion examples in Second Restatement § 652B comment b: tapping a telephone wire, opening private mail, searching a wallet, or examining a private bank account. Capturing a complete payment-card number is treated as the modern web analogue of those “prying eyes” scenarios—an unauthorized “investigation or examination” of a highly sensitive private affair.

Critically, the court emphasizes a doctrinal advantage of intrusion upon seclusion: publication is not required. The injury occurs at the moment of the offensive intrusion itself, not when (or if) the data is later exposed to the public.

5. The “fingerprinting” theory is characterized as speculative as pleaded

Plaintiffs alleged providers can aggregate cross-site data into “fingerprints” and later de-anonymize browsing histories. The Third Circuit treats this as a “theoretical path,” not a pleaded actuality: the complaint says providers “can” and “often do,” but does not allege that they did so on BPS’s websites. Without factual allegations that aggregation was used here and that identities were linked, the “fingerprint” theory does not supply concreteness.

6. The remedial rule: standing dismissals generally cannot be “with prejudice”

Relying on Barclift v. Keystone Credit Servs., LLC and Cook v. GameStop, Inc., the court reiterates that a lack of standing is a jurisdictional defect. Because the court lacks power to decide the merits, dismissal “with prejudice” is generally improper. The Third Circuit therefore modifies the district court’s dismissal of the six plaintiffs to be without prejudice.

C. Impact

1. A clarified Third Circuit rule for session replay standing

The opinion crystallizes a practical rule for future Third Circuit cases involving session replay or similar web instrumentation:

  • Standing is unlikely where alleged interception involves only routine browsing interactions unconnected to sensitive or identifying data.
  • Standing is plausible where interception reaches highly sensitive private affairs, especially complete payment-card credentials, because the injury closely resembles intrusion upon seclusion.
  • Public-disclosure analogies face a high bar unless plaintiffs can plead dissemination beyond a functionally internal chain.

2. Litigation strategy and pleading consequences

The decision signals that plaintiffs should plead, with specificity:

  • what sensitive fields were entered (e.g., full card number, CVV),
  • how the code captured them (e.g., keystroke capture even without “submit”), and
  • what was actually done with the data (not merely what providers are capable of doing).

Conversely, defendants can more effectively challenge standing by focusing on whether the alleged capture involved “private affairs” in the common-law sense and whether any “disclosure” was truly “public.”

3. Compliance implications for website operators

While the merits were not decided, the standing holding increases exposure where session replay tools can capture checkout fields. Organizations using session replay should expect heightened scrutiny of: data minimization (masking/redaction of payment fields), consent design, and vendor data flows.

IV. Complex Concepts Simplified

Article III standing
The constitutional requirement that a plaintiff show a real, personal stake in the dispute. Without standing, a federal court lacks power to decide the case.
Concrete injury (intangible harms)
Even without financial loss, a plaintiff can have standing if the alleged harm closely resembles a harm that courts historically recognized (e.g., certain privacy invasions).
“Close relationship” / tort analogue
A comparison between the plaintiff’s alleged harm and a traditional common-law cause of action, used to decide whether the harm is “real” enough for federal jurisdiction.
Public disclosure of private facts (Second Restatement § 652D)
A privacy tort aimed at the humiliation from publicizing highly offensive private facts to the public. Sharing within an internal business pipeline typically is not “publicity.”
Intrusion upon seclusion (Second Restatement § 652B)
A privacy tort aimed at the offensive act of intruding into someone’s private space or private affairs (like reading mail or tapping a phone line). Publication is not required.
“Functionally internal” disclosure
Sharing information with a service provider or intermediary in a way that functions as part of the defendant’s internal operations—insufficient, by itself, to resemble public “publicity.”
Fingerprinting (as alleged)
A method of identifying a browser/device using a unique combination of settings and attributes. In this case, the court found allegations about fingerprinting too speculative without facts showing it was actually used to de-anonymize plaintiffs.

V. Conclusion

The Third Circuit’s decision establishes a clear standing divide in session replay litigation: plaintiffs who allege only the capture of ordinary browsing behavior, without sensitive or identifying information, generally fail to show a concrete injury. But where a plaintiff plausibly alleges session replay tools surreptitiously captured complete payment-card credentials, the injury closely tracks the historic privacy harm of intrusion upon seclusion, satisfying Article III.

Equally important, the court reinforces a jurisdictional safeguard: when standing is absent, dismissal should ordinarily be without prejudice. Going forward, the opinion will shape both how plaintiffs plead web-tracking harms and how courts in the Third Circuit sort “mere statutory violation” allegations from historically grounded privacy injuries capable of supporting federal jurisdiction.