Opinion
2:22-cv-1578-MJH 2:23-cv-00784-MJH 2:23- cv-00895-MJH
04-05-2024
MALINDA A. SMIDGA, FRANCES CURD, and KAYLA MANDENG, individually and on behalf of all others similarly situated, Plaintiffs, v. SPIRIT AIRLINES, INC., Defendant.
OPINION AND ORDER
MARILYN J. HORAN, UNITED STATES DISTRICT JUDGE
Plaintiffs, Malinda S. Smidga, Frances Curd, and Kayla Mandeng, individually and on behalf of all others similarly situated, bring this consolidated matter against Defendant, Spirit Airlines, Inc., for allegedly wiretapping electronic communications of visitors to its website. (ECF No. 45).
For said conduct, Ms. Smidga alleges violations of Pennsylvania Wiretap Act (18 Pa.C.S. § 5701, et seq.) (Count I) and Invasion of Privacy-Pennsylvania Intrusion Upon Seclusion (Count II); Ms. Curd alleges violations of Maryland Wiretap Act (Md. Code Ann., Cts. & Jud. Proc. § 10-401, et seq.) (Count III) and Invasion of Privacy-Maryland Intrusion Upon Seclusion (Count IV); and Ms. Mandeng alleges violations of California Invasion of Privacy Act (Cal. Penal Code § 630, et seq.) (Count V), Statutory Larceny (Cal. Pen. Code §§ 484 and 496) (Count VI), violation of California Unfair Competition Law (Cal. Bus. & Prof. Code §§ 17200, et seq.). All Plaintiffs aver Trespass to Chattels (Count VIII) and Conversion to Chattels (Count IX).
Spirit has moved for dismissal pursuant to Fed.R.Civ.P. 12(b)(1) and 12(b)(6). (ECF No. 57). Spirit's Motions are now ripe for disposition.
Upon consideration of Plaintiffs' First Consolidated Complaint (ECF No. 53), Spirit's Motion to Dismiss (ECF No. 57), Request for Judicial Notice (ECF No. 59), the respective responses, notices of supplemental authority, and briefs (ECF Nos. 58, 62, 64, 65, 70, 75, 76, and 79), and for the following reasons, Spirit's Motion to Dismiss pursuant to Fed.R.Civ.P. 12(b)(1) will be granted. Because this Court finds the Plaintiffs lack standing, thus depriving this Court of jurisdiction, Spirit's Motion to Dismiss pursuant to Fed.R.Civ.P. 12(b)(6) will be denied as moot.
Following review of Spirit's Request for Judicial Notice, the same has no bearing on the standing issue. Therefore, the Court need not make a determination on Spirit's Request.
I. Background
Plaintiffs allege that Spirit procures third-party vendors, such as FullStory, to embed snippets of JavaScript computer code (“Session Replay Code”) on Spirit's website. (ECF No. 53 at ¶ 1). Plaintiffs aver that the Session Replay Code deploys on each website visitor's internet browser for the purpose of intercepting and recording the website visitor's electronic communications with Spirit's website, including their mouse movements, clicks, keystrokes (such as text being entered into an information field or text box), URLs of web pages visited, and/or other electronic communications in real-time (“Website Communications”). Id. The Session Replay Code procured by Spirit allegedly intercepted, stored, and recorded everything Plaintiffs and the Class Members did on Spirit's website, e.g., what they searched for, what they looked at, the information they input, and what they clicked on for the entire duration of their visit. Id.
Plaintiffs aver Spirit's conduct violates the California Penal Code § 631, Statutory Larceny, Cal. Pen. Code §§ 484, 496, Unfair Competition Law, Cal. Bus. & Prof. Code §§ 17200, et seq., Maryland Wiretapping and Electronic Surveillance Act, Md. Code. Ann (“MWESA”)., Cts. & Jud. Proc. § 10-401, Pennsylvania Wiretapping and Electronic Surveillance Control Act (“WESCA”), 18 Pa. C.S.A. § 5701, et. seq., and constitutes an invasion of the privacy rights of website visitors. Id. at ¶ 8.
Spirit has moved for dismissal under Fed.R.Civ.P. 12(b)(1) for lack of jurisdictional standing and under Fed.R.Civ.P. 12(b)(6) for failure to state a claim.
II. Discussion
A. Rule 12(b)(1) Motion
1. Rule 12(b)(1) Standard for Standing
A motion to dismiss predicated on a lack of standing presents a jurisdictional matter; and thus, is “properly brought pursuant to Rule 12(b)(1).” Ballentine v. United States, 486 F.3d 806, 810 (3d Cir. 2007). Two types of challenges to the court's subject matter jurisdiction can be asserted under Rule 12(b)(1)-facial or factual. In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 632 (3d Cir. 2017) (citing Davis v. Wells Fargo, 824 F.3d 333, 346 (3d Cir. 2016)). “[A] facial attack ‘contests the sufficiency of the pleadings, ... whereas a factual attack concerns the actual failure of a [plaintiff's] claims to comport [factually] with the jurisdictional prerequisites.'” The Constitution Party of Pa. v. Aichele, 757 F.3d 347, 358 (3d Cir. 2014) (internal citations omitted).
“In reviewing a facial attack, ‘the court must only consider the allegations of the complaint and documents referenced therein and attached thereto, in the light most favorable to the plaintiff.'” Id. (quoting In re Schering Plough Corp. Intron/Temodar Consumer Class Action, 678 F.3d 235, 243 (3d Cir. 2012)) (other citation omitted). Thus, a facial challenge requires the court to apply the same legal standard it would apply in ruling on a motion to dismiss under Rule 12(b)(6). Id. (citing In re Schering Plough Corp., supra). As such, “‘[t]o survive a motion to dismiss [for lack of standing], a complaint must contain sufficient factual matter' that would establish standing if accepted as true.” In re Horizon Healthcare Servs., 846 F.3d at 633 (quoting Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009), citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007)). At the pleading stage, the plaintiff bears the burden of establishing that she has standing to sue. Reilly v. Ceridian Corp., 664 F.3d 38, 41 (3d Cir. 2011) (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 561, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992); Storino v. Borough of Point Pleasant Beach, 322 F.3d 293, 296 (3d Cir. 2003)). See also Spokeo, Inc. v. Robins, 578 U.S. 330, 338, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016) (The burden of establishing federal subject matter jurisdiction rests with the party asserting its existence).
“By contrast, on a factual attack to federal subject matter jurisdiction, courts may consider evidence outside the pleadings.” Descalzi v. U.S. Post Off., No. 19-12832, 2020 WL 907773, at *1 (D.N.J. Feb. 25, 2020) (citing Petruska v. Gannon Univ., 462 F.3d 294, 302 n.3 (3d Cir. 2006)). Moreover, “‘no presumptive truthfulness attaches to plaintiff's allegations, and the existence of disputed material facts will not preclude the trial court from evaluating for itself the merits of jurisdictional claims.” Petruska, 462 F.3d at 302 n.3 (citation omitted).
2. Standing Analysis
Spirit contends that Plaintiffs have not alleged a basis for suing in federal court, because they have not established an injury in fact under their claims, which is a requirement to maintain standing under Article III of the Constitution. Specifically, Spirit maintains that Plaintiffs have alleged no concrete harm from Spirit's use of Session Replay software and/or any harm that bears a close relationship to a substantive statutory or common law right. Spirit also argues that no concrete harm to Plaintiffs occurred, because any information that Spirit collected was anonymized. In a declaration by Spirit's Senior Vice President and Chief Information Officer, Rocky Bruce Wiggins, he attests that the Session Reply software operating on Spirit's website does not collect personal identifying information from website visitors. (ECF No. 58-1). He further attests that the purpose of the software is to ensure Spirit's website functionality during users' interactions and to optimize a consumer's experience and perspective of the website. Id.
Plaintiffs argue that they have sufficiently alleged concrete injuries to their privacy interests, as protected by common law and state wiretapping statutes. As regards Mr. Wiggins declaration, Plaintiffs contend that it attacks the merits of the case rather than the standing element of jurisdiction.
In response, Spirit contends that Plaintiffs concede only procedural violations of privacy statutes, and that such violations are not actionable without allegations of a concrete harm. Spirit also maintains that Plaintiffs, in responding to Spirit's lack of standing argument, have not disputed Spirit's Senior Vice-President and Chief Financial Officer's factual attestations.
In the First Consolidated Complaint, Plaintiffs allege that they suffered a concrete injury through Spirit's collection, aggregation, and use of their personal browsing histories without consent. (ECF No. 53 at ¶¶ 99, 106, 112). Plaintiffs allege that Spirit's Session Replay Code intercepted personal information that they inputted on Spirit's website. Id. at ¶¶ 96, 103, and 109. Ms. Smidga and Ms. Curd also assert that the “disclosure and loss of privacy and confidentiality has caused [them] and the Class to experience mental anguish, emotional distress, worry, fear, and other harms” as well as a lost economic value in their information. Id. at ¶¶ 172-73, 209-10.
To establish “the irreducible constitutional minimum” of standing, plaintiff must have “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 136 S.Ct. 1540, 1547 (2016). “The plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these elements.” Id.
Spirit identifies “injury in fact” as the key missing element from Plaintiffs' claims. “To establish an injury in fact, a plaintiff must show that he or she suffered an invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical.” Id. at 339, 136 S.Ct. 1540. “That a suit may be a class action adds nothing to the question of standing, for even named plaintiffs who represent a class must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong.” Id. at 338, n.6, 136 S.Ct. 1540.
Even if a plaintiff alleges statutory violations, as Plaintiffs allege here, Article III standing still “requires a concrete injury[.]” TransUnion LLC v. Ramirez, __U.S.__, 141 S.Ct. 2190, 2205, 210 L.Ed.2d 568 (2021). As the Supreme Court explained in TransUnion, it is not enough that “a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right” because “an injury in law is not an injury in fact.” Id. Congress “may not simply enact an injury into existence, using its lawmaking power to transform something that is not remotely harmful into something that is.” Id. Rather, “[o]nly those plaintiffs who have been concretely harmed by a defendant's statutory violation may sue that private defendant over that violation in federal court.” Id. (emphasis in original). In other words, “for standing purposes,” an “important difference exists between (i) a plaintiff's statutory cause of action to sue a defendant over the defendant's violation of federal law, and (ii) a plaintiff's suffering concrete harm because of the defendant's violation of federal law.” Id.
There are “certain harms” that “readily qualify as concrete injuries under Article III.” Id. at 2204. For example, “traditional tangible harms, such as physical harms and monetary harms” are “obvious[ly]” concrete. Id. Other, intangible harms are closer calls. These harms can be “concrete” if they bear “a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts.” Id. (citation omitted). “In looking to whether a plaintiff's asserted harm has a close relationship to a harm traditionally recognized as providing a basis for a lawsuit in American courts, we do not require an exact duplicate.” Id. at 2209.
Courts have held that averments of the statutory elements of the PWESCA, MWESA, or CIPA claim and corresponding state common law privacy claims without facts establishing an accompanying harm are insufficient under Article III. Cook v. GameStop, Inc., No. 2:22-CV-1292, 2023 WL 5529772, at *3 (W.D. Pa. Aug. 28, 2023) (dismissing PWESCA claim for lack of standing); Lightoller v. Jetblue Airways Corp., No. 23-361, 2023 WL 3963823, at *3 (S.D. Cal. June 12, 2023) (rejecting contention that “any violation of CIPA necessarily constitutes an injury in fact without the need for an additional showing of harm”); Straubmuller v. Jetblue Airways Corp., No. CV DKC 23-384, 2023 WL 5671615, at *5 (D. Md. Sept. 1, 2023) (“allegations that Defendant has violated MWESA, without additional concrete harm, cannot satisfy Article III standing requirements.”).
Furthermore, courts have held that even the collection of basic contact information by Session Reply software or where the plaintiffs merely visited the website are not a concrete harms. Massie v. Gen. Motors LLC, No. 21-787, 2022 WL 534468, at *3 (D. Del. Feb. 17, 2022) (“Here, Plaintiffs do not allege that any of their information collected by the Session Replay software was personal or private within the common law understanding of a privacy right.”); Mikulsky v. Noom, Inc., No. 3:23-CV-00285-H-MSB, 2023 WL 4567096, at *5 (S.D. Cal. July 17, 2023) (acquisition of “personal information in text fields” including “email address or phone number” is not a concrete harm); Cook, 2023 WL 5529772 at *5 (dismissing claims based on session replay; stating nearly identical information “is no different from what [defendant's] employees would have been able to observe if [plaintiff] had gone into a brick-and-mortar store and began browsing the inventory”); Lightoller, 2023 WL 3963823, at *4 (S.D. Cal. June 12, 2023) (allegations that defendant recorded plaintiff's website interactions to obtain information on “flight pricing” were insufficient to confer standing); I.C. v. Zynga, Inc., 600 F.Supp.3d 1034, 1049- 50 (N.D. Cal. 2022) (“[T]he Court is hard pressed to conclude that basic contact information, including one's email address, phone number, or Facebook or Zynga username, is private information.”); In re BPS Direct, LLC, No. 22-CV-4709, 2023 WL 8458245, at *13 (E.D. Pa. Dec. 5, 2023) (“website visitors do not have standing to sue under the wiretap statutes where they fail to identify the specific personal information captured by session replay code.”) (“This is no different than what Bass and Cabela's employees would have been able to observe if Website Users had gone into a brick-and-mortar store and began browsing the inventory.”); Farst v. AutoZone, Inc., No. 1:22-CV-1435, 2023 WL 7179807, at *6 (M.D. Pa. Nov. 1, 2023) (“Farst's decision to visit AutoZone's publicly accessible website rather than its physical store did not increase his expectation of privacy or expose him to a concrete harm that otherwise did not exist. We decline to endorse his novel theory of injury because it runs counter to well-settled Article III principles.”) (citing Ramirez, 141 S.Ct. at 2205)). District courts nationwide have reached the same conclusion. See Hernandez v. Noom, Inc., No. 1:23-CV-00641-JRR, 2023 WL 8934019, at *6 (D. Md. Dec. 27, 2023) (“Plaintiff does not provide any authority to support the conclusion that establishing a violation of privacy-protective statutes such as MWESA are sufficient to establish a concrete, albeit intangible, injury to privacy sufficient to confer standing under Article III.”); Popa v. PSP Group, LLC, No. C23-0294JLR, 2023 WL 7001456, at *5 (W.D. Wash. Oct. 24, 2023) (“Popa does not allege that she entered any personally identifiable information into PSP's website ....[S]he has not alleged an injury in fact[.]”); Adams v. PSP Grp., LLC, No. 4:22-CV-1210 RLW, 2023 WL 5951784, at *7-8 (E.D. Mo. Sept. 13, 2023) (Plaintiff's harm “not closely related to the harm upon which [ ] intrusion of seclusion is based.”); Straubmuller v. Jetblue Airways Corp., No. CV DKC 23-384, 2023 WL 5671615, at *3 (D. Md. Sept. 1, 2023) (same); Toston v. JetBlue Airways Corp., No. 2:23-cv01156-SVW-E, 2023 U.S. Dist. LEXIS 148675, *6 (Aug. 23, 2023) (no standing where plaintiff alleges that session replay recorded “how he interacted with the website to retrieve flight information and prices”); Mikulsky v. Noom, Inc., No. 3:23-CV-00285-H-MSB, 2023 WL 4567096, at *5 (S.D. Cal. July 17, 2023) (acquisition of “personal information in text fields” like plaintiff's “email address or phone number” did not constitute a concrete harm).
While these courts have rejected standing where plaintiffs have only inputted basic personal information, Cook and others suggest that the input and recording of credit card data may be sufficient to allege a concrete harm. See, e.g., India Price v. Carnival Corp., 23-CV-236-GPC-MSB, 2024 WL 221437, at *3 (S.D. Cal. Jan. 19, 2024).
Here, the Court agrees with the well-worn paths of other courts around that country that have rejected standing in nearly identical claims. Spirit's facial and factual attacks to jurisdiction, that the Plaintiffs have not sufficiently established a concrete injury to establish standing for their statutory and common law privacy claims, are well-taken. Smidga and Curd's individual experiences in the First Consolidated Complaint as alleged each cannot survive a facial attack in establishing a concrete injury. Ms. Smidga and Ms. Curd aver:
The data and information intercepted by the Session Replay Code goes well beyond information about the “when” and “how” of the communications (commonly referred to as “record data”) and includes the “what” of the communications (i.e., the contents of the communication) including, inter alia, Plaintiffs' location, intent to travel, dates of travel, travel locations and destinations, as well as such personal details about Plaintiff such as dates of birth,
home address, phone number, email address, or payment information/credit card information.(ECF No. 53 at ¶¶ 96, 103). However, beyond these boilerplate averments, Ms. Smidga and Ms. Curd have not specifically alleged “what” personal details they inputted, only a disjunctive “or” statement. In contrast, Ms. Mandeng avers she “input[ed] the names, addresses and ages of herself and her four (4) children, the departure and arrival locations for her potential trip, and her credit card and billing information.” Id. at ¶ 109.
Because Ms. Smidga and Ms. Curd did not specifically allege entry of their credit card information, the disjunctive nature of their boilerplate averments, their admissions that neither purchased flights on their website visits (Id. at ¶¶ 94, 101), and Ms. Mandeng' allegation she did input credit card information, the Court may reasonably infer that Ms. Smidga and Ms. Curd did not enter credit card information. Since Plaintiffs specifically allege Ms. Mandeng inputed credit card information, then logically, Plaintiffs could have alleged that Ms. Smidga and Ms. Curd had as well. Therefore, the Court can infer that, taking the Plaintiffs' pleading as true, Ms. Smidga and Ms. Mandeng suffered no concrete injury under their statutory and common claims to support Article III standing.
As regards Ms. Mandeng, she alleges her input of specific information, vis-a-vis credit card, etc. While this may survive a facial attack on jurisdictional standing, the same will otherwise fail under Spirit's factual attack. Spirit has factually challenged, asserting that the Session Reply Software, operating on Spirit's website, does not collect personal identifying information from website visitors. The absence of any collection of this data fails to produce a concrete injury to support Plaintiffs' claim. See Massie 2022 WL 534468, at *5 (D. Del. Feb. 17, 2022) (“Plaintiffs do not have a reasonable expectation of privacy over the anonymized data captured by the Session Replay software.”). Under a factual challenge to jurisdictional standing, Plaintiffs are no longer afforded the assumptions of their pleadings, and Plaintiffs hold the burden to sustain jurisdiction. Plaintiffs have offered nothing in response to Spirit's sworn assertions that no personalized data was recorded. This leaves Plaintiffs, and Ms. Mandeng in particular, without a concrete injury to support Article III standing.
Accordingly, Spirit's Motion to Dismiss, pursuant to Fed.R.Civ.P. 12(b)(1), will be granted.
B. Fed. R. Civ. P. 12(b)(6) Motion
A motion challenging a federal court's subject matter jurisdiction pursuant to Fed.R.Civ.P. 12(b)(1) differs from a challenge made pursuant to Fed.R.Civ.P. 12(b)(6) (or Fed.R.Civ.P. 56) in that it does not afford a plaintiff the benefit of all of the same procedural safeguards. Robinson v. Dalton, 107 F.3d 1018, 1021 (3d Cir.1997); Cohen v. Kurtzman, 45 F.Supp.2d 423, 428 (D.N.J.1999). Instead, Fed.R.Civ.P. 12(b)(1) attacks the right of a plaintiff to even be heard in federal court. Id. A court cannot dismiss a claim under 12(b)(6) without first assuming subject matter jurisdiction; thus, a claim can be dismissed for lack of subject matter jurisdiction or for failure to state a claim, but not for both. See Kehr Packages, Inc. v. Fidelcor, Inc., 926 F.2d 1406, 1409 (3d Cir.1991) (holding court must assume jurisdiction over a case before deciding legal issues on the merits); see also Spencer v. Casavilla, 903 F.2d 171, 173 (2d Cir.1990) (holding “even if court believes that it would dismiss the complaint in response to a motion under [12(b)(6)], that is not reason to dismiss for lack of jurisdiction”).
Here, because the Court finds no jurisdiction under Fed.R.Civ.P. 12(b)(1), due to an absence of Article III standing, the Court need not examine Spirit's Fed.R.Civ.P. 12(b)(6) motion. Accordingly, said motion is denied as moot.
C. Leave to Amend
The Court notes that, in their response to Spirit's Motions, Plaintiffs neither seek leave to amend nor do they request any jurisdictional discovery to counter Spirit's assertions. Nevertheless, the Court recognizes that Plaintiffs' arguments rested on a presumption that they bore no burden in Spirit's jurisdictional challenge. Now that the Court has determined that Plaintiffs have lost both their facial and factual jurisdictional arguments, the Court finds it equitable to permit Plaintiffs an opportunity to amend. This opportunity though will be limited to the bounds of this Court's ruling, namely to the extent that Ms. Smidga or Ms. Curd actually entered credit card information and/or to the extent that Ms. Smidga, Ms. Curd, and Ms. Mandeng can, in good faith and without speculation, dispute Spirit's sworn assertions that its Session Replay software recorded no identifiable information from its website users. Therefore, Plaintiffs will be permitted leave to amend to cure these deficiencies, if they can do so in good faith.
Based upon the foregoing, the Court enters the following order
III. Conclusion and Order
Accordingly, after consideration of Plaintiffs' First Consolidated Complaint (ECF No. 53), Spirit's Motion to Dismiss (ECF No. 57), Request for Judicial Notice (ECF No. 59), the respective responses, notices of supplemental authority, and briefs (ECF Nos. 58, 62, 64, 65, 70, 75, 76, and 79), and for the reasons stated, Spirit's Motion to Dismiss pursuant to Fed.R.Civ.P. 12(b)(1) is granted. Because this Court finds the Plaintiffs lack standing, thus depriving this Court of jurisdiction, Spirit's Motion to Dismiss pursuant to Fed.R.Civ.P. 12(b)(6) is denied as moot.
Plaintiffs shall have leave to amend, it they can do so in good faith. Before any amendment, the parties shall confer on the best and judiciously economical way forward to address this Court's determination on standing. Should the Plaintiffs believe that through amendment or limited discovery that they can overcome this Court's determination relative to standing, they may amend their Complaint on or before April 19, 2024. Should no amendment be filed by that date, the Court shall dismiss this action for lack of subject matter jurisdiction.
If the Plaintiffs find that they cannot allege that Ms. Smidga or Ms. Curd inputted credit card information, should Ms. Mandeng proceed with her claims, the Court would also ask counsel to confer on whether Ms. Mandeng's action should be transferred back to California. Further, the Court reiterates that these matters address the standing issue only; and that, were Plaintiffs able to overcome the standing obstacles, the Court would still need to address defendants 12(b)(6) arguments several of which present significant Fed.R.Civ.P. 12(b)(6) challenges.
SO ORDERED