Privacy claims keep heating up folks.

In this case, an individual named Tomi Hartley sued Urban Outfitters, Inc. for violations of the Arizona Telephone, Utility Communication Service Records Act.

A bit of background first.

The Complaint alleges that Urban uses Inbox Monster and Salesforce, two email tracking systems. These systems utilize trackers that Plaintiff calls “spy pixels,” images typically one pixel high by one pixel long which are embedded into emails and activated when an email is opened. Sneaky. Plaintiff alleges “[t]hese spy pixels allow Defendant to collect an assortment of information about those who open its promotional emails, including whether, when, where, and for how long an email was opened, as well as the recipient’s associated email addresses, email path data, email viewing platform, and operating system.” And does so without the individual’s consent.

Plaintiff alleges she received promotional emails from Urban and Urban collected data regarding Plaintiff every time she opened the emails without her consent.

The defendant moved to dismiss under FRCP 12(b)(1) arguing that Plaintiff does not have standing and she fails to allege she suffered a concrete injury.

In order for a plaintiff to sue in federal court, he or she must have standing. That is, a plaintiff must establish he or she suffered: a (1) concrete injury, (2) traceable to the defendant’s conduct, and (3) is redressable.

The Court focused its analysis on the specific data collected.

Here, the Court stated the information Urban allegedly collected through spy pixels does not give rise to a concrete injury because Plaintiff voluntarily disclosed it, including her name and email address. Other data collected, the Court stated, are not of the kind in which a party has a reasonable expectation of privacy. More specifically, the Court stated:

As a matter of law, the Court concludes that digital records reflecting merely the dates and times at which Plaintiff opened promotional emails she signed up to receive, and the length of time she spent reading them, are not sufficiently personal to support a concrete injury. Like a users’ keystrokes and mouse clicks upon voluntarily visiting a retailers’ website, these details are entitled to less privacy protection by virtue of Plaintiff’s decision to opt into receiving and reading the emails.

As such, the Court held Plaintiff failed to allege facts supporting an injury in fact sufficient to confer standing under Article III and dismissed the case for lack of jurisdiction.

Hartley, v. Urban Outfitters, Inc., No. CV 23-4891, 2024 WL 3445004, at *1 (E.D. Pa. July 17, 2024).