Session-Replay Privacy Suits Require Concrete, Traditionally Analogous Harm—Statutory Labels and Anonymized Tracking Alone Do Not Create Article III Standing

1. Introduction

The appeal arose from a putative class action filed by Malinda Smidga (Pennsylvania), Frances Curd (Maryland), and Kayla Mandeng (California) against Spirit Airlines, Inc. The plaintiffs alleged that Spirit used third-party “Session Replay Code” (SRC) on its website to record and intercept visitors’ website interactions in real time—allegedly capturing text entries, mouse clicks, and geolocation—without users’ knowledge.

Only Mandeng alleged she purchased tickets and input personal details (names, addresses, ages). The consolidated complaint asserted multiple statutory and common-law privacy and property claims across Pennsylvania, Maryland, and California (including wiretap statutes, intrusion upon seclusion, and unfair competition-related theories).

The central issue on appeal was Article III standing: whether plaintiffs plausibly alleged a concrete injury-in-fact based on the asserted privacy invasion from SRC-based website recording, particularly where (as Spirit contested) any data was anonymized and not traceable to specific users.

2. Summary of the Opinion

The Third Circuit affirmed the district court’s dismissal under Rule 12(b)(1) for lack of subject matter jurisdiction, holding plaintiffs failed to allege a concrete injury necessary for standing. Relying heavily on Cook v. GameStop, Inc., the court concluded the alleged harms did not bear a sufficiently “close relationship” to traditionally recognized privacy torts where the complaint lacked allegations of:

• collection of personal information for two of the named plaintiffs;
• embarrassment or humiliation required for “disclosure of private information” (as invoked by plaintiffs);
• intentional disturbance of private affairs akin to intrusion upon seclusion, given voluntary website input and alleged anonymization;
• unauthorized dissemination of non-anonymous personal data; or
• an express promise by Spirit not to collect data (followed by secret collection).

The court also approved the district court’s consideration of Spirit’s declaration in a factual Rule 12(b)(1) challenge and emphasized plaintiffs’ failure to pursue jurisdictional discovery after being invited to do so.

Finally, while affirming dismissal, the panel modified the judgment: dismissals for lack of Article III standing are “generally improper” if “with prejudice,” so the dismissal was changed to without prejudice.

3. Analysis

3.1 Precedents Cited

(a) Standing framework and “concreteness”

• Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992): Supplied the canonical three-part test—injury-in-fact, traceability, and redressability. The dispute centered on the first element.
• Spokeo, Inc. v. Robins, 578 U.S. 330 (2016): Reinforced that even intangible harms must be “concrete,” rejecting the idea that a statutory violation automatically equals standing.
• TransUnion LLC v. Ramirez, 594 U.S. 413 (2021): Anchored the panel’s insistence on “concrete harm” rather than focusing on the “statutory cause of action.” The court treated TransUnion as foreclosing standing arguments that rely primarily on statutory prohibition rather than real-world or traditionally analogous harm.
• Barclift v. Keystone Credit Servs., LLC, 93 F.4th 136 (3d Cir. 2024): Provided the Third Circuit’s articulation of the “close relationship” test (quoting TransUnion) and standards of review for standing dismissals. It also supported the “without prejudice” approach to standing-based dismissals.

(b) The controlling circuit analogue: session replay and privacy injury

• Cook v. GameStop, Inc., 148 F.4th 153 (3d Cir. 2025): The opinion’s linchpin. Cook held that GameStop’s alleged use of SRC to collect website interaction data did not, without more, constitute a concrete intangible injury. The panel imported Cook’s reasoning to reject: (i) asserted analogies to privacy torts, (ii) standing-by-statute theories, and (iii) generalized “invasion of privacy” assertions where data is anonymized and there is no deception akin to a broken privacy promise.

(c) Comparator torts and privacy expectations

• Borse v. Piece Goods Shop, Inc., 963 F.2d 611 (3d Cir. 1992): Cited for the elements of intrusion upon seclusion—an intentional intrusion upon private affairs that would be highly offensive. The panel used it to show plaintiffs’ allegations did not fit the tort’s core requirements.
• In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262 (3d Cir. 2016): Used in two ways: (i) to underscore practical limits on internet privacy (“Most of us understand that what we do on the Internet is not completely private.”), and (ii) as a contrast case where the defendant allegedly gave explicit assurances (“We don’t collect ANY personal information...”)—a fact pattern the panel deemed materially different from Spirit’s alleged conduct.

(d) Pre-TransUnion Third Circuit data/privacy decisions (distinguished)

• In re Horizon Healthcare Servs. Data Breach Litig., 846 F.3d 625 (3d Cir. 2017): Plaintiffs cited it for the proposition that legislatures can “elevate” harms. The panel, following TransUnion, treated that principle as insufficient unless the pleaded injury reflects concrete harm.
• In re: Google Inc. Cookie Placement Consumer Priv. Litig., 934 F.3d 316 (3d Cir. 2019): Mentioned (via Cook) as not controlling where prior cases involved allegations of intentional/deceptive tracking and disclosure of non-anonymous personal information. The panel emphasized the absence of such dissemination allegations here.

(e) Rule 12(b)(1) factual challenge and evidence weighing

• Davis v. Wells Fargo, 824 F.3d 333 (3d Cir. 2016): Supported the district court’s ability to weigh evidence when a defendant makes a factual jurisdictional challenge; “no presumptive truthfulness attaches” to the complaint’s jurisdictional allegations in that posture.
• United States ex rel. Zizic v. Q2Administrators, LLC, 728 F.3d 228 (3d Cir. 2013): Cited for abuse-of-discretion review of dismissal with prejudice, informing the panel’s modification to a without-prejudice dismissal.

3.2 Legal Reasoning

(1) “Close relationship” failure: the alleged harm did not match traditional privacy torts

Applying Spokeo/TransUnion through Barclift and Cook, the court asked whether plaintiffs’ asserted harm closely resembled a harm traditionally recognized as actionable.

• Disclosure of private information (as framed by plaintiffs): Smidga and Curd did not allege their personal information was collected at all. Mandeng alleged she entered personal information, but the panel held plaintiffs failed to plead the kind of downstream harm the opinion associated with that tort—specifically, “resulting embarrassment or humiliation,” which the complaint did not allege.
• Intrusion upon seclusion: The court held the allegations did not show Spirit intentionally disturbed plaintiffs’ private affairs in the relevant sense because (i) plaintiffs voluntarily entered information to browse/purchase, (ii) the intercepted information was alleged to be anonymized, and (iii) internet use is not typically understood as wholly private (invoking In re Nickelodeon Consumer Priv. Litig.).

(2) Statutory-violation standing theory rejected under TransUnion

Plaintiffs argued that violations of privacy statutes (wiretap and related statutes) themselves confer standing. The panel rejected the move from “prohibited by statute” to “concrete injury” without particularized harm, emphasizing TransUnion’s instruction to focus on “concrete harm” as pleaded, not the cause of action label.

The court also distinguished earlier Third Circuit cases where standing existed because plaintiffs alleged defendants intentionally (and sometimes deceptively) tracked and disclosed non-anonymous personal data without authorization—allegations not present here.

(3) No “de facto invasion of privacy” absent an express no-collection promise

Echoing Cook, the panel found it significant that plaintiffs did not allege Spirit made an explicit promise not to collect information and then secretly did so. The opinion drew a “material difference” between:

• a site that merely does not obtain prior consent for certain tracking, and
• a site that expressly promises it will not collect personal information but covertly does so (as in the quoted assurance in In re Nickelodeon Consumer Priv. Litig.).

(4) Procedural holding: courts may consider declarations in a factual 12(b)(1) attack

Spirit submitted a declaration stating it never enabled SRC functions that collect personal information and that collected data is not traceable to specific users. The panel held this was a permissible factual attack on jurisdiction under Davis v. Wells Fargo, allowing the district court to weigh evidence. Critically, plaintiffs were offered an opportunity to seek jurisdictional discovery and amend again—but chose not to—leaving “boilerplate averments” insufficient to rebut Spirit’s evidence.

(5) Remedy: dismissal without prejudice

Following Cook and Barclift, the panel modified the judgment to make the dismissal without prejudice, reflecting the principle that a standing-based dismissal is jurisdictional and typically does not adjudicate the merits.

3.3 Impact

• Pleading burden in session-replay cases (Third Circuit): Complaints premised on SRC/website recording must allege more than “interception” in the abstract. This opinion reinforces that plaintiffs should plead facts indicating a concrete privacy harm with a traditional analogue—e.g., identifiable/non-anonymous capture, intentional intrusion into genuinely private matters, deceptive practices (especially broken express promises), and/or unauthorized dissemination.
• Statutory privacy claims still face Article III constraints: Even where state statutes create causes of action, plaintiffs in federal court must plead concrete harm under TransUnion. The decision pressures plaintiffs to select forums carefully (e.g., state court where possible) and to plead concrete consequences rather than relying on statutory violation alone.
• Defense playbook: factual 12(b)(1) challenges: The endorsement of declarations in factual jurisdictional attacks incentivizes early evidentiary submissions by defendants. Plaintiffs, in turn, must timely seek jurisdictional discovery or risk dismissal based on unrebutted evidence.
• Dismissal posture matters: By modifying to “without prejudice,” the opinion signals that plaintiffs who can later develop concrete standing facts (or sue in an appropriate forum) are not necessarily barred by claim preclusion from a jurisdictional dismissal.

4. Complex Concepts Simplified

• Article III standing: A constitutional requirement that a plaintiff show a real, personal stake in the case. Without it, federal courts lack power to decide the dispute.
• Injury-in-fact and “concrete” harm: The injury must be real in a practical sense; for intangible harms (like privacy), courts look for a strong similarity to historically recognized harms (the “close relationship” test).
• “Close relationship” to traditional harms: Not an identical match, but the alleged injury must resemble a recognized basis for suit (e.g., classic privacy torts). Vague discomfort about data collection may not be enough.
• Intrusion upon seclusion: A privacy tort involving intentional intrusion into a private place/affair that would be highly offensive. Voluntarily entering information on a public-facing commercial website, especially where data is anonymized, may not satisfy the concept as used here.
• Factual vs. facial Rule 12(b)(1) challenges: A facial challenge assumes the complaint’s facts are true; a factual challenge disputes jurisdictional facts with evidence. In a factual challenge, courts may weigh evidence and plaintiffs may need discovery to respond.
• Dismissal “without prejudice”: The case is dismissed for now, but the plaintiff is not barred from refiling if they can cure the jurisdictional defect (or pursue the claim in a court that does not require Article III standing).

5. Conclusion

Smidga v. Spirit Airlines, Inc. applies the Third Circuit’s session-replay standing framework from Cook v. GameStop, Inc. to hold that alleged SRC tracking, without well-pleaded concrete harm closely analogous to traditional privacy torts, does not confer Article III standing. The opinion underscores that statutory privacy claims in federal court must be tied to concrete harm (per TransUnion LLC v. Ramirez), and it validates the use of declarations in factual Rule 12(b)(1) challenges—especially when plaintiffs forgo jurisdictional discovery. Although non-precedential, the decision consolidates a practical message for litigants: in the Third Circuit, session-replay allegations must be specific, harm-focused, and evidence-ready at the jurisdictional stage, and standing dismissals should ordinarily be without prejudice.