{"id":2972,"date":"2026-05-29T10:07:09","date_gmt":"2026-05-29T14:07:09","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=2972"},"modified":"2026-05-29T10:10:27","modified_gmt":"2026-05-29T14:10:27","slug":"third-circuit-affirms-dismissal-of-session-replay-code-class-action-because-the-collection-of-anonymized-information-does-not-constitute-a-concrete-injury-necessary-to-confer-article-iii-standing","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2026\/05\/29\/third-circuit-affirms-dismissal-of-session-replay-code-class-action-because-the-collection-of-anonymized-information-does-not-constitute-a-concrete-injury-necessary-to-confer-article-iii-standing\/","title":{"rendered":"Third Circuit Affirms Dismissal Of Session Replay Code Class Action Because The Collection Of Anonymized Information Does Not Constitute A Concrete Injury Necessary To Confer Article III Standing"},"content":{"rendered":"\n
\"\"<\/a><\/figure>\n\n\n\n

By Gerald L. Maatman, Jr., Justin Donoho, and Hayley Ryan<\/strong><\/p>\n\n\n\n

Duane Morris Takeaways:<\/em><\/strong>\u00a0 On May 26, 2026, in Smidga, et al. v. Spirit Airlines, Inc.<\/em>, No. 24-1757, 2026 WL 1470137 (3d Cir. May 26, 2026), the U.S. Court of Appeals for the Third Circuit affirmed<\/a> a federal district court\u2019s dismissal of a class action alleging that the defendant\u2019s use of session replay code, a form of website analytics technology, violated federal and state privacy laws.\u00a0 Relying on its prior decision in Cook v. GameStop, Inc.<\/em>, 148 F.4th 153 (3d Cir. 2025), the Third Circuit held that the three named plaintiffs lacked standing because there were no allegations of embarrassment or humiliation, plaintiffs voluntarily provided the information on the defendant\u2019s website, the information allegedly collected was anonymized, and, in any event, most people \u201cunderstand that what we do on the Internet is not completely private.\u201d Id. at *2. Accordingly, the Third Circuit concluded that plaintiffs failed to allege a concrete injury to their privacy interests sufficient to confer Article III standing. Id. at *1.<\/em><\/p>\n\n\n\n

This ruling reinforces the growing trend among federal courts requiring plaintiffs to plausibly allege that the collected data was personally identifiable and obtained without authorization in order to establish a concrete privacy injury.<\/em><\/p>\n\n\n\n

Background<\/strong><\/p>\n\n\n\n

Many companies embed session replay code and other similar software, such as Google Analytics and the Meta Pixel, into their websites to conduct website analytics and\/or targeted advertising.  All of these various technologies capture users\u2019 browsing behaviors and cryptographically transmit this data to algorithms residing on the software providers\u2019 servers.  Upon entry into the algorithm, this data is typically anonymized, aggregated, and not alleged to have been viewed or accessible by any human.  Plaintiffs across the country have filed multitudes of class actions challenging these various website analytics and advertising practices under federal and state privacy laws, targeting companies in virtually every industry, including healthcare, retail, education, and consumer products.  Some cases have resulted in multimillion-dollar settlements, others have been dismissed, and the vast majority remain undecided.  In these session replay and other data privacy class actions, the central question is often whether the specific data captured is sufficiently sensitive or personally identifying to establish a cognizable legal injury.<\/p>\n\n\n\n

In Smidga, <\/em>three named plaintiffs sued the defendant airline, alleging that session replay code embedded on its website recorded users\u2019 interactions with the website in real time, including \u201ctext entries, mouse clicks, and geolocation.\u201d Id<\/em>. at *1.  Plaintiffs asserted claims under the Pennsylvania and Maryland Wiretap Acts, the California Invasion of Privacy Act, California\u2019s Unfair Competition Law, and several other state and common law causes of action. Id<\/em>. at *1 n.2.<\/p>\n\n\n\n

All three plaintiffs visited defendant\u2019s website to browse flights. Only one plaintiff ultimately purchased tickets and entered the names, addresses, and ages of herself and her children while doing so.  Id<\/em>. at *1.<\/p>\n\n\n\n

The defendant moved to dismiss for lack of Article III standing under Federal Rule of Civil Procedure 12(b)(1) or, alternatively, for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6).  In support of its Rule 12(b)(1) arguments, the defendant submitted a declaration from its Senior Vice President and Chief Information Officer disputing plaintiffs\u2019 allegations that the session replay code collected personal information and explaining that any data collected was \u201cnot traceable to any specific [w]ebsite user.\u201d  Id<\/em>. at *1.<\/p>\n\n\n\n

The District Court granted the motion to dismiss for lack of standing, finding that the plaintiffs failed to establish an injury-in-fact sufficient to confer Article III standing, while also granting plaintiffs leave to seek jurisdictional discovery and amend the complaint again. Id<\/em>. When plaintiffs took no further action, the District Court dismissed the complaint with prejudice, and plaintiffs appealed.<\/p>\n\n\n\n

The Third Circuit\u2019s Decision<\/strong><\/strong><\/p>\n\n\n\n

The Third Circuit affirmed dismissal of the complaint but modified the District Court\u2019s order so that the dismissal would be without prejudice. Id<\/em>.<\/p>\n\n\n\n

After observing that its recent decision in Cook v. GameStop, Inc<\/em>., 148 F.4th 153 (3d Cir. 2025), \u201cplainly resolve[d]\u201d plaintiffs\u2019 standing challenge, the Third Circuit \u201cbriefly explain[ed]\u201d why plaintiffs failed to establish a concrete injury sufficient to confer Article III standing. Id<\/em>. at *2.<\/p>\n\n\n\n

First, the Third Circuit held that the alleged harm did not share a \u201cclose relationship\u201d to the comparator torts of disclosure of private information or intrusion upon seclusion. Id<\/em>.  With respect to public disclosure of private information, the Third Circuit explained that the two non-purchasing plaintiffsdid not allege that the defendant collected any personal information. Although the purchasing plaintiff entered personal information while using the website, the Third Circuit noted that the tort of public disclosure of private facts requires allegations of resulting embarrassment or humiliation, which were absent from the complaint.  Id<\/em>. <\/p>\n\n\n\n

The Third Circuit similarly concluded that plaintiffs failed to state an analogous intrusion upon seclusion injury. Such a claim requires allegations that the defendant intentionally intruded upon plaintiffs\u2019 \u201cprivate affairs or concerns.\u201d Id<\/em>. The Third Circuit determined that standard was not satisfied because plaintiffs voluntarily provided the information, the allegedly collected information was anonymized, and, in any event, most people \u201cunderstand that what we do on the Internet is not completely private.\u201d Id<\/em>.<\/p>\n\n\n\n

Second, the Third Circuit rejected plaintiffs\u2019 argument that bare violations alone confer standing, concluding that the argument misconstrued Third Circuit precedent and the U.S. Supreme Court\u2019s holding in TransUnion LLC v. Ramirez<\/em>, 594 U.S. 413, 426\u201327 (2021). Id<\/em>. at *2.<\/p>\n\n\n\n

Third, the Third Circuit reasoned that it was \u201chard-pressed to find that a de facto<\/em> invasion of privacy exists where a website makes no express promise to refrain from collecting site visitors’ information.\u201d Id. <\/em>at *3. As explained in Cook<\/em>, \u201cthere is a material difference between an allegation that a website merely failed to ask for visitors\u2019 consent to data collection and an allegation that a website expressly promised it would not collect information but secretly did so anyway.\u201d Id<\/em>. The complaint contained no allegations that the defendant made such a promise.<\/p>\n\n\n\n

The Third Circuit also rejected plaintiffs\u2019 challenge to the District Court\u2019s consideration of the declaration submitted in support of the defendant\u2019s Rule 12(b)(1) motion to dismiss. The Third Circuit emphasized that plaintiffs failed to request discovery to respond to the defendant\u2019s factual challenge despite being given the opportunity to do so, and it agreed that plaintiffs\u2019 \u201cboilerplate averments\u201d alone could not rebut the defendant\u2019s external evidence. Id<\/em>. at *3.<\/p>\n\n\n\n

Accordingly, the Third Circuit affirmed the District Court\u2019s dismissal order for lack of Article III standing but modified the dismissal to be without prejudice.<\/p>\n\n\n\n

Implications For Companies<\/strong><\/p>\n\n\n\n

Smidga <\/em>reinforces that plaintiffs challenging the use of common website analytics and advertising technology must, at a minimum, plausibly allege that the technology collected and disclosed personally identifying information, rather than anonymized, aggregated web-browsing data cryptographically transmitted to software providers\u2019 servers and not viewable or accessible by any human.  Moreover, alleging the collection and disclosure of PII via functionally internal session replay technology may or may not confer standing, depending on the jurisdiction one is in, as we blogged about earlier this month (here<\/a>).<\/p>\n\n\n\n

For companies facing session replay and other data privacy class actions in federal court, Article III standing remains a significant threshold defense that should be evaluated throughout the litigation, while balancing the possibility that claims may continue in state court.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr., Justin Donoho, and Hayley Ryan Duane Morris Takeaways:\u00a0 On May 26, 2026, in Smidga, et al. v. Spirit Airlines, Inc., No. 24-1757, 2026 WL 1470137 (3d Cir. May 26, 2026), the U.S. Court of Appeals for the Third Circuit affirmed a federal district court\u2019s dismissal of a class action alleging … <\/p>\n

Continue reading “Third Circuit Affirms Dismissal Of Session Replay Code Class Action Because The Collection Of Anonymized Information Does Not Constitute A Concrete Injury Necessary To Confer Article III Standing”<\/span><\/a><\/p>\n","protected":false},"author":575,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[170],"ppma_author":[7,122,145],"class_list":["post-2972","post","type-post","status-publish","format-standard","hentry","category-general","tag-data-privacy"],"authors":[{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":122,"user_id":686,"is_guest":0,"slug":"jrdonoho","display_name":"Justin Donoho","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/02\/donohojustin-1-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":145,"user_id":740,"is_guest":0,"slug":"hhryan","display_name":"Hayley Ryan","avatar_url":{"url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/09\/ryanhayley.jpg","url2x":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/09\/ryanhayley.jpg"},"0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2972","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/575"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=2972"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2972\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=2972"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=2972"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=2972"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=2972"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}