
By Gerald L. Maatman, Jr., Justin Donoho, and Hayley Ryan
Duane Morris Takeaways: On May 26, 2026, in Smidga, et al. v. Spirit Airlines, Inc., No. 24-1757, 2026 WL 1470137 (3d Cir. May 26, 2026), the U.S. Court of Appeals for the Third Circuit affirmed a federal district court’s dismissal of a class action alleging that the defendant’s use of session replay code, a form of website analytics technology, violated federal and state privacy laws. Relying on its prior decision in Cook v. GameStop, Inc., 148 F.4th 153 (3d Cir. 2025), the Third Circuit held that the three named plaintiffs lacked standing because there were no allegations of embarrassment or humiliation, plaintiffs voluntarily provided the information on the defendant’s website, the information allegedly collected was anonymized, and, in any event, most people “understand that what we do on the Internet is not completely private.” Id. at *2. Accordingly, the Third Circuit concluded that plaintiffs failed to allege a concrete injury to their privacy interests sufficient to confer Article III standing. Id. at *1.
This ruling reinforces the growing trend among federal courts requiring plaintiffs to plausibly allege that the collected data was personally identifiable and obtained without authorization in order to establish a concrete privacy injury.
Background
Many companies embed session replay code and other similar software, such as Google Analytics and the Meta Pixel, into their websites to conduct website analytics and/or targeted advertising. All of these various technologies capture users’ browsing behaviors and cryptographically transmit this data to algorithms residing on the software providers’ servers. Upon entry into the algorithm, this data is typically anonymized, aggregated, and not alleged to have been viewed or accessible by any human. Plaintiffs across the country have filed multitudes of class actions challenging these various website analytics and advertising practices under federal and state privacy laws, targeting companies in virtually every industry, including healthcare, retail, education, and consumer products. Some cases have resulted in multimillion-dollar settlements, others have been dismissed, and the vast majority remain undecided. In these session replay and other data privacy class actions, the central question is often whether the specific data captured is sufficiently sensitive or personally identifying to establish a cognizable legal injury.
In Smidga, three named plaintiffs sued the defendant airline, alleging that session replay code embedded on its website recorded users’ interactions with the website in real time, including “text entries, mouse clicks, and geolocation.” Id. at *1. Plaintiffs asserted claims under the Pennsylvania and Maryland Wiretap Acts, the California Invasion of Privacy Act, California’s Unfair Competition Law, and several other state and common law causes of action. Id. at *1 n.2.
All three plaintiffs visited defendant’s website to browse flights. Only one plaintiff ultimately purchased tickets and entered the names, addresses, and ages of herself and her children while doing so. Id. at *1.
The defendant moved to dismiss for lack of Article III standing under Federal Rule of Civil Procedure 12(b)(1) or, alternatively, for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6). In support of its Rule 12(b)(1) arguments, the defendant submitted a declaration from its Senior Vice President and Chief Information Officer disputing plaintiffs’ allegations that the session replay code collected personal information and explaining that any data collected was “not traceable to any specific [w]ebsite user.” Id. at *1.
The District Court granted the motion to dismiss for lack of standing, finding that the plaintiffs failed to establish an injury-in-fact sufficient to confer Article III standing, while also granting plaintiffs leave to seek jurisdictional discovery and amend the complaint again. Id. When plaintiffs took no further action, the District Court dismissed the complaint with prejudice, and plaintiffs appealed.
The Third Circuit’s Decision
The Third Circuit affirmed dismissal of the complaint but modified the District Court’s order so that the dismissal would be without prejudice. Id.
After observing that its recent decision in Cook v. GameStop, Inc., 148 F.4th 153 (3d Cir. 2025), “plainly resolve[d]” plaintiffs’ standing challenge, the Third Circuit “briefly explain[ed]” why plaintiffs failed to establish a concrete injury sufficient to confer Article III standing. Id. at *2.
First, the Third Circuit held that the alleged harm did not share a “close relationship” to the comparator torts of disclosure of private information or intrusion upon seclusion. Id. With respect to public disclosure of private information, the Third Circuit explained that the two non-purchasing plaintiffsdid not allege that the defendant collected any personal information. Although the purchasing plaintiff entered personal information while using the website, the Third Circuit noted that the tort of public disclosure of private facts requires allegations of resulting embarrassment or humiliation, which were absent from the complaint. Id.
The Third Circuit similarly concluded that plaintiffs failed to state an analogous intrusion upon seclusion injury. Such a claim requires allegations that the defendant intentionally intruded upon plaintiffs’ “private affairs or concerns.” Id. The Third Circuit determined that standard was not satisfied because plaintiffs voluntarily provided the information, the allegedly collected information was anonymized, and, in any event, most people “understand that what we do on the Internet is not completely private.” Id.
Second, the Third Circuit rejected plaintiffs’ argument that bare violations alone confer standing, concluding that the argument misconstrued Third Circuit precedent and the U.S. Supreme Court’s holding in TransUnion LLC v. Ramirez, 594 U.S. 413, 426–27 (2021). Id. at *2.
Third, the Third Circuit reasoned that it was “hard-pressed to find that a de facto invasion of privacy exists where a website makes no express promise to refrain from collecting site visitors’ information.” Id. at *3. As explained in Cook, “there is a material difference between an allegation that a website merely failed to ask for visitors’ consent to data collection and an allegation that a website expressly promised it would not collect information but secretly did so anyway.” Id. The complaint contained no allegations that the defendant made such a promise.
The Third Circuit also rejected plaintiffs’ challenge to the District Court’s consideration of the declaration submitted in support of the defendant’s Rule 12(b)(1) motion to dismiss. The Third Circuit emphasized that plaintiffs failed to request discovery to respond to the defendant’s factual challenge despite being given the opportunity to do so, and it agreed that plaintiffs’ “boilerplate averments” alone could not rebut the defendant’s external evidence. Id. at *3.
Accordingly, the Third Circuit affirmed the District Court’s dismissal order for lack of Article III standing but modified the dismissal to be without prejudice.
Implications For Companies
Smidga reinforces that plaintiffs challenging the use of common website analytics and advertising technology must, at a minimum, plausibly allege that the technology collected and disclosed personally identifying information, rather than anonymized, aggregated web-browsing data cryptographically transmitted to software providers’ servers and not viewable or accessible by any human. Moreover, alleging the collection and disclosure of PII via functionally internal session replay technology may or may not confer standing, depending on the jurisdiction one is in, as we blogged about earlier this month (here).
For companies facing session replay and other data privacy class actions in federal court, Article III standing remains a significant threshold defense that should be evaluated throughout the litigation, while balancing the possibility that claims may continue in state court.











