Frequent readers of this blog are aware of the surge in lawsuits alleging that companies illegally wiretap consumers when they utilize software which tracks consumers’ interactions on their websites. The majority of these lawsuits are concentrated in jurisdictions that have enacted broad wiretapping statutes. One such jurisdiction is Pennsylvania, with a statute known as the Pennsylvania Wiretapping and Electronic Surveillance Control Act (“WESCA”). Recently, the United States Court of Appeals for the Third Circuit (“Third Circuit”) was tasked with determining whether Defendants’ use of session replay code to record consumer communications constitutes wiretapping under WESCA.

Lack of Personal Jurisdiction Over Pennsylvania Wiretapping Claims

In Schnur v. Papa John’s Int’l Inc., the Third Circuit reviewed the Western District Court of Pennsylvania’s (“WDPA”) dismissal of a class action in which Plaintiff alleged that Defendant deployed session replay code on its website to illegally wiretap Pennsylvania residents. Session replay technology, with which readers of this blog are familiar, is a tool that uses the data collected from a website visit to create a video-like reconstruction of same. Companies keep these records to prove that consumers visited their sites, and, among other things, consented to be called or receive email marketing communications. Plaintiff alleged that Defendant’s use of session replay technology without notice and/or consumer consent constituted illegal wiretapping of Pennsylvania residents in violation of WESCA. In response, Defendant moved to dismiss for lack of personal jurisdiction. The WDPA granted Defendant’s Motion to Dismiss, finding that Plaintiff failed to allege that Defendant expressly aimed the subject session replay code at Pennsylvania residents. The WDPA also held that Plaintiff’s wiretapping claims did not arise out of or relate to Defendant’s marketing and sale of pizza in Pennsylvania. Accordingly, the WDPA granted Defendant’s Motion to Dismiss.

On appeal, Plaintiff argued that the WDPA erred when it dismissed Plaintiff’s claims for lack of jurisdiction because it failed to consider Defendant’s extensive business contacts with the State of Pennsylvania. In its decision, the Third Circuit agreed with the WDPA’s holding that Plaintiff failed to allege that Defendant expressly aimed its use of session replay code at Pennsylvania residents. In its holding, the Court stated that Plaintiff “did not allege that [Defendant’s] website is accessible only in Pennsylvania; that the [Defendant] deploys Session Replay Code only to users who access the site in Pennsylvania, or that the website tailors its content in any meaningful way to Pennsylvanians.” Citing a recent First Circuit decision, the Court held that for unlawful wiretapping to have occurred, Plaintiff, at a minimum, had to allege that Defendant knew that a given user was in Pennsylvania before it deployed the session replay code on the user’s browser.

Applying a different jurisdictional test, the Court then analyzed whether Plaintiff adequately alleged that: (1) Defendant “purposefully availed itself of the privilege of conducting activities” in Pennsylvania; and (2) his claims arise out of or relate to Defendant’s contacts with Pennsylvania. By maintaining approximately 85 brick-and-mortar locations and regularly marketing and advertising in the State of Pennsylvania, the Court found that Papa John’s purposely availed itself of the Pennsylvania market. However, because the Court determined that Defendant’s in-State restaurant sales and marketing activities lacked a strong relationship to Plaintiff’s Pennsylvania wiretapping claims, it affirmed the WDPA’s dismissal for lack of personal jurisdiction.

Similarly, in Hasson v. FullStory, Inc., the Third Circuit reviewed the WDPA’s dismissal of Plaintiff’s Pennsylvania wiretapping claims for lack of personal jurisdiction. Although the Third Circuit agreed with the WDPA’s conclusion that Defendant did not expressly aim its allegedly tortious conduct at Pennsylvania, the Third Circuit remanded to the WDPA to consider whether: (1) Defendant purposely availed itself of the privilege of conducting activities in the State of Pennsylvania; and (2) Plaintiff’s claims arise out of or relate to Defendant’s contacts with Pennsylvania.

What is The Significance of These Decisions?

It should be noted that the Schnur decision was not unanimous, as one judge on the three-judge tribunal dissented from the majority. The proliferation of e-commerce and corresponding technological advances continue to present challenges for courts nationwide. As a result, illegal wiretapping claims are unlikely to slow down anytime soon. If your company uses software to track consumers’ interactions on its website and is named as a defendant in a wiretapping lawsuit, it is imperative that you evaluate whether you have viable jurisdictional defenses (such as those raised in Schnur and Hasson). Failing to do so may result in protracted and costly litigation that could easily have been avoided. In addition, your company should consider reviewing: (1) its data collection technology and practices; (2) when and how consent to collect and use such consumer data is obtained; and (3) with whom your company shares this information.

[View source.]