Opinion
2:22-1621
06-03-2024
JORDAN SCHNUR, Plaintiff, v. JETBLUE AIRWAYS CORPORATION, Defendants.
MEMORANDUM OPINION
ROBERT J. COLVILLE, UNITED STATES DISTRICT JUDGE
Before the Court is a Motion to Dismiss (ECF No. 30) filed by Defendant in this matter. Defendant moves to dismiss all counts in Plaintiff's First Amended Complaint (ECF No. 23), arguing that Plaintiff has failed to state a claim upon which relief can be granted, that the Court lacks personal jurisdiction over Defendant, that Plaintiff lacks standing to bring this action, and that Plaintiff's claims are barred by Federal law. The Court has subject matter jurisdiction to rule on this matter pursuant to 28 U.S.C. § 1332(a). The Motion has been fully briefed and is ripe for disposition.
I. Factual Background & Procedural History
In the Complaint, Plaintiff sets forth the following factual allegations relevant to the Court's consideration of the Motions at issue:
Defendant's website, www.jetblue.com, employs session replay software (the “Session Replay Code”), which “enables website operators to record, save, and replay website visitors' interactions with [the] website[, providing] online marketers and website designers with insights into the user experience by recording website visitors ‘as they click, scroll, type or navigate across different web pages.'” ECF No. 23 ¶ 23 (quoting Erin Gilliam Haije, Are Session Recording Tools a Risk to Internet Privacy?, Mopinion (Mar. 7, 2018)). The software “works by inserting computer code into the various event handling routines that web browsers use to receive input from users.” Id. ¶ 25. It can monitor “all mouse movements, clicks, scrolls, zooms, window resizes, keystrokes, text entry, and numerous other forms of a user's navigation and interaction through the website.” 26. After this information is recorded, “a website operator can view a visual reenactment of the user's visit through the Session Replay Provider, usually in the form of a video.” Id. ¶ 28.
“[The Session Replay Code] collects highly personal information and substantive communications that can be linked directly to a website user's identity as it monitors, records, and collects a website user's every move [which] can then be used to play back a user's journey through a website, showing how they interacted with site navigation, calls to action, search features, and other on-page elements.” Id. ¶ 48. It also collects “IP address information, [which] enables websites such as JetBlue to search recorded website user sessions by specific locations that is ‘fairly accurate' at the country and state level.” Id. ¶ 49. Notably, “[t]he Session Replay Code procured by [Defendant] is not a website cookie, analytics tool, tag, web beacon, or other similar technology. Instead, the data collected by the Session Replay Code identified specific information inputted and content viewed, and thus revealed personalized and sensitive information about website visitors' Internet activity and habits.” Id. ¶ 68.
Plaintiff visited Defendant's website, and some of his actions and communications on the site were recorded by the Session Replay Code. Id. ¶ 53-58. Plaintiff did not provide prior consent. Id. ¶ 70. And JetBlue did not ask for it. Id. ¶ 71.
Plaintiff brings claims for violations of the Pennsylvania Wiretap Act, under 18 Pa. Cons. Stat. § 5701, (the “PWA”), and common law Invasion of Privacy - Intrusion Upon Seclusion, individually and on behalf of the following Class: All natural persons in Pennsylvania whose Website Communications were captured in Pennsylvania through the Session Replay Code embedded in www.jetblue.com. Id. ¶¶ 75, 84-117. On February 21, 2023, Plaintiff filed an Amended Complaint. On March 31, 2023, Defendant filed a Motion to Dismiss, along with a Brief in Support (ECF No. 31).
II. Legal Standard
Defendant has moved to dismiss for lack of personal jurisdiction under Federal Rule of Civil Procedure 12(b)(2), for lack of standing under Article III of the United States Constitution, and for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6).
A. Personal Jurisdiction
A motion to dismiss under Federal Rule of Civil Procedure 12(b)(2) tests the Court's power over the defendant. There are two kinds of personal jurisdiction: specific and general. A court that has general jurisdiction over a party has jurisdiction to hear all claims against that party, irrespective of the relationship between those claims and the forum State. Burger King Corp. v. Rudzewicz, 471 U.S. 462, 473 n.15 (1985). General jurisdiction is proper over corporations “when their affiliations with the State are so ‘continuous and systematic' as to render them essentially at home in the forum State.” Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 92324 (2011) (quoting Int'l Shoe Co. v. Washington, 326 U.S. 310, 317 (1945)). A corporation is typically “at home” where it is incorporated and where it has its principal place of business. See Daimler AG v. Bauman, 571 U.S. 117, 137 (2014) (“With respect to a corporation, the place of incorporation and principal place of business are ‘paradig[m] . . . bases for general jurisdiction.'” (quoting Lea Brilmayer, Jennifer Haverkamp, & Buck Logan, A General Look at General Jurisdiction, 66 TEX. L. REV. 721, 735 (1988)).
Specific jurisdiction, on the other hand, exists where a claim relates to the defendant's contacts with the forum. See Goodyear, 564 U.S. at 923-24 (“Adjudicatory authority is ‘specific' when the suit ‘aris[es] out of or relate[s] to the defendant's contacts with the forum.'” (quoting Helicopteros Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 414 n.8 (1984))). Under the Federal Rules of Civil Procedure, district courts may exercise specific personal jurisdiction over non-residents to the extent permissible under the law of the state in which the district court is located. Fed.R.Civ.P. 4(e); N. Penn Gas Co. v. Corning Nat. Gas Corp., 897 F.2d 687, 689 (3d Cir. 1990). In exercising personal jurisdiction, a court must first ascertain whether jurisdiction exists under the forum state's long-arm jurisdiction statute and then determine whether the exercise of jurisdiction comports with the Due Process Clause of the Fourteenth Amendment to the Constitution. Van Buskirk v. Carey Canadian Mines, Ltd., 760 F.2d 481, 489-90 (3d Cir.1985).
In Pennsylvania, the inquiry into whether the state's long-arm statute satisfies the United States Constitution is straightforward. The statute provides that “the jurisdiction of the tribunals of this Commonwealth shall extend to all persons . . . to the fullest extent allowed under the Constitution of the United States and may be based on the most minimum contact with this Commonwealth allowed under the Constitution of the United States.” 42 Pa. Const. Stat. § 5322(b); Van Buskirk, 760 F.2d at 490. The reach of the Pennsylvania long-arm statute is thus “coextensive” with the Due Process Clause. North Penn Gas, 897 F.2d at 690. Under International Shoe, the Due Process Clause permits the court to assert personal jurisdictional over a nonresident defendant who has “certain minimum contacts with [the forum] such that the maintenance of [a] suit does not offend traditional notions of fair play and substantial justice.” Int'l Shoe Co., 326 U.S. at 316 (quotations omitted).
To establish “minimum contact” in intentional torts cases, the United States Supreme Court has developed a three-pronged “effects” test. Calder v. Jones, 465 U.S. 783 (1984). Under the Calder test, the following elements must be satisfied: (1) the defendant committed an “intentional tort,” (2) the plaintiff “felt the brunt of the harm” in the forum, such that the forum can be said to be the focal point of the harm suffered, and (3) the defendant “expressly aimed” the allegedly tortious conduct at the forum. See IMO Indus., Inc. v. Kiekert AG, 155 F.3d 254, 265-66 (3d Cir. 1998); Remick v. Manfredy, 238 F.3d 248, 260 (3d Cir. 2001).
The plaintiff bears the burden of establishing that these standards are met to show that personal jurisdiction exists over the defendant. Where the parties have not conducted discovery, the plaintiff need only make a prima facie showing that jurisdiction is proper, and the pleadings and affidavits are to be construed in the light most favorable to the plaintiff. See Autogenomics, Inc. v. Oxford Gene Tech. Ltd., 566 F.3d 1012, 1017 (Fed. Cir. 2009) (quoting Avocent Huntsville Corp. v. Aten Int'l Co., 552 F.3d 1324, 1328 (Fed. Cir. 2008).
B. Article III Standing
“Federal courts are courts of limited jurisdiction.” Ins. Corp. of Ireland v. Compagnie des Bauxites de Guinee, 102 S.Ct. 2099, 2104 (1982). As such, the Court does not proceed with the “presumption that [it has] . . . jurisdiction to adjudicate a particular case,” Allison v. Chesapeake Energy Corp., 2013 WL 787257 (W.D. Pa. Jan. 29, 2013), and must do an analysis on a plaintiff's standing. “Absent Article III standing, a federal court does not have subject matter jurisdiction to address a plaintiff's claims, and they must be dismissed.” Taliaferro v. Darby Twp. Zoning Bd., 458 F.3d 181, 188 (3d Cir. 2006).
Under Article III of the United States Constitution, the power of the federal judiciary is limited to “cases” and “controversies.” U.S. Const. art. III, § 2. To establish the existence of a case or controversy, a plaintiff must show that (1) as a result of the defendant's conduct (2) the plaintiff suffered an injury in fact (3) that a favorable decision can redress. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61 (1992). However, it is not the case that “a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016). As the Supreme Court ruled in TransUnion v. Ramirez, “[o]nly plaintiffs concretely harmed by a defendant's statutory violation have Article III standing to seek damages against that private defendant in federal court.” 594 U.S. 413 (2021). While physical and monetary injuries are the more readily identifiable concrete harms, concreteness can also be found when the “harm has a ‘close relationship' to a harm ‘traditionally' recognized as providing a basis for a lawsuit in American courts.” Id. (quoting Spokeo, 578 U.S. 330, at 340). The types of harms with such a tradition “include, for example, reputational harms, disclosure of private information, and intrusion upon seclusion.” Id. at 425 (citing Gadelhak v. AT&T Services, Inc., 950 F.3d 458, 462 (CA7 2020) (Barrett, J.)). At bottom, TransUnion attempts to limit standing to only those who were victims of bad acts and to prevent “virtually any citizen [from bringing] a statutory damages suit against virtually any defendant who violated virtually any federal law.” Id. at 428.
C. Failure to State a Claim
A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests the legal sufficiency of the complaint. Kost v. Kozakiewicz, 1 F.3d 176, 183 (3d Cir. 1993). In deciding a motion to dismiss, the court is not opining on whether the plaintiff will likely prevail on the merits, but simply accepts as true all well-pled factual allegations in the complaint and views them in a light most favorable to the plaintiff. U.S. Express Lines Ltd. v. Higgins, 281 F.3d 383, 388 (3d Cir. 2002). While a complaint does not need detailed factual allegations to survive a Rule 12(b)(6) motion to dismiss, a complaint must provide more than labels and conclusions. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). A “formulaic recitation of the elements of a cause of action will not do.” Id. (citing Papasan v. Allain, 478 U.S. 265, 286 (1986)).
“To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.'” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 554). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678 (citing Twombly, 550 U.S. at 556). The Supreme Court of the United States has explained:
The plausibility standard is not akin to a “probability requirement,” but it asks for more than a sheer possibility that a defendant has acted unlawfully. Where a complaint pleads facts that are “merely consistent with” a defendant's liability, it “stops short of the line between possibility and plausibility of ‘entitlement to relief.'”Id. (quoting Twombly, 550 U.S. at 556) (internal citations omitted).
The United States Court of Appeals for the Third Circuit instructs that “a court reviewing the sufficiency of a complaint must take three steps.” Connelly v. Lane Constr. Corp., 809 F.3d 780, 787 (3d Cir. 2016). The court explained:
First, it must “tak[e] note of the elements [the] plaintiff must plead to state a claim.” Iqbal, 556 U.S. at 675. Second, it should identify allegations that, “because they are no more than conclusions, are not entitled to the assumption of truth.” Id. at 679; see also Burtch v. Milberg Factors, Inc., 662 F.3d 212, 224 (3d Cir. 2011) (“Mere restatements of the elements of a claim are not entitled to the assumption of truth.” (citation and editorial marks omitted)). Finally, “[w]hen there are well-pleaded factual allegations, [the] court should assume their veracity and then determine whether they plausibly give rise to an entitlement to relief.” Iqbal, 556 U.S. at 679.
Connelly, 809 F.3d at 787. “Determining whether a complaint states a plausible claim for relief will . . . be a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Iqbal, 556 U.S. at 679 (internal citations omitted).
In addition to reviewing the facts contained in the complaint, a court may consider “matters of public record, orders, exhibits attached to the complaint and items appearing in the record of the case.” Oshiver v. Levin, Fishbein, Sedran & Berman, 38 F.3d 1380, 1384 n.2 (3d Cir. 1994). When a document integral to or relied upon in the complaint is included, the court may also consider that document. In re Burlington Coat Factory Sec. Litig., 114 F.3d 1410, 1426 (3d Cir. 1997).
Although a district court is not obligated to permit leave to amend before dismissing a complaint in a non-civil rights case, Wolfington v. Reconstructive Orthopaedic Assocs. II P.C., 935 F.3d 187, 210 (3d Cir. 2019), courts generally grant leave to amend unless amendment of the complaint would be inequitable or futile. See, e.g., Bachtell v. Gen. Mills, Inc., 422 F.Supp.3d 900, 915 (M.D. Pa. Oct. 1, 2019) (citing Phillips v. Allegheny Cty., 515 F.3d 224, 245 (3d Cir. 2008)).
III. Discussion
A. Personal Jurisdiction
As to personal jurisdiction, Plaintiff argues that jurisdiction is proper because “[t]he privacy violations complained of [in the Complaint] resulted from Defendant's purposeful and tortious acts directed towards citizens of Pennsylvania while they were located within Pennsylvania.” ECF No. 23 ¶ 8 In other words, taking the Complaint in its totality, Plaintiff posits that the allegations meet the Calder effects test: (1) by violating the Pennsylvania Wiretap Act and common law invasion of privacy rules, Defendant has committed an intentional tort, (2) Plaintiff visited the JetBlue website and had his interactions recorded within Pennsylvania, and therefore felt the brunt of the harm in this forum, and (3) Defendant expressly aimed its tortious conduct at Pennsylvania, by servicing two major airports in the state, which essentially guaranteed that residents of the state would visit the website and have their actions recorded.
Defendant does not contest that the first two factors of the Calder test are met, and instead focuses its challenge on the “expressly aiming” prong. Defendant argues that “Plaintiff attempts to link JetBlue's activity to Pennsylvania by alleging . . . conduct unrelated to any alleged wiretapping[, which] is irrelevant to whether the Court has personal jurisdiction.” ECF No. 31 at 7. Citing Goodyear, 564 U.S. at 919, Rittinger v. Keystone Maint. Servs. Corp., 2018 WL 3455856, at *7-8 (M.D. Pa. Jul. 18, 2018)), and Bomberger v. Am. Airlines, Inc., 2018 WL 3416386, at *2 (E.D. Pa. July 12, 2018)), Defendant posits that the act that created the connection to the forum was unrelated to the cause of action, and therefore cannot establish expressed aiming under Calder.
Defendant further argues that courts repeatedly find a lack of express aiming in cases involving globally available websites. In Kim v. Korean Air Lines Co., the court granted the defendant's motion to dismiss for lack of personal jurisdiction because “the mere operation of a commercially interactive web site” does not establish that the website was purposefully directed at the forum, just because the website is accessible therefrom. 513 F.Supp.3d 462 (D.N.J. 2021) (quoting Toys “R” Us, Inc. v. Step Two, S.A., 318 F.3d 446, 454 (3d Cir. 2003)). Defendant further cites to Hadnagy v. Moss, 2023 WL 114689, at *7 (E.D. Pa. Jan. 5, 2023) (“[Publishing information] on the Internet [that is] accessible and widely disseminated [is not sufficient to establish personal jurisdiction absent] facts to support the theory that the [information] was specifically circulated or concentrated in Pennsylvania.”), Shuker v. Smith & Nephew, PLC, 885 F.3d 760, 780 (3d Cir. 2018) (“[N]ationally directed efforts . . . to exploit a national market [that] necessarily include[s] Pennsylvania,” do not establish purposeful availment), and Remick v. Manfredy, 238 F.3d 248, 259 (3d Cir. 2001) to show that nationally available websites cannot establish expressed aiming. Defendant posits that its website is aimed at a global audience, and so a fortiori should not satisfy the express aiming prong of the Calder test.
Defendant further argues that the record does not support a finding that JetBlue knew that Plaintiff would suffer the brunt of the harm in Pennsylvania. To establish the expressed aiming element, the plaintiff must show that the defendant knew that the plaintiff would suffer the brunt of the harm in the forum state. IMO Indus., 155 F.3d at 266. Defendant concludes that the company's general knowledge that its website collected data from visitors in Pennsylvania would not establish jurisdiction because “the foreseeability of harm being suffered in a forum is insufficient to establish personal jurisdiction under Calder.” LaSala v. Marfin Popular Bank Pub. Co., 410 Fed.Appx. 474, 477 (3d Cir. 2011) (citing Marten v. Godwin, 499 F.3d 290, 297 (3d Cir. 2007)).
The Court analyzes these issues differently. The Korean Air Lines case cited by defendant derives its reasoning from Toys “R” Us, a case in which the court was ruling during the infancy of the world wide web, when the commercial nature of business websites was simply not as robust. In 2003, it was yet unclear that the internet would become the primary marketplace for businesses. Applying the standard described by Defendant would essentially foreclose most people injured by e-commerce websites from seeking redress in the forum in which they were harmed. In Toys “R” Us, the Third Circuit Court established a distinction between a company that incidentally makes its website available in a particular state (because it is available nationwide) and a company that “directly target[s] its web site to the state, knowingly interact[s] with residents of the forum state via its web site, or through sufficient other related contacts.” 318 F.3d at 454. By the Court's reading of the record, Defendant's website is more analogous to the latter. Defendant services customers in Pennsylvania primarily through airports, but has an additional interest in having residents in Pennsylvania visit the website to facilitate ease of commerce.
The analysis is similar for the other cases cited by Defendant. Defendant has a particular interest in attracting Pennsylvania residents to its website, because of the two major airports in the state, one in Philadelphia and one in Pittsburgh. ECF No. 23 ¶ 9. The website is not merely informational nationally and incidentally available in Pennsylvania. Interactions with Pennsylvanians have specific benefits to Defendant, and increased engagement by Pennsylvanians is likely to translate into direct and specific Pennsylvania-based commercial benefits for the company. People visiting jetblue.com within Pennsylvania are very likely seeking a service that Defendant will provide, at least in part, within Pennsylvania. The Court notes that flight tickets are purchased, if not predominantly then at least frequently enough, online. This would mean that if two airports service passengers either leaving from or heading to Pennsylvania, then Defendant specifically benefits from Pennsylvania residents visiting the website, and Defendant, therefore, “appeals to, and profits from, an audience in [this] particular state.” Massie v. Gen. Motors Co., 2021 WL 2142728, at *5 (E.D. Cal. May 26, 2021).
The Court is also unpersuaded by Defendant's claim that the Amended Complaint fails to allege facts showing that JetBlue knew Plaintiff would suffer the brunt of the harm in Pennsylvania. ECF No. 31 at 8. In the LaSala case quoted by Defendant, the Third Circuit Court found that “the foreseeability of harm being suffered in a forum is insufficient to establish personal jurisdiction under Calder. In the absence of ‘specific facts showing a deliberate targeting of [the forum],' the District Court properly refused to premise personal jurisdiction upon the effects test.” 410 Fed.Appx. at 477 (quoting Marten, 499 F.3d at 298). In other words, foreseeability alone may not establish expressed aiming, but it does not foreclose it either. Facts showing deliberate targeting of the forum do satisfy the expressed aiming prong of the Calder test. As discussed above, the facts in the Complaint, if true, would show that Defendant deliberately targets this forum. Jetblue.com is not merely an informational website available nationwide so that Americans can engage with the brand or receive a service accessed directly through an online application or portal. That sort of website may establish the mere foreseeability of harm in Pennsylvania. Instead, Defendant's website provides a platform by which Defendant sells the service of transporting travelers to and from various airports. The potential customers who live near those airports are not just foreseeable customers, but targeted ones. Thus, the Court finds that deliberate targeting is satisfied.
Accordingly, the Court finds that Defendant is subject to personal jurisdiction in Pennsylvania.
B. Article III Standing
Defendant argues that Plaintiff lacks standing under Article III of the U.S. Constitution, because by alleging merely that his mouse movements, clicks, keystrokes, page views, location, and information entered were recorded, Plaintiff has not established concrete harm. Citing Nyanhongo v. Credit Collection Services, Defendant argues that courts within this Circuit tend to not find harm where plaintiffs fail to explain how the violation of a statute concretely harmed them. WL 1546233, at *3 (E.D. Pa. Apr. 20, 2021). However, this decision was decided prior to the Article III standard set by the U.S. Supreme Court in TransUnion.
While Nyanhongo was decided before TransUnion, it is worth pointing out that even after TransUnion, the facts in that case would have been distinct enough from the instant case to have warranted different outcomes. In Nyanhongo, the statute at issue was designed to prevent debt collectors from adding potentially embarrassing details to the outside of collection letter envelopes. This was to protect the dissemination to third parties of the specific embarrassing fact that a person is facing financial hardship. WL 1546233, at *2. Nevertheless, the court found that had the plaintiff alleged that private information had been conveyed on an envelope from a collector, even if such information had never reached a third party, Article III standing would be satisfied. Id. at *3 (citing Sussino v. Work Out World, Inc., 862 F.3d 346, 351-52 (3d Cir. 2017)). Ultimately, the plaintiff lacked standing because her letter had certain information that the statute advised against but that were not personal or indicative of collections. As such, she did not allege that she was the victim of the variety of harm the statute contemplated. Id. The court's ultimate analysis was that the statute was more about a specific issue with collections agencies and their abusive business practices, not about a broad right that individuals have to not receive letters with certain markings on them. The intent of the PWA is not so constrained. It is not meant to protect against the collection of only sensitive information. Rather, it protects the fundamental right to not have your seemingly private communications molested by prying ears, however benign or non-delicate such communications may be. As the Court sees it, the intent of the PWA is met by the allegation that Defendant did record seemingly private information that Plaintiff did not choose to submit to Defendant. Within the universe of TransUnion, the distinctions are potentially even more pronounced.
The facts in the instant matter are fairly analogous to the facts in TransUnion, where the Supreme Court found that Article III standing was satisfied. In that case, the plaintiffs sued the defendant under the Fair Credit Reporting Act for providing misleading credit reports to third parties. TransUnion, 594 U.S. at 417. Justice Kavanaugh, writing for the majority, ruled that, even though the information in the credit reports may not have been false, the injury under the statute still bore a close relationship to the traditional injury of defamation, thereby satisfying the concreteness requirement necessary to establish Article III standing. Id. at 432. Here, Plaintiff sues Defendant under the PWA for non-consensual recording of various, otherwise private, movements and communications. The injury under the PWA bears a close relationship to the broad category of traditional invasion of privacy injuries, including common law intrusion upon seclusion, eavesdropping, trespass, and others. The PWA alone is not the sole method by which litigants have been, historically, made whole for having their private information invaded or recorded. Courts have recognized a cause of action for such invasions since well before it became common for state legislatures to provide statutory remedies. See, e.g., Rhodes v. Graham, 37 S.W.2d 46 (1931) (“The evil incident to the invasion of the privacy of the telephone is as great as that occasioned by unwarranted publicity in newspapers and by other means of a man's private affairs for which courts have granted the injured person redress. Whenever a telephone line is tapped the privacy of those talking over the line is invaded and conversations, wholly proper and confidential, may be overheard. Wire tapping is akin to eavesdropping, which was an indictable offense at common law, and while it has not been made a punishable offense by statute in this state, we conclude that the facts alleged in the petition in this case constitute a wrong done to appellant for which the law affords a remedy by an action for damages.”).
The Court stresses that it does not read Article III and the governing caselaw as requiring that concrete harm meet the standards for harm established for proof of the required elements for the cause of action. For instance, as the Court will note later in this memorandum order, infra Section III (C)(b), courts in this District have set a high bar to meet the “highly offensive” element of Intrusion Upon Seclusion. To establish Article III standing on a claim of Intrusion Upon Seclusion, a plaintiff must merely show that (1) the defendant's violation (2) harmed the plaintiff (3) in a manner for which courts traditionally provide a remedy, not that the harm was “highly offensive.” As the Court reads it, the corpus of Article III caselaw assessing the question of the concreteness of intangible harm is driving at a very particular limitation: the plaintiff should be the party injured by the statutory violation. See, e.g., Warth v. Seldin, 422 U.S. 490, 498 (1975) (“[T]he standing question is whether the plaintiff has alleged such a personal stake in the outcome of the controversy as to warrant his invocation of federal-court jurisdiction and to justify exercise of the court's remedial powers on his behalf.” (internal quotation marks omitted)); Allen v. Wright, 468 U.S. 737, 761 (1984) (“A black person in Hawaii [should not have standing to] challenge the grant of a tax exemption to a racially discriminatory school in Maine. Recognition of standing in such circumstances would transform the federal courts into no more than a vehicle for the vindication of the value interests of concerned bystanders.” (internal quotation marks omitted)); Lujan, 504 U.S. at 561-62 (“[T]he nature and extent of facts that must be averred . . . in order to establish standing depends considerably upon whether the plaintiff is himself an object of the action . . . If he is, there is ordinarily little question that the action . . . has caused him injury, and that a judgment preventing or requiring the action will redress it.”); Hollingsworth v. Perry, 570 U.S. 693, 707 (2013) (“Article III standing is not to be placed in the hands of concerned bystanders, who will use it simply as a vehicle for the vindication of value interests.” (internal quotation marks omitted); TransUnion, 594 U.S. at 429 (“Private plaintiffs are . . . not charged with pursuing the public interest in enforcing a defendant's general compliance with regulatory law.”).
Some courts have found that, for Article III standing purposes, it would be appropriate at the pleading stage to determine whether the harm alleged would be sufficient to establish harm under the closely connected traditionally harmful cause of action. See, e.g., Cook, 2023 WL 5529772, at *4 (“[T]he Court must examine the nature of the information that [the defendant] allegedly intercepted and determine whether the interception of that kind of information amounts to an invasion of privacy interests that have been historically protected.”). But the Court is instructed more directly by the Supreme Court. “In looking to whether a plaintiff's asserted harm has a ‘close relationship' to a harm traditionally recognized as providing a basis for a lawsuit in American courts, we do not require an exact duplicate.” TransUnion, 594 U.S. at 433. In fact, in TransUnion, the Supreme Court found that the plaintiff's claim of harm can qualify for Article III standing, even if harm would not be established under the standards of the traditional harm the plaintiff's cause of action was closely related to. As noted, in that case, the plaintiff did not allege that the information disseminated was untrue, and the Supreme Court made no finding that negative speech that is true is actionable. Instead, the Supreme Court found that the harm alleged, while perhaps not defamation (a cause of action that requires the negative statement to be untrue), was sufficiently closely related to the traditionally recognized harm of defamation. Id. The allegations, for standing analysis purposes, did not need to satisfy the defamation cause of action.
Plaintiff alleges that Defendant violated the law and that Plaintiff was the victim of said violation. The sort of harm outlined in the PWA is closely related to several harms that American courts have traditionally recognized as worthy of remedy. Thus, the Court is satisfied that Article III standing is met.
C. Failure to State a Claim
a. Count I - Pennsylvania Wiretap Act 18 Pa. Cons. Stat. § 5701
The PWA criminalizes various actions related to intentionally intercepting or trying to intercept any wire, electronic, or oral communication. 18 Pa. Cons. Stat. § 5703. More specifically, it “prohibits the interception of an electronic communication without prior consent.” Cook v. GameStop, Inc., 2023 WL 5529772, at *6 (W.D. Pa. Aug. 28, 2023) (emphasis added) (quoting 18 Pa. Cons. Stat. § 5725(a)). To establish a PWA violation, a plaintiff must show:
(1) that [the claimant] engaged in a communication; (2) that he possessed an expectation that the communication would not be intercepted; (3) that his expectation was justifiable under the circumstances; and (4) that the defendant attempted to, or successfully intercepted the communication, or encouraged another to do so.Kelly v. Carlisle, 622 F.3d 248, 257 (3d Cir. 2010) (quoting Agnew v. Dupler, 553 Pa. 33, 717 A.2d 519, 522 (Pa. 1998)).
Courts tend to dispense with defining “communication” in any particular fashion, seeming to accept the common parlance, and finding that verbal, signed, or written congress is communication for PWA purposes. See, e.g., Mulder v. Wells Fargo Bank, N.A., 2018 WL 3750627 (W.D. Pa. July 10, 2018); Oliver v. Noom, Inc., 2023 WL 8600576, at *7 (W.D. Pa. Aug. 22, 2023); In re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125 (3d Cir. 2015).
Defendant argues that the information gathered by the Session Replay Code is not a “communication” because it does not qualify as “contents of communication” under the definition of “content” in the PWA, which creates a cause of action for, among other things, “intentionally disclos[ing] or endeavor[ing] to disclose to any other person the contents of any wire, electronic or oral communication, or evidence derived therefrom, [while] knowing or having reason to know that the information was obtained through the interception of a wire, electronic or oral communication.” 18 Pa. Cons. Stat. § 5703(2) (emphasis added). Defendant claims that “mouse clicks and movements, keystrokes, search terms, information inputted by Plaintiff, and pages and content viewed by Plaintiff . . . because it does not convey the substance or meaning of any message” are examples of information intercepted that would not be considered contents. ECF No. 31 at 19 (quoting Jacome v. Spirit Airlines Inc., 2021 WL 3087860, at *4 (Fla. Cir. Ct. June 17, 2021)).
This argument fails for various reasons. First, in a highly analogous case, Judge Stickman stated, “Plaintiffs allege that [the] Session Replay Code records all website visitor actions[,] which necessarily includes all of the information input.... At this stage, these allegations are sufficient to establish that [the defendant] intercepted contents of [the p]laintiff['s] communications.” Oliver, 2023 WL 8600576, at *7 (internal quotation marks omitted, emphasis added) (citing Google Inc. Cookie Placement, 806 F.3d at 139 (“Because the complaint pleads a broad scheme in which the defendants generally acquired and tracked the plaintiffs' internet usage, we are satisfied that this scheme, if it operated as alleged, involved the collection of at least some ‘content' within the meaning of the Wiretap Act.”)).
Second, there is a viable cause of action under the PWA that does not require the interception of the “contents” of a communication. Plaintiff brings this action under 18 Pa. Const. Stat. §§ 5703(1)-(3). 18 Pa. Cons. Stat. § 5703(1) creates a cause of action against one who “intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept any wire, electronic or oral communication.” No mention of content here, and this alone would provide Plaintiff with a viable cause of action under the PWA.
Defendant claims that Plaintiff had “no expectation of privacy in his communications on the Website,” because Plaintiff consented to such interception. ECF No. 31 at 3-4. “[A]n interception does not occur where a party elects to [communicate] with or send messages to a recipient.” Id. (citing Com. v. Cruttenden, 619 Pa. 123, 58 A.3d 95, 100 (2012)). The Court derives the inverse, as well, that when a party does not elect to communicate or send a message, the acquisition of said communication through indirect means is an interception. Here, the Complaint alleges that Defendant's website provides no method for visitors to consent to having their mouse movements and keystrokes recorded. Defendant contends that Plaintiff did in fact consent, because “he expressly clicked his assent to JetBlue's use of cookies.” ECF No. 31 at 4. The Court does not accept that this would qualify as notice or consent, as the Session Replay Code does not record cookies. Additionally, Plaintiff alleges that no such banner was available on Defendant's website at the time that he visited, which presents a material dispute of substantive fact between the parties. ECF No. 23 ¶ 20. Further, the Court found no source in this District or under this Circuit to suggest that visitors to websites should justifiably expect to have all their actions recorded. On the contrary, courts have found that software like the Session Replay Code are not an expected component of internet activity. See, e.g., Oliver, 2023 WL 8600576. The Court finds that Plaintiff had a justifiable expectation that his keystroke and mouse movement activity on Defendant's website was not being recorded.
An “interception” is an “[a]ural or other acquisition of the contents of any wire, electronic or oral communication through the use of any electronic, mechanical or other device.” 18 Pa. Cons. Stat. § 5702. Such an interception happens “when the contents of a communication are ‘captured or redirected in any way.'” Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (3d Cir. 2022) (quoting United States v. Rodriguez, 968 F.2d 130, 136 (2d Cir. 1992)).
Defendant posits that there was no interception because the Session Replay Code is not an intercepting “device” under the meaning of the PWA. ECF. No. 31 at 16. The [PWA] defines “device” as “[a]ny device or apparatus . . . that can be used to intercept a wire, electronic or oral communication.” 18 Pa. Cons. Stat. § 5702. Defendant argues that the Session Replay Code is not a device, as such, but an intangible computer code embedded in the website's software. Id. Quoting a case from the District of Maryland, Defendant argues that “the ‘most natural reading' of a ‘device' is something like a ‘piece of equipment.'” Mason v. Mach. Zone, Inc., 140 F.Supp.3d 457, 462-63 (D. Md. 2015).”
The Court does not accept this argument on multiple levels. First, the Court is not bound by the opinion Defendant cites. Courts in this District have found that software similar to the Session Replay Code do fall within the definition of “device.” See, e.g., Oliver, 2023 WL 8600576, at *6. Second, as a practical matter, software does not operate independently of hardware. Not only is Plaintiff's computer or mobile phone, which facilitated the connection to Defendant's website, a “device,” but the Session Replay Code itself operates on a remote computer or server controlled by Defendant. It is hard to imagine that software installed on a user's phone that intercepts phone conversations would not fall under the category of “device” for PWA purposes, and the Court fails to see why it should be any different for internet communications. Accordingly, the Court finds that the Session Replay Code, or Defendant's remote hardware that operates the Session Replay Code, is a device that intercepts under the meaning of the PWA.
It is worth noting that the Court does not read the case from the District of Maryland as a proper analogue to the matter here. That case involved a California statute banning the manufacture of slot machine devices. The court there found that because the defendant created a computer game that the plaintiff knowingly downloaded onto her hardware (effectively providing half the machine), it would not be sensible to claim that the defendant manufactured an outlawed “device.” Here, Plaintiff did something similar to the plaintiff in that case, by interacting with Defendant's website. He used his own hardware device to visit the site and navigate to the various pages. However, that is not the “device” under scrutiny here. The second “secret” device, operating from a remote location, is not something Plaintiff chose to download to his device, thereby providing the hardware half of the machine. Indeed, Defendant used its own device that could remotely access keystrokes and mouse movements.
Defendant further argues that there is no interception because its access to Plaintiff's internet activity was not contemporaneous with the transmission. ECF No. 31 at 19. If the Court understands this correctly, Defendant argues that Plaintiff's interactions with the website were recorded at the point of transmission, but they were then stored in a server for access at a later date. Because Defendant did not conduct the interception “in flight,” to borrow Defendant's football analogy, this would be more properly categorized as an “acquisition from electronic storage,” rather than an “interception.” Id. at 20.
To paraphrase Judge Easterbrook, it is risky to defend against one claim by admitting to another. It sounds here as if Defendant is instructing Plaintiff to go after it under 18 Pa. Cons. Stat. § 5741. But the Court is not so sure. In United States v. Szymuszkiewicz, an employee redirected his boss's incoming emails to his own inbox. 622 F.3d 701 (7th Cir. 2010), as amended (Nov. 29, 2010). The court there found that although the emails only redirected after they had arrived in their intended destination inbox, contemporaneousness was still met. Id. at 706. The instant matter more clearly shows contemporaneousness than Szymuszkiewicz, because the intercepting portion of the alleged wrongful act happens in the moment of the transmission. This Court fails to understand what separates this from any type of recording device that taps into a telephone conversation to be listened to later. Plaintiff is not alleging that Defendant wiretapped him when JetBlue accessed the recorded data, but rather when it (or its third-party software) recorded his data.
For the reasons discussed, as to the PWA claim, the Court denies Defendant's motion to dismiss.
b. Count II - Common Law Invasion of Privacy - Intrusion Upon Seclusion
Under the Restatement of Torts, Intrusion Upon Seclusion requires the plaintiff to show “(i) an intentional intrusion (ii) upon the seclusion of another that is (iii) highly offensive to a reasonable person.” In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 293 (3d Cir. 2016) (citing RESTATEMENT (SECOND) OF TORTS § 652B (Am. L. Inst. 1972)); see also Boring v. Google Inc., 362 Fed.Appx. 273, 278-79 (3d Cir. 2010) (“To state a claim for intrusion upon seclusion, plaintiffs must allege conduct demonstrating ‘an intentional intrusion upon the seclusion of [her] private concerns which was substantial and highly offensive to a reasonable person, and aver sufficient facts to establish that the information disclosed would have caused mental suffering, shame or humiliation to a person of ordinary sensibilities.'” (quoting Pro Golf Mfg., Inc. v. Trib. Rev. Newspaper Co., 570 Pa. 242, 809 A.2d 243, 247 (2002))).
An intrusion may be physical, but it can also involve some form of eavesdropping or attempt to investigate or examine someone's private affairs. RESTATEMENT (SECOND) OF TORTS § 652B. An intentional intrusion is established by showing that the defendant lacked “the necessary legal or personal permission to commit the intrusive act.” O'Donnell v. United States, 891 F.2d 1079, 1083 (3d Cir. 1989). In the context of internet activity monitoring, if “the plaintiffs [n]ever authorized [the defendant] to collect or disclose their personal information,” this establishes that the defendant had substantial certainty that it lacked permission to intrude. Nickelodeon, 827 F.3d at 293. “Courts ‘have appropriately treated the presence or absence of consent as a key factor in' determining whether an alleged intrusion occurred without ‘legal or personal permission.'” Oliver, 2023 WL 8600576, at *9 (quoting Nickelodeon, 827 F.3d at 293). Here, Plaintiff alleged that Defendant never received consent to intrude upon his internet behavior. ECF No. 23 ¶ 101. Thus, the Court finds that Plaintiff properly alleges that Defendant's use of Session Replay Code software is an “intentional intrusion” for the common-law claims purposes.
Establishing that the intrusion was “upon the seclusion of another” requires a showing that the defendant intruded upon a space where the plaintiff had an expectation of privacy. Notably, “a person ‘has no legitimate expectation of privacy in information he voluntarily turns over to third parties.'” United States v. Bowers, 2021 WL 2882438, at *3 (W.D. Pa. July 8, 2021) (quoting Smith v. Maryland, 442 U.S. 735, 743-44 (1979)). The inverse is true, as well; what is turned over involuntarily maintains its expectation of privacy. See, e.g., Oliver, 2023 WL 8600576, at *9 (dismissing claims only as related to information voluntarily provided). The Third Circuit Court has noted that sophisticated internet users likely know that their browsing activity may be monitored when visiting a website. Google Inc. Cookie Placement, 806 F.3d at 151. However, this was intrinsically linked to consent; allowing cookies is clear consent to collect them, and refusing cookies is clear indication that cookies are presumed private and collecting them is non-consensual. Id. Here, Plaintiff alleges that the Session Replay Code on Defendant's website is enabled before visitors have a chance to consent to any monitoring. ECF No. 23 ¶ 73. Further, the only consent Defendant requests is to collect cookies, not to fully monitor every aspect of visitor activity. Id. Notifying website visitors in a terms page of the fact that defendant collects all activity is not sufficient prior notice, because the Session Replay Code is deployed as soon as users visit the website, before they have had a chance to read any terms of service or user agreements.
Courts have likened the degree of privacy reasonably expected online to that in a brick-and-mortar store. See, e.g., Farst v. AutoZone, Inc., 2023 WL 7179807 (M.D. Pa. Nov. 1, 2023) (“Shopping on a public website, like shopping in a public store, is not an activity one can reasonably expect to keep private from the retailer.”); Cook, 2023 WL 5529772, at *5 (“[Session replay] information is no different from what [the defendant's] employees would have been able to observe if [the plaintiff] had gone into a brick-and-mortar store and began browsing the inventory.”). This is certainly true in terms of shopping activity, where it would essentially be unimaginable to withhold from an online retailer that you made a purchase on its website or even added an item to your online shopping cart. Some courts have gone even further, finding that the comparison to physical stores holds for browsing and even mouse hovering, which are similar to physical browsing activities customers routinely do in stores. See, e.g., Id. (“[The plaintiff's] physical movements in the store are like her mouse movements, her pauses to look at inventory are like her mouse pointer hovering over products, and her picking up [products] off the shelf are like placing those same [items] in her virtual cart.”)
But here Plaintiff alleges that Defendant used software to sidestep seclusion that exists in a traditional store. Stores do not read and keep information from, say, credit cards that customers may have in their possession but do not ultimately choose to use as payment. Plaintiff points out that this reveals inherent vulnerabilities in the use of Session Replay Code, noting that credit card details and other sensitive information not intentionally disclosed, or even actively withheld after typing errors, are recorded and stored for Defendant to access. ECF No. 23 ¶ 39. This would likely be seen as an intrusion in the brick-and-mortar setting. As the Court sees it, generally, online activity is not secluded, but the Court is obliged to recognize limits to that rule.
Finally, we turn to the question of whether the nature of this intrusion would be “highly offensive to a reasonable person.” Nickelodeon, 827 F.3d at 293. For an intrusion to be highly offensive, a plaintiff must “establish that the information disclosed would have caused mental suffering, shame or humiliation to a person of ordinary sensibilities.” Google Inc., 362 Fed.Appx. at 279 (quoting Pro Golf Mfg., Inc., 570 Pa. at 247 (2002)) (internal quotation marks omitted). Several courts in this District have found that recording keystrokes and mouse movements alone are simply not enough to reasonably induce mental suffering, shame, and humiliation in ordinary people. See, e.g., Oliver, 2023 WL 8600576, at *10 (“While having one's keystrokes and mouse movements recorded may be an invasion of a website user's privacy, it is simply not the type of highly offensive act to which liability can attach.” (internal quotation marks omitted)); Popa v. Harriet Carter Gifts, Inc., 426 F.Supp.3d 108, 122 (W.D. Pa. 2019) (“The act of collecting [the plaintiff's] keystrokes, mouse clicks, and PII is simply not the type of highly offensive act to which liability can attach.”); Cook, 2023 WL 5529772, at *10 (“[T]he collection . . . of a website visitor's activity does not constitute the highly objectionable conduct needed to state a claim.... Nor has [the plaintiff] alleged how [the defendant's] use of Session Replay Code caused her mental suffering, shame, or humiliation.” (internal quotation marks omitted)). If your mouse movement and keystroke data is stored somewhere on JetBlue's servers, “does it make a sound?” OwnerOperator Indep. Drivers Ass'n, Inc. v. United States Dep't of Transp., 879 F.3d 339, 345 (D.C. Cir. 2018).
The Court is not ruling that information gathered through the Session Replay Code cannot lead to harm. But, to date, Plaintiff provides no specific keystrokes or mouse movements (or any other digital input) the collection of which was harmful. Plaintiff's allegation that Defendant's practices are “highly objectionable to a reasonable person and constitutes an egregious breach of the social norms underlying the right to privacy [that led to] mental anguish and suffering arising from their loss of privacy and confidentiality” reads more like a “formulaic recitation” deemed inadequate under Twombly to satisfy the pleading requirement of substantive factual allegations. ECF No. 23 ¶¶ 111-12. Because a consensus has emerged within this District that the collection of this keystroke and mouse movement data alone is not sufficient harm to establish Intrusion Upon Seclusion, without some additional specific allegations of harm, the Court will not make a finding that the generic allegation of the mere collection of this sort of data constitutes highly offensive harm. Because the third element of Intrusion Upon Seclusion is not met, the Court finds that the Complaint does not state a facially plausible claim for relief.
Accordingly, as to the claim of Intrusion Upon Seclusion, the Court grants Defendant's motion to dismiss.
D. Preemption Under the Airline Deregulation Act
Defendant argues that even if this Court has jurisdiction and the Complaint properly states a claim, this matter should still be dismissed as preempted by the Airline Deregulation Act (the “ADA”). 49 U.S.C. § 41713(b). Defendant posits that because its website is related to various services provided by the airline, this action should be barred as preempted.
In 1978, the United States Congress passed the ADA to reduce airline regulations and allow market forces to further efficiency, innovation, price, variety, and quality of air transportation services. Morales v. Trans World Airlines, Inc., 504 U.S. 374, 378 (1992). The law includes a preemption provision, designed to make sure states do not simply “re-regulate” how airlines operate within the state, contrary to Congress's intent. Taj Mahal Travel, Inc. v. Delta Airlines, Inc., 164 F.3d 186, 191 (3d Cir. 1998). The ADA reads, “a State . . . may not enact or enforce a law, regulation, or other provision having the force and effect of law related to a price, route, or service of an air carrier.” 49 U.S.C. § 41713(b)(1).
The precise meaning of “related to a ... service” is not always clear and may require some degree of balancing. In Taj Mahal Travel, the Third Circuit Court advised that “service” means the functions of an airline that operate as public utilities, such as “‘the frequency and scheduling of transportation,' and ‘the selection of markets' for that activity.” 164 F.3d 193 (quoting Charas v. Trans World Airlines, Inc., 160 F.3d 1259, 1265-66 (9th Cir.1998)). In Smith v. Comair, Inc., for example, the Fourth Circuit Court found that an airline's boarding practices could not be preempted by state law. 134 F.3d 254 (4th Cir.1998). “Transportation itself” can also not be regulated by states. Hodges v. Delta Airlines, Inc., 44 F.3d 334, 336 (5th Cir.1995).
But the ADA does not allow airlines to simply conduct business however they see fit without being subjected to state laws. As the United States Supreme Court put it, states may oversee an airline's ability to provide regulated services, such as gambling or sex work. Morales, 504 U.S. at 390. As a more general guideline, the ADA does not bar state laws that are connected to airlines in “too tenuous, remote, or peripheral a manner to have preemptive effect.” Id. For example, states may enforce against an airline “run-of-the-mill personal injury claims,” Charas, 160 F.3d 1261, routine breach-of-contract claims, Am. Airlines, Inc. v. Wolens, 513 U.S. 219, 220 (1995), and defamation claims. Taj Mahal Travel, 164 F.3d at 193 (finding that enforcing a defamation claim did “not frustrate Congressional intent, nor [did] it impose a state utility-like regulation on the airlines”). In fact, as the Third Circuit Court put it, preemption is generally inappropriate in the tort field. Id. at 194.
Here, Plaintiff brings tort actions against an airline, and, if successful, the Court is not convinced that such action would limit the airline's public utility function or act as a “re- regulation” of the industry in opposition to the legislative intent of the ADA. It seems that even if the result of this action would be that Defendant is prevented from engaging in the allegedly harmfill behavior going forward, all the central functions of the airline would still survive. Further, it is not as if the state statute is an idiosyncratic law that could frustrate airlines broadly if combined with unique or highly particularized wiretap statutes in other states. See, e.g., People ex rel. Harris v. Delta Air Lines, Inc., 247 Cal.App.4th 884 (2016). The PWA sets out roughly the same standard as federal wiretap statutes. For the reasons discussed, the Court finds that Plaintiff s claims are not preempted by the ADA.
IV. Conclusion
For the reasons discussed above, the Court giants in part and denies in part Defendant's Motion to Dismiss. Plaintiff s Intrusion Upon Seclusion claim is dismissed without prejudice, and the Court giants Plaintiff leave to amend the Complaint within 21 days of the date of this memorandum order.