By Gerald L. Maatman, Jr., Jennifer Riley, and Olga A. Romadin
Duane Morris Takeaways: On October 23, 2026, in Thompson v. C. & J. Clark America, Inc., No. 74 WDA 2026, 2026 Pa. Super. LEXIS 557 (Pa. Super. Ct. Oct. 23, 2026), the Pennsylvania Superior Court vacated a lower court’s grant of summary judgment to footwear retailer C. & J. Clark America, Inc. (“Clarks”) in a putative class action alleging that a third-party analytics vendor “wiretapped” visitors’ interactions with the retailer’s website in violation of Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (“WESCA”) and constituted common law invasion of privacy. The Superior Court rejected the trial court’s holding that communicating over the internet amounts to consent to interception, and adopted the framework articulated in Popa v. Harriet Carter Gifts, Inc., 772 F. Supp. 3d 592 (W.D. Pa. 2025), in its entirety, holding that a reasonably conspicuous privacy policy disclosing third-party tracking can establish implied consent under WESCA’s all-party consent exception. The decision underscores an emerging line of state court rulings scrutinizing online privacy policies more closely, with wider implications for litigation to be brought against companies with an online presence.
Background
On February 14, 2023, Plaintiff, a consumer, brought a putative class action against Clarks in the Court of Common Pleas of Washington County alleging that the shoe retailer, through third-party vendor Content Square, wiretapped the electronic communications of visitors to its website, including their “mouse movements, clicks, keystrokes … URLs of web pages visited, and/or other electronic communications,” in violation of WESCA and common law invasion of privacy. Id. at *1-2. Plaintiff claimed that after visiting the Clarks website on her phone and browsing for sandals, she received unwanted, targeted ads for sandals, including for those sold by Clarks. Id. at *6-7. Plaintiff’s complaint stated that she had not entered her name, email address, or payment information, did not create an account on the website, and did not use the chat function. Id. Further, Plaintiff claimed that she never reviewed the website’s terms of use nor the cookie policy. Id. at *7.
The Court of Common Pleas dismissed her common law invasion of privacy claim on preliminary objections but allowed her to proceed on her WESCA claim. Id. at *2. On December 5, 2025, it granted summary judgment to Clarks. Id. at *8. In a 3-5 decision relying on Commonwealth v. Proetto, 2001 PA Super 95, 771 A.2d 823 (Pa. Super. 2001), Commonwealth v. Cruttenden, 619 Pa. 123, 58 A.3d 95 (Pa. 2012), Commonwealth v. Diego, 2015 PA Super 143, 119 A.3d 370 (Pa. Super. 2015), and Commonwealth v. Byrd, 661 Pa. 85, 235 A.3d 311 (Pa. 2020), the Court of Common Pleas held that a website visitor need not have known that she was being tracked or by whom, and that her “‘very act’ of sending an electronic communication over the Internet amounted to her express consent to recording.” Id. at *15-16. The Court of Common Pleas determined that “when [plaintiff] surfed the Internet for summer sandals and clicked on the Clarks America website, she should have known that Clarks America or another acting on its behalf was tracking her activity.” Id. at *16.
Plaintiff appealed, and the Superior Court vacated the summary judgment and remanded the matter back to the Court of Common Pleas.
The Superior Court’s Decision
On October 23, 2026, the Superior Court issued its decision after considering (1) whether the Court of Common Pleas erred in finding that a website visitor gives their express consent to being wiretapped through the act of sending an electronic communication over the internet; (2) whether the Court of Common Pleas erred in finding that Clarks’ third-party vendor was its agent and thus permitted to circumvent WESCA’s all-party consent requirement; and (3) whether the Court of Common Pleas erred in holding that Plaintiff had failed to make a prima facie showing sufficient to allow a trier of fact to find that her communications with Clarks’ website were unlawfully intercepted by the third party vendor. In an opinion written by Judge Mary P. Murray and joined by Judges Mary Jane Bowes and Judith F. Olson, the Superior Court found that the Court of Common Pleas had erred on the issue of consent, and found the last question moot, and thus vacated and remanded the decision.
The Superior Court, finding a dearth of Pennsylvania case law applying WESCA to the circumstances at issue, based its decision on what it referred to as a “highly instructive” 2025 ruling in the U.S. District Court for the Eastern District of Pennsylvania entitled Popa v. Harriet Carter Gifts, Inc., 772 F. Supp. 3d 592 (W.D. Pa. 2025) (“Popa II”), which followed a reversal of summary judgment granted in Popa v. Harriet Carter Gifts, Inc., 544 F. Supp. 3d 535 (W.D. Pa. 2021) (“Popa I”), to a defendant in a putative class action alleging similar claims, reversed by the Third Circuit in Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (3d Cir. 2022) (“Popa III”). Id. at *28. In Popa II, the Third Circuit held that “there is no sweeping direct-party exception to civil liability under WESCA,” reasoning that the General Assembly’s 2012 amendment codifying a narrow intended-recipient carve-out for law enforcement limited Proetto and Cruttenden to their facts. Id. at *31. On remand, the District Court in Popa III had held that the plaintiff constructively consented to third-party tracking because the defendant retailer’s privacy statement adequately disclosed third-party data collection and was reasonably conspicuous in the website’s footer. Id. at *33-44.
The Superior Court found that the record raised a genuine issue of fact as to whether Content Square tracked Plaintiff’s communications, and that such tracking would constitute an interception under WESCA. Id. at *47. The Superior Court agreed with the Court of Common Pleas that under WESCA § 5704(4), consent turns on an objective, “reasonable user” standard: “whether a reasonable Internet user in [plaintiff’s] position knew or should have known that the contents of her communications with the Clarks website would be acquired by a third party,” and that actual knowledge is not required. Id. at *47-48. But the Superior Court held that the Court of Common Pleas erred with its application of the statute. Id. at *48. It found that the lower court’s conclusion that a sender’s ignorance of the recipient’s identity is irrelevant was in error because of the reliance on Proetto and Cruttenden, which had involved two-party communications with police officers posing as the intended recipient, and a 2012 amendment to WESCA licensed only police officers to do so. Id. at *48-50. As the Superior Court observed, “misrepresenting one’s identity in order to receive communications appears to be a prerogative belonging to police officers.” Id. at *49.
The Superior Court found that the Court of Common Pleas had removed Proetto’s language on the “very act of sending a communication over the Internet” being consent from its context, which, in Proetto was a chat room message received in recorded form by its intended recipient. Id. at *51-53. The Superior Court explained that “Proetto and its progeny do not support the blanket ruling, which implies that any person sending any form of communication over the Internet inherently consents to the acquisition of that communication’s contents by anyone who happens to be listening/recording.” Id. at *52. The Superior Court found that the Court of Common Pleas erred by failing to apply the reasonable person standard to the particular form of communication at issue, here, a shopper’s interaction with a retail website, and by failing to consider whether a reasonable person would be aware that someone other than the intended recipient might acquire the communication. Id. at *52-53.
The Superior Court agreed with Clark’s reasoning, relying on Popa III, that “a reasonably prudent person has a lower expectation of privacy on the Internet, particularly with respect to the kind of non-sensitive data involved here.” Id. at *55. While acknowledging that WESCA is content-neutral and that a violation does not require sensitive information, the Superior Court held that the “innocuous nature” of the data is relevant to the reasonable person standard. Id. at *55.
The Superior Court then held that a website privacy policy may convey implied consent to an interception if it “disclose[s] the nature of the interception to a reasonable reader” and is “reasonably conspicuous” on the webpage. Id. at *57. It found Clarks’ privacy policy to have satisfied the first prong because it disclosed that Clarks and its “third party partners” used cookies, pixel tags, and web beacons to “track the actions of users,” and that third parties “may place cookies on your browsers for purposes of tracking consumer behavior.” Id. at *57-61. The Superior Court found the policy “rife with references to the involvement of third parties,” and concluded that “reasonable readers of the Privacy Policy would know that the content of their communications with the Clarks website would be intercepted by third parties.” Id. at *61-62. The Superior Court rejected the opinions of Plaintiff’s expert that the policy did not cover Content Square because it applied only to data collected by “www.clarksusa.com” because the Superior Court found that such a technical distinction “would not be appreciable by an average Internet user,” and it agreed with Popa III that WESCA does not require a privacy policy to “reveal granular details about the identity of the ‘third parties’ or the specific type of cookies used.” Id. at *62.
The Superior Court adopted Popa III’s rejection of Plaintiff’s argument that tracking begins before a user can reach the privacy policy. Id. at *63. It further refused to import the heightened, “unambiguous manifestation of assent” standard that the Superior Court had applied to online arbitration agreements in Duffy v. Tatum, 354 A.3d 14 (Pa. Super. 2026), explaining that Plaintiff waived no constitutional right and that the alleged infringement “is of such low stakes” that the Third Circuit had found it insufficient to confer Article III standing. Id. at *63-65. The Superior Court thus held that “a website’s browsewrap privacy policy, if reasonably conspicuous, may be sufficient to demonstrate that a reasonable user should know about the data-collection practices disclosed in the policy, thereby conferring implied consent under WESCA section 5704(4).” Id. at *66.
Ultimately, however, the Superior Court rejected Clark’s contention that a link to its privacy policy was conspicuously located at the center of the bottom of its website because it was not supported by evidence in the record. Id. at *68. Thus, viewing the record in the light most favorable to Plaintiff, the Superior Court could not conclude that Clarks had met its burden for consent. Id. The Superior Court therefore vacated without prejudice and remanded, authorizing the parties to supplement the record. Id. at *70.
Implications For Companies
With the decision in Thompson, the Superior Court of Pennsylvania has laid out the governing framework for WESCA class actions in Pennsylvania courts via Popa. Courts in the state are instructed to more closely scrutinize whether website users have been reasonably apprised of a site’s privacy policy, and whether such policies inform users of any tracking they are subject to. A simple click or scroll is, under this ruling, may no longer be argued as consent to be tracked. The key takeaway for companies operating websites utilizing tracking software or third party vendors include the importance of preparing a conspicuous and clear privacy policy that discloses use of such technology and/or vendors, and that a visible and accessible privacy policy may be the centerpiece of a defense of consent in wiretapping litigation.













