By Gerald L. Maatman, Jr., Jesse S. Stavis, and Ryan T. Garippo
Duane Morris Takeaways: On April 5, 2024, Judge Marilyn J. Horan of the U.S. District Court for the Western District of Pennsylvania granted defendant Spirit Airlines’ motion to dismiss in Smidga et al. v. Spirit Airlines, No: 2:22-CV-0157 (W.D. Pa. Apr. 5, 2024). Plaintiffs alleged that Spirit had invaded their privacy and violated state wiretapping laws by recording data regarding visits to Spirit’s website, but the Court held that they failed to plead a concrete injury sufficient to establish Article III standing. The ruling should serve as a reminder of the importance of considering challenges to standing, particularly in data privacy class actions where alleged injuries are often abstract and speculative.
Case Background
Like many companies, Spirit Airlines uses session replay code to track users’ activity on its website in order to optimize user experience. Session replay code allows a website operator to track mouse movements, clicks, text entries, and other data concerning a visitor’s activity on a website. According to Spirit, all data that is collected is thoroughly anonymized.
The plaintiffs in this putative class action alleged that Spirit violated numerous state wiretapping and invasion of privacy laws by recording their identities, travel plans, and contact information. One of the plaintiffs also alleged that she had entered credit card information into the website. All three plaintiffs claimed that the invasion of privacy had caused them mental anguish and suffering as well as lost economic value in their information.
Spirit moved to dismiss based on a lack of standing under Rule 12(b)(1) and failure to state a claim under Rule 12(b)(6).
The Court’s Ruling
The Court dismissed all claims without prejudice. It held that the plaintiffs had failed to establish standing. Under Article III of the U. S. Constitution, a plaintiff must establish that he or she has standing to sue in order to proceed with a lawsuit. The standing analysis asks whether: “(1) the plaintiff suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016).
Spirit argued that the plaintiffs had failed to identify an injury in fact because they did not suffer any concrete injury from the recording of session data. The court accepted this argument, noting that absent a concrete injury, a violation of a statute alone is insufficient to establish standing: “Congress [or a state legislature] may not simply enact an injury into existence, using its lawmaking power to transform something that is not remotely harmful into something that is.” Smidga et. al v. Spirit Airlines, Inc., No. 2:22-CV-1578, 2024 WL 1485853, at *3 (W.D. Pa. Apr. 5, 2024) (internal citations and quotation marks omitted).
Judge Horan cited over fifteen recent cases where federal courts denied standing in similar circumstances to demonstrate that the mere recording of anonymized data does not satisfy the constitutional standing requirement. Further, the Court reasoned that a website’s “collection of basic contact information” is also insufficient. Id. at *4. However, the Court did note that recording credit card data without a user’s authorization might be sufficient to establish standing. Id. at *5. In Smidga, one plaintiff alleged that she had entered her credit card information, but Spirit insisted that no personally identifying information had been stored. Because plaintiffs bear the burden to prove standing, the Court found that the mere assertion that a plaintiff entered her credit card information into a website was — absent allegations that her personalized data was tied to that information — insufficient to confer Article III standing.
Having dismissed the case for lack of standing, the Court did not analyze Spirit’s arguments under Rule 12(b)(6) for failure to state a claim. The court did, however, grant the plaintiffs leave to amend their complaint.
Implications For Companies
The success or failure of a class action often comes down to whether the putative class can achieve certification under Rule 23. Nonetheless, Rule 23 challenges are not the only weapon in a defendant’s arsenal. Indeed, a Rule 12(b)(1) challenge to standing is often an effective and efficient way to quickly dispose of a claim. This strategy is a particularly potent defense in the data privacy space, as the harms that are alleged in these cases are often abstract and speculative. The ruling in Smidga shows that even if a defendant allegedly violated a state privacy or wiretapping law, a plaintiff must still demonstrate that he or she has actually been harmed.