{"id":2432,"date":"2025-09-25T09:05:37","date_gmt":"2025-09-25T13:05:37","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=2432"},"modified":"2025-09-25T09:05:39","modified_gmt":"2025-09-25T13:05:39","slug":"what-the-click-third-circuit-finds-no-standing-for-class-complaining-of-website-operator-monitoring-clicks","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2025\/09\/25\/what-the-click-third-circuit-finds-no-standing-for-class-complaining-of-website-operator-monitoring-clicks\/","title":{"rendered":"What The Click?:\u00a0 Third Circuit Finds No Standing For Class Complaining Of Website Operator Monitoring Clicks\u00a0"},"content":{"rendered":"
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

By Gerald L. Maatman, Jr., Anna Sheridan, and Shannon Noelle<\/strong><\/p>\n\n\n\n

Duane Morris Takeaways:<\/strong> On August 7, 2025, in an opinion authored by Circuit Judge D. Michael Fisher, the United States Court of Appeals for the Third Circuit issued a precedential decision <\/a>in Cook v. GameStop, Inc., 148 F.4th 153 (3d Cir. 2025), affirming the U.S. District Court for the Western District of Pennsylvania\u2019s dismissal for lack of standing of a putative class action asserting privacy causes of action against a website operator monitoring clicks.\u00a0 The Third Circuit found that merely tracking internet users\u2019 browsing time and website interactions \u2014 without recording or disclosing sensitive or personal information \u2014 fails to constitute the type of concrete injury required to confer Article III standing.\u00a0 The decision is instructive for corporate counsel dealing with privacy issues and defense of class action litigation.<\/em><\/p>\n\n\n\n

Case Background<\/strong><\/p>\n\n\n\n

Plaintiff Amber Cook (\u201cCook\u201d or \u201cPlaintiff\u201d) was an internet user that visited GameStop\u2019s website in Pennsylvania.  See Cook, 148 F.4th 153, 156.  <\/em>Through third-party vendor Microsoft and its programming script called Clarity, GameStop was tracking internet user\u2019s browsing history and interaction with its website.  Id.<\/em>  The script Clarity creates is known as a \u201csession replay code\u201d that aggregates data about how long the user browsed the website, mouse movement, links clicked, scrolling, search bar entries, and products added and removed from the \u201ccart.\u201d   Id.  <\/em>The script creates a unique id and profile for each user and recaptures each user\u2019s session through a video which GameStop could review to improve functionality and user experience.  Id.  <\/em>The unique ids and profiles do not utilize personally identifying information such as names, addresses, and the like.  Id.<\/em> at 160.  GameStop\u2019s website has a privacy policy describing the script and information collected but this policy is \u201cburied at the very bottom of the website.\u201d   Id. <\/em>at 156.<\/p>\n\n\n\n

Cook sued GameStop for its use of the Clarity script, alleging that it violated the Pennsylvania Wiretapping and Electronic Surveillance Control Act (\u201cWESCA\u201d) and asserting a common law cause of action for intrusion upon seclusion.  Cook alleged that the WESCA and privacy tort for intrusion upon seclusion prohibit the interception of electronic communications without prior consent and she suffered an injury in fact \u201c\u2018\u2018when her communications with . . . GameStop\u2019s website were intercepted\u2019 by the session replay code.\u201d   GameStop moved to dismiss the First Amended Complaint at the District Court level pursuant to Federal Rule of Civil Procedure 12(b)(6) and 12(b)(1).  See <\/em>Case No. 2:22-CV-01292, ECF No. 25-27.  The District Court granted GameStop\u2019s motion under Rule 12(b)(1) with prejudice and, in the alternative, held that Cook failed to \u201cplead the necessary facts to support her claims for violation of [WESCA] or intrusion upon seclusion.\u201d  See <\/em>Case No. 2:22-CV-01292, ECF No. 45-46.  Specifically, the District Court concluded that Cook\u2019s harms were not analogous to the traditional intangible harms recognized by privacy torts because none of the data gathered \u201ccould connect her browsing activity to her<\/em><\/strong>.<\/em>\u201d   See <\/em>Case No. 2:22-cCV01292, ECF No. 46, at 8 (emphasis in the original).  Cook appealed the District Court\u2019s decision on standing to the Third Circuit.<\/p>\n\n\n\n

The Third Circuit\u2019s Ruling<\/strong><\/p>\n\n\n\n

Reviewing whether Cook\u2019s allegations met the Article III standing threshold de novo<\/em>, the Third Circuit determined that the appeal concerned only the first element of the analysis, or whether Cook had sufficiently alleged an injury in fact (as opposed to the other requirements of traceability and redressability).  The Third Circuit adopted the standard articulated in Barclift <\/em>and Transunion<\/em> that \u2014 to determine whether a plaintiff has suffered a concrete injury \u2014 the framework is whether the harm asserted bears a \u201cclose relationship to a harm traditionally recognized as providing a basis for a lawsuit in American courts \u2014 such as physical harm, monetary harm, or various intangible harms including . . . reputational harm.\u201d  Id. <\/em>at 158 (citing Barclift v. Keystone Credit Servs., LLC<\/em>, 93 F.4th 136, 141, 145 (3d Cir. 2024); TransUnion LLC v. Ramirez<\/em>, 594 U.S. 413, 417 (2021)). <\/p>\n\n\n\n

The Third Circuit clarified that it would not take as \u201crigid\u201d of an approach as other federal circuits but that it would consider the privacy torts that Cook identified of disclosure of private information and intrusion upon seclusion to determine if the harm she alleges is \u201cthe kind of harm caused by the comparator tort[s].\u201d   The Third Circuit found that she failed to identify sufficiently concrete harms under either analogy.<\/p>\n\n\n\n

    \n
  1. Tracking Information That Is Not Personal Or Sensitive Nor Disclosed Publicly Not Sufficient To Allege Concrete Injury<\/strong><\/li>\n<\/ol>\n\n\n\n

    With regard to the disclosure of private information analogy, the Third Circuit found that the information captured by the session replay code \u2014 recording clicks, mouse hovers, and search bar searches \u2014 was neither sensitive or personal.  In support of this conclusion, the Third Circuit reasoned that the disclosure of such information cannot plausibly be said to result in embarrassment or humiliation.  Cook did not share her name, contact information, address, or billing information while on GameStop\u2019s website.  Further, though Cook alleged that GameStop obtained information about her device and browser and created a unique ID and profile for her to capture the session replay information, she did not allege that GameStop identified her through this information.  Id.<\/em> at 160.  Cook alleged only that if a user \u201ceventually identifies themselves\u201d then GameStop could \u201cback-reference all of that user\u2019s other web browsing.\u201d   Id.  <\/em>The Third Circuit found these allegations were too hypothetical to meet Article III\u2019s injury-in-fact requirement.<\/p>\n\n\n\n

    Going one step further, the Third Circuit found that \u201ceven assuming the information was the type that could cause Cook humiliation under \u2018public scrutiny,\u2019\u201d Cook did not allege that the information was ever publicized or disclosed publicly.  Id.  <\/em>Cook alleged only that the information was disclosed to third-party vendor Microsoft, \u201cnot the broader public.\u201d  Id. <\/em><\/p>\n\n\n\n

    As the information collected was not personal or sensitive, the Third Circuit also rejected Cook\u2019s intrusion upon seclusion analogy.  As an additional basis for rejecting this tort analogy, the Third Circuit acknowledged that \u201c[m]ost of us understand that what we do on the Internet is not completely private.\u201d   Id. <\/em>(citation omitted). <\/p>\n\n\n\n

      \n
    1. The WESCA Does Not Provide A Statutory Avenue For Circumventing The Injury-In-Fact Requirement For Standing<\/strong><\/li>\n<\/ol>\n\n\n\n

      The Third Circuit next considered and rejected Cook\u2019s argument that the WESCA provides a separate avenue to circumvent Article III\u2019s injury-in-fact requirement.  In making this argument, Cook relied on language in the TransUnion <\/em>decision that the legislature can \u201c\u2018elevate harms that exist in the real world\u2019 to make them legally actionable\u201d and went on to claim the WESCA did just that in protecting a \u201cwider range of information\u201d from collection during electronic communications.  The Third Circuit disagreed with this logic and reading of the TransUnion<\/em> decision, determining that the theory \u201ccontradicts the fundamental holding of TransUnion<\/em>\u201d which instructs courts to consider the concrete harm actually alleged<\/em><\/strong> by the Plaintiff rather than the \u201charm the statutory cause of action typically protects against<\/em><\/strong>.\u201d   Id.<\/em>at 161 (emphasis added).  The Third Circuit analyzed that a statutory violation of the WESCA for tracking web browsing information does not dispense with the Article III standing inquiry and Cook was still required to articulate a harm existing in the \u201creal world\u201d under TransUnion<\/em>, as legislatures cannot \u201ctransform something that is not remotely harmful into something that is.\u201d  Id. <\/em><\/p>\n\n\n\n

        \n
      1. Precedent In Which Website Operators Affirmatively Represented They Would Not Track Information Are Not Controlling<\/strong><\/li>\n<\/ol>\n\n\n\n

        The Third Circuit further opined that the Nickelodeon<\/em> and Google II <\/em>decisions \u2014 which Cook cited in favor of her argument that tracking internet browsing history has been found to constitute a concrete harm \u2014 were not controlling.  The Third Circuit explained that Nickelodean <\/em>involved claims that a website operator was collecting minors\u2019 personal information despite affirmatively representing that it would not do so.  Id. <\/em>at 162 (citing In Re Nickelodeon Consumer Priv. Litig.<\/em>, 827 F.3d 262, 269 (3d Cir. 2016)).  And, similarly, Google II<\/em> involved allegations that Google bypassed browser privacy settings through the use of browser cookies to track user information.  Id.<\/em> (citing In Re Google Inc. Cookie Placement Consumer Priv. Litig.<\/em>, 934 F.3d 316, 321 (3d Cir. 2019) (Google II<\/em>)).  The Third Circuit found that both were instances of affirmative \u201cpromises not to\u201d collect information that the website operator collected in any event.  Id.  <\/em>Here, by contrast, Cook failed to identify an affirmative representation on the part of GameStop to refrain from tracking user browsing and website usage information.<\/p>\n\n\n\n

          \n
        1. Current Status of GameStop <\/em>Action<\/strong><\/li>\n<\/ol>\n\n\n\n

          A mandate was issued on September 12, 2025 transferring the action back to the jurisdiction of the District Court, where the matter is still pending.<\/p>\n\n\n\n

          Implications for Website Operators Tracking Browsing History and Use:<\/strong><\/p>\n\n\n\n

          The Third Circuit has provided a helpful roadmap for website operators \u2014 at least in this jurisdiction \u2014 that merely tracking clicks and interaction with a website is insufficient to confer standing in federal court to potential plaintiffs challenging such tracking.  It is critical that the tracking at issue in GameStop<\/em>, however, did not collect personal or sensitive information nor disclose the same.  GameStop also did not affirmatively represent that it would not track website use and interaction.  Website operators would be well-advised to review any website tracking using this rubric and to seek legal advice in the event of doubt or ambiguity. <\/p>\n","protected":false},"excerpt":{"rendered":"

          By Gerald L. Maatman, Jr., Anna Sheridan, and Shannon Noelle Duane Morris Takeaways: On August 7, 2025, in an opinion authored by Circuit Judge D. Michael Fisher, the United States Court of Appeals for the Third Circuit issued a precedential decision in Cook v. GameStop, Inc., 148 F.4th 153 (3d Cir. 2025), affirming the U.S. … <\/p>\n

          Continue reading “What The Click?:\u00a0 Third Circuit Finds No Standing For Class Complaining Of Website Operator Monitoring Clicks\u00a0“<\/span><\/a><\/p>\n","protected":false},"author":575,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[59],"tags":[],"ppma_author":[7,133,134],"class_list":["post-2432","post","type-post","status-publish","format-standard","hentry","category-privacy-class-actions"],"authors":[{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","author_category":"","last_name":"Maatman Jr.","first_name":"Gerald L.","job_title":"","user_url":"https:\/\/www.duanemorris.com\/attorneys\/geraldmaatman.html","description":"Read Gerald's bio.<\/a>"},{"term_id":133,"user_id":711,"is_guest":0,"slug":"asheridan","display_name":"Anna Sheridan","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/04\/sheridananna-100x100.jpg","author_category":"","last_name":"Sheridan","first_name":"Anna","job_title":"","user_url":"","description":"Read Anna's bio.<\/a>"},{"term_id":134,"user_id":717,"is_guest":0,"slug":"snoelle","display_name":"Shannon Noelle","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/07\/noelleshannon-100x100.jpg","author_category":"","last_name":"Noelle","first_name":"Shannon","job_title":"","user_url":"","description":"Read Shannon's Bio<\/a>"}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2432","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/575"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=2432"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2432\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=2432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=2432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=2432"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=2432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}