In a victory for defendants, on August 26, 2025, the Ninth Circuit dismissed a class action lawsuit alleging violation of Pennsylvania’s wiretap statute by using session replay tracking technology on the company’s website.¹The appellate court held that the plaintiff failed to demonstrate she had suffered a concrete injury in fact that would give her standing to sue. The Ninth Circuit’s ruling may have far-reaching implications for similar class actions alleging violations of the California Invasion of Privacy Act (CIPA) and other wiretap laws.

Facts

This case arises out of the common use of so-called “session replay” technology that allows businesses to track and record visitors’ various interactions with a website, capturing user activities such as the date the website was accessed, the device used to access the website, a user’s mouse movements, screen swipes, any text input by the user on the website, and more. In this case, the plaintiff alleged that the defendants tracked her activity while browsing for pet supplies on the defendant’s website.

Wiretap Laws

The plaintiff filed a class action on behalf of all visitors to the website for violations of Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (WESCA) in addition to common law claims for invasion of privacy stemming from intrusion upon seclusion. WESCA prohibits the interception, disclosure, or use of any oral, wire, or electronic communication without the consent of all parties involved. Under WESCA, victims of unlawful recordings can sue for civil damages, which include actual damages, a minimum of liquidated damages ($1,000 or $100/day, whichever is higher), punitive damages, and attorney's fees.

Notably, many states have similar wiretap laws including CIPA, which can result in statutory damages of up to $5,000 per violation. In recent years, an increasing number of class action lawsuits have been filed against companies that use session replay, Meta Pixel, or similar tracking technologies on their websites for violation of state and federal wiretap laws, in anticipation of potentially sizeable awards.

Article III Standing Analysis

A plaintiff must demonstrate that he/she has standing to bring suit. For suits filed in federal courts, the U.S. Supreme Court has established a three-part test for Article III standing: 

• The plaintiff must have suffered an “injury in fact” that is both “concrete and particularized” and “actual or imminent”
• “There must be a causal connection between the injury and the conduct complained of” (often described as whether the injury is “fairly traceable” to the challenged conduct)
• “It must be likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision."²

In this case, the sole issue on appeal to the Ninth Circuit was whether the plaintiff alleged a “concrete” injury in fact sufficient to support Article III standing. In its analysis, the Ninth Circuit relied heavily on the U.S. Supreme Court’s decision in TransUnion, LLC v. Ramirez.³ In TransUnion, the Court distinguished between “(i) a plaintiff’s statutory cause of action to sue a defendant over the defendant’s violation of federal law, and (ii) a plaintiff’s suffering concrete harm because of the defendant’s violation of federal law."⁴ The TransUnion court summarized: “[U]nder Article III, an injury in law is not an injury in fact. Only those plaintiffs who have been concretely harmed by a defendant’s statutory violation may sue that private defendant over that violation in federal court."⁵ In other words, a statutory violation alone is not enough to confer standing.

Relying on TransUnion, the Ninth Circuit concluded that the plaintiff failed to meet her burden of proving that she had standing to sue. Specifically, the Ninth Circuit made the following key findings:

First, it rejected the plaintiff’s attempt to bootstrap her purported injury to common law invasion of privacy claims for intrusion upon seclusion or public disclosure of private facts. The appellate court observed that both such claims require the dissemination of information that would be considered “highly offensive” to a reasonable person. Here, the Ninth Circuit noted that “the monitoring of [plaintiff’s] interactions with [the subject] website seems most similar to a store clerk’s observing shoppers in order to identify aisles that are particularly popular or to spot problems that disrupt potential sales."⁶

Second, the Ninth Circuit rejected the plaintiff’s overbroad interpretation of its (post-TransUnion) decision in Jones v. Ford Motor Co.⁷ In Jones, the Ninth Circuit suggested that “A statute that codifies a common law privacy right ‘gives rise to a concrete injury sufficient to confer standing.⁸ Here, backing off its decision in Jones, the Ninth Circuit expressly declined to establish a “categorical rule” that statutes embodying privacy violations automatically create a concrete injury for purposes of standing.

Third, the Ninth Circuit emphasized the importance of focusing on the specific facts and circumstances giving rise to the lawsuit. In particular, the appellate court noted that the nature, type, and sensitivity of the information exposed was a fundamental factor in its analysis. Here, the Ninth Circuit observed that the plaintiff “identifies no embarrassing, invasive, or otherwise private information collected.”⁹

In short, the Ninth Circuit affirmed the district court’s opinion finding that plaintiff lacked standing to sue and dismissed the class action. 

Conclusion 

While the Ninth Circuit’s ruling involved a Pennsylvania wiretap statute, the appellate court’s analysis and reassessment of its prior rulings on standing involving privacy statutes may have far-reaching application to both CIPA and Video Privacy Protection Act (VPPA) class actions, which have increased dramatically in recent years. Indeed, as the Ninth Circuit observed in closing “in Eichenberger,¹⁰ the plaintiff sued under the Video Privacy Protection Act of 1988. Perhaps we might analyze that statute differently today, especially after the Supreme Court’s decision in TransUnion, but we need not reach that issue to decide whether [plaintiff] has adequately alleged standing in this case.”¹¹

Perhaps the Ninth Circuit has realized that plaintiffs have gone too far in their quest to sue companies for violations of privacy statutes without demonstrating any concrete injury. As the Supreme Court noted in TransUnion, “[i]f the law of Article III did not require plaintiffs to demonstrate a ‘concrete harm,’ Congress could authorize virtually any citizen to bring a statutory damages suit against virtually any defendant who violated virtually any federal law."¹²

Footnotes 

^{1 Ashley Popa v. Microsoft, U.S. Court of Appeals for the Ninth Circuit, Docket No. 24-14 (August 26, 2025), D.C. No. 2-23-cv-00294-JLR.}

^{2 Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992) (internal quotation marks and citations omitted).}

^{3 TransUnion v. Ramirez, 594 U.S. 413 (2021).} 

^{4 Id. at 426–27.}

^{5 Id. at 427.}

^{6 Popa v. Microsoft, Ninth Circuit Opinion issued August 26, 2025, Docket No. 24-14, page 14.}

^{7 Jones v. Ford Motor Corp., 85 F.4th 570 (9th Cir. 2023).}

^{8 Id. at 574 (internal quotations and citations omitted).}

^{9 Popa v. Microsoft, Opinion at p. 14.}

^{10 Eichenberger v. ESPN, Inc., No. 15-35449 (9th Cir. 2017).}

^{11 Popa v. Microsoft, Opinion at p. 21 (internal citations omitted).}

^{12 TransUnion v. Ramirez, 594 U.S.}