On June 16, 2021, the Western District of Pennsylvania granted summary judgment on a state wiretapping claim brought by a putative class of users of an e-commerce website based on that website’s use of a third-party tracking service. Three weeks later, the Southern District of Florida dismissed at the pleading stage a similar case that alleged that Whirlpool’s tracking of the activity of visitors to its website violated Florida’s wiretapping statute. The pair of cases provides defendants with ammunition to defeat the growing number of class action claims brought under the Federal Wiretap Act and its state analogues.

• The Western District of Pennsylvania case—Popa v. Harriet Carter Gifts, Inc.—arose from Ashley Popa’s visit to the website of pet products retailer Harriet Carter. While visiting the Harriet Carter website, Popa provided her email address, browsed for products, and added some products to her cart, but ultimately did not buy anything. Harriet Carter used a service called Navistone to gather information about the activity of users on its website and to send those users direct mail promotions following such a visit. Popa alleged that Navistone unlawfully used information gathered from her use of Harriet Carter’s website to link together her browsing activity on a number of websites she used, “revealing an enormous amount of private information about” her.
  • Popa brought claims for intrusion upon seclusion and violations of the Pennsylvania Wiretapping and Electronic Surveillance Control Act (“WESCA”) on behalf of herself and “a class of all Pennsylvania residents who accessed Harriet Carter’s website and had their communications intercepted by Navistone.”
  • The court dismissed Popa’s claim for intrusion upon seclusion at the pleading stage, and both Harriet Carter and Navistone moved for summary judgment on the WESCA claim. They argued that (1) there was no interception of a communication as required by WESCA and (2) even if there were such an interception, it did not violate WESCA because it took place outside of Pennsylvania. The court agreed with both arguments and granted summary judgment in defendants’ favor.
  • First, the court analyzed the technical process Navistone used and found that because Popa sent information directly to Navistone when accessing Harriet Carter’s website, Navistone could not have “intercepted” Popa’s communications with Harriet Carter for purposes of WESCA. The court relied on a line of Pennsylvania state court cases holding that “an interception does not occur where a party elects to speak with or send messages to a recipient because the recipient acquires the information contained in the communications by virtue of being a direct party to the communication.” Though these cases generally involved communications between two individuals taking place in person or via phone or web chat, the court extended their reasoning to Popa’s WESCA claim.
  • Second, the court found that even if there were an interception of a communication within the meaning of WESCA, that interception occurred outside Pennsylvania because the Navistone servers with which Popa interacted are located in Virginia and the offices where it interprets the information hosted on those servers are located in Ohio. Because WESCA reaches only conduct that occurs within Pennsylvania, Popa’s WESCA claim failed even assuming there had been an interception.
• The Southern District of Florida case—Cardoso v. Whirlpool Corporation—involved a similar claim brought under the Florida Security of Communications Act (“FSCA”) by Mariana Cardoso on behalf of a putative class of Florida residents who visited Whirlpool’s website and purportedly had their communications intercepted by Whirlpool’s “session reply software.” That software allegedly tracks how visitors “interact with the [Whirlpool] website,” including visitors’ “mouse movements and clicks, keystrokes, search terms, information inputted into the website, and pages and content viewed while visiting the website.” Cardoso asserted that the software allowed Whirlpool to “capture, observe, and divulge [her] personal interests, browsing history, queries, and habits as [s]he interacted with and browsed” Whirlpool’s website.
  • Relying on a recent Florida state court decision, the Cardoso court found that the FSCA did not apply to the session replay software that formed the basis of Cardoso’s claim. The court also concluded that Cardoso failed to allege “multiple elements of an FSCA violation, including that contents of her electronic communications were intercepted, that an electronic, mechanical, or other device was used to effect interception, . . . that interception was contemporaneous with transmission, or that the plaintiff had a reasonable expectation of privacy when visiting” Whirlpool’s website.
• The decisions in Popa and Cardoso provide defendants with a roadmap to help stem the rising tide of class action litigation under the California, Florida, Pennsylvania, and federal wiretapping statutes. Popa in particular provides an example of how a defendant can closely analyze the emerging technology at issue and compare it with the elements of a claim to secure a favorable judgment.
• You can read the Western District of Pennsylvania’s full decision in Popa v. Harriet Carter Gifts, Inc. here and the Southern District of Florida’s full decision in Cardoso v. Whirlpool Corporation here.