A recent ruling in Popa v. Harriet Carter Gifts, Inc. (W.D. Pa. March 24, 2025) has reaffirmed the role of privacy policies in establishing user consent for online tracking. After being remanded by the Third Circuit, the Pennsylvania District Court considered a motion for summary judgement focused solely on the issue of whether the plaintiff consented to alleged interception of her data under Pennsylvania’s Wiretap Act. Applying the reasonable person standard, the Court ruled that Popa had constructive notice of the website’s privacy policy – contained in a browsewrap agreement – and therefore consented to the use of tracking software.

The Allegations

Plaintiff Ashley Popa brought a class action against Harriet Carter Gifts, Inc. and NaviStone, Inc. alleging that they violated the Pennsylvania Wiretapping and Electronic Surveillance Control Act of 1978 (“WESCA”) by unlawfully intercepting her data while she shopped on Harriet Carter’s website (the “Website”).

WESCA prohibits the interception of electronic communications without the prior consent of all parties to the communication.

The Privacy Policy

The Website had a privacy policy hyperlinked in its footer, which both parties and their experts agreed was a common practice for commercial websites. Interestingly, the parties also agreed that in 2018, it would have been a “reasonable conclusion” for a company to believe that it ought to present the privacy policy in this manner.  The hyperlink was labelled “Privacy Statement” and was in white font against a blue background.

Harriet Carter’s privacy policy broadly addressed its data collection and use practices: it stated that Harriet Carter collected customer information (without addressing what information) and explained that cookies were used to keep track of shopping carts and deliver targeted content.

In a separate section titled “Who Else Has Access to the Information I provide to Harriet Carter.com?” the policy also addressed third party access to customer information through use of a cookie or pixel tag – which Harriet Carter deemed “industry standard technology”. The policy noted that no personally identifiable information would be collected through this process, but third parties may pool the information from Harriet Carter’s website with other sources of information that could include the customer’s name and mailing address.

Popa testified that she had never reviewed Harriet Carter’s privacy policy.

The Motions

In 2020, the Defendants filed a motion for summary judgement which was granted by the District Court. The Court held that there was no interception under WESCA because NaviStone, which operated the program that caused the alleged interception, was a direct party to the communications and because the alleged interception occurred outside Pennsylvania and was therefore outside the scope of WESCA. Following an appeal by Popa, the Third Circuit Court of Appeals reversed, holding that there is no sweeping direct-party exception under WESCA and that there was a genuine issue of material fact as to where the interception occurred. 

The Third Circuit also noted that the issue of whether Harriet Carter posted a privacy policy and the sufficiency of the privacy policy was not addressed by the District Court and remanded this issue to the Court.

On remand, Defendants filed a second motion for summary judgement, focusing solely on the issue of consent and contending that Popa was on constructive notice of Harriet Carter’s privacy policy and therefore consented to the communications being recorded as described therein.

The Court’s Analysis

In its analysis, the Court noted the objective standard to interpret the consent provisions of WESCA – whether a reasonably prudent person can be deemed to have consented under the circumstances. The Court looked to the decision in Commonwealth v. Byrd, where the Pennsylvania Supreme Court held that actual knowledge that communications may be recorded is not required to satisfy the consent requirement under WESCA.

Notably, the Court took into consideration the ubiquitous use of tracking technologies on the internet and stated that, “when determining whether a reasonable person can be deemed to consent to an interception under WESCA, it must be mindful of the reality of internet communication.” Therefore, it held that while the nature of the internet does not confer blanket implied consent to interception under WESCA, “a reasonably prudent person has a lower expectation of privacy on the internet” than on other technologies (like telephones) which do not use cookies, algorithms, and trackers.

“[A] reasonably prudent person has a lower expectation of privacy on the internet“

Next, the Court considered the scope of Harriet Carter’s privacy policy, looking specifically at whether a reasonable person could have been alerted that third parties, like NaviStone, may access information about consumers’ activities on the Website. The Court answered affirmatively – the privacy policy made clear that the Website used tracking cookies, and that Harriet Carter may share information about users’ activities with third parties. The Court also rejected Popa’s argument that privacy policy was insufficient because it did not contain details about the identity of the third parties or the specific type of cookies used, holding that such “granular details” were immaterial because WESCA focuses on the event of interception rather than the specific means of thereof.

Lastly, the Court considered whether Popa consented to NaviStone’s tracking on the Website. The central question here was not whether Popa had actual knowledge of the alleged interceptions (the record established that Popa never reviewed the privacy policy), but rather, whether a reasonable person in her position could have known of the disclosures in the privacy policy. The Court acknowledged that privacy policy on the Website was in the form of a “browsewrap agreement”, which does not require a user to click or take any affirmative action to consent to its terms. While such agreements are routinely enforced when a user has actual notice, in the absence of actual knowledge the court must look to the visibility and accessibility of the browsewrap agreement to determine whether it placed a user on inquiry notice of its terms.

The Court held that the privacy policy on Harriet Carter’s website was reasonably conspicuous based on the appearance and layout of the Website: it was labelled “Privacy Statement”, located at the center and bottom of each page, the hyperlink was in white font contrasting against a blue background, and a link to the policy could also be found in a drop-down menu on the left side of the website. These factors led the Court to find that a reasonable person in Popa’s position had constructive notice of the terms in the privacy policy, and that Popa constructively consented to the interception described in the policy. Therefore, there was no violation of WESCA.

Popa’ s contention that the presence of NaviStone’s program meant that merely visiting Harriet Carter’s website would give rise to an interception before a reasonable user had a chance to view the privacy policy was rejected. The Court analogized to someone hanging up a phone call after hearing a disclosure that the call was being recorded – there would be no interception under WESCA because WESCA only applies to “contents” of communications. Similarly, to the extent that Popa was concerned about privacy, she could have immediately reviewed the privacy policy and, if concerned, left the page, and this would not lead to the interception of “content” under WESCA.

Takeaways

Though based on a state statute, this ruling signifies a shift in the hotly litigated arena of website tracking software.

For businesses, Popa may offer some respite – while explicit clickwrap agreements remain the gold standard, this case suggests that browsewrap agreements may still hold up in court if they are reasonably conspicuous and sufficiently disclose the use of third party tracking software. As digital privacy law continues to evolve, courts are likely to place greater emphasis on reasonable user expectations, meaning online users may need to be more proactive in understanding how their data is being collected.

Perhaps most interestingly, the Pennsylvania District Court’s willingness to acknowledge the widespread (maybe even indispensable) use of cookies and trackers demonstrates a growing understanding of the “reality of internet communication”. It will be interesting to see whether a similar approach is adopted by courts states such as California, with its particularly stringent privacy laws.