“Mouse-Clicks, Not Private Facts” – Third Circuit Declares Non-Personal Session-Replay Tracking Insufficient for Article III Standing

1. Introduction

In Amber Cook v. GameStop Inc., the United States Court of Appeals for the Third Circuit confronted a burgeoning species of privacy litigation: class actions attacking “session-replay” code that records how users move through a commercial website. The plaintiff, Amber Cook, alleged GameStop’s use of Microsoft’s “Clarity” script violated Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (“WESCA”) and the common-law tort of intrusion upon seclusion. The district court dismissed for lack of Article III standing; Cook appealed. The Third Circuit affirmed but—important to practitioners—modified the dismissal to “without prejudice.”

The central question was whether mere collection of non-identifying browsing data, without disclosure of personal or sensitive information, inflicts a concrete injury sufficiently analogous to traditional privacy torts to satisfy the “injury-in-fact” requirement imposed by Spokeo and TransUnion. The Court said “no,” forging a significant precedent that narrows federal-court access for plaintiffs challenging web-tracking technologies.

2. Summary of the Judgment

• The Court held Amber Cook lacked Article III standing because she failed to allege a concrete, particularized injury.
• Her asserted harms did not bear a “close relationship” to either of the common-law comparators she invoked—disclosure of private facts and intrusion upon seclusion—because:

• No sensitive or personal data (e.g., name, address, payment details) was captured.
• No information was publicized beyond the first-party website and its analytics vendor.

• WESCA’s statutory prohibition against interception cannot, by itself, manufacture standing; Congress or a state legislature may recognize existing real-world harms but cannot “legislate an injury into existence.” • Having no jurisdiction, the district court rightly dismissed, but erred by doing so with prejudice; the proper disposition is dismissal without prejudice.

3. Analysis

3.1 Precedents Cited and Their Influence

• TransUnion LLC v. Ramirez (594 U.S. 413 (2021)) – Cornerstone for the “concrete injury” test. The Third Circuit applied its mandate to compare alleged intangible injuries to historically recognized harms.
• Spokeo Inc. v. Robins (578 U.S. 330 (2016)) – Confirmed that statutory violations alone do not suffice; plaintiffs still need real, concrete harm.
• Barclift v. Keystone Credit Services (3d Cir. 2024) – Recent Third Circuit case holding that one-off disclosure to a mailing vendor is unlike public disclosure of private facts. The Court relied heavily on Barclift’s analytical framework.
• Susinno v. Work Out World (3d Cir. 2017) – Recognized unsolicited robocall as an intrusion upon seclusion. Used to contrast situations where personal solitude is actually invaded.
• In re Nickelodeon Consumer Privacy Litigation (3d Cir. 2016) & Google II (934 F.3d 316 (3d Cir. 2019)) – Earlier decisions finding standing where defendants promised not to track yet did so. The present Court distinguished these because GameStop made no such promise and disclosed tracking in its privacy policy.
• Popa v. Harriet Carter Gifts (3d Cir. 2022) – Addressed WESCA liability but not standing; the Court notes its jurisdictional silence carries no precedential weight.

3.2 Legal Reasoning

1. Concrete Injury Analysis
   • The Court dissected Cook’s claims under the tripartite Spokeo/TransUnion test:
   (a) Disclosure of private information – Requires publication of humiliating, sensitive facts to the public; Cook’s mouse clicks and generic search terms do not qualify.
   (b) Intrusion upon seclusion – Centers on disturbing someone’s solitude in private affairs. The Court ruled ordinary browsing on a public retail site lacks the requisite private character.
   • Because neither comparator matched, no “close relationship” existed; thus, no concrete injury.
2. Statutory Elevation Argument Rejected
   – Cook contended WESCA “elevates” any interception into a cognizable injury. The Court reiterated that legislatures can recognize, not create, harms; absent an intrusion akin to common-law privacy torts, the statutory violation alone is insufficient.
3. Merits v. Standing
   – The panel clarified that evaluating whether the alleged facts plausibly constitute an intrusion is appropriately part of the standing inquiry, not a merits determination.
4. Remedy Correction
   – Consistent with Third Circuit precedent (Barclift, Cottrell), dismissal for lack of jurisdiction must be without prejudice, even if amendment appears futile.

3.3 Impact on Future Litigation

• Session-Replay Lawsuits – Plaintiffs will need to plead more than tracking: concrete linkage to personal identity, sensitive data, or egregious promises not to collect.
• WESCA & Similar Statutes – The decision erects an Article III hurdle; state-court forums may see an uptick because standing doctrine there is less restrictive.
• Privacy-Tort Pleading Standards – Demonstrates the Third Circuit’s flexible but rigorous “harm-character” comparison, rejecting bright-line per-element tests yet demanding a meaningful analogue.
• Dismissal Procedure – Reinforces that jurisdictional dismissals should almost always be without prejudice—a procedural point defense counsel should remember when moving to dismiss.

4. Complex Concepts Simplified

• Session-Replay Code – JavaScript that records a user’s navigation (mouse moves, clicks, typing) and replays it as a video for site owners.
• Article III Standing – Constitutional requirement that a plaintiff show (1) concrete, particularized injury, (2) traceable to defendant, (3) likely redressable.
• Concrete Injury – A real harm (tangible or intangible) analogous to historically recognized harms.
• Intrusion upon Seclusion – Common-law tort where someone deliberately intrudes into another’s private affairs in a highly offensive manner.
• Disclosure of Private Facts – Tort arising when one publicizes embarrassing, non-newsworthy private information.
• Dismissal Without Prejudice – Case is thrown out but plaintiff may re-file (in federal or state court) if able to cure defects.

5. Conclusion

The Third Circuit’s decision in Cook v. GameStop crystallizes a pivotal rule: capturing anonymous browsing behavior, by itself, is not an Article III injury. Plaintiffs advancing session-replay or similar tracking suits must allege facts tying the surveillance to traditionally cognizable privacy harms—either dissemination of sensitive facts or a meaningful invasion of solitude. Legislatures cannot transform harmless conduct into injury by fiat, and courts must police this boundary vigilantly. Procedurally, the case underscores that jurisdictional dismissals belong in the “without prejudice” column, preserving a plaintiff’s right to re-plead or seek relief elsewhere. Collectively, the opinion tightens the nexus between modern digital-privacy claims and their common-law ancestors, ensuring that federal jurisdiction remains tethered to real, historically grounded injuries.