COOK v. GAMESTOP, INC.

IN THE UNITED STATES DISTRICT COURT

FOR THE WESTERN DISTRICT OF PENNSYLVANIA

AMBER COOK, individually and on )

)

behalf of all others similarly situated,

) 2:22-cv-1292

)

Plaintiff, )

)

v. )

)

)

GAMESTOP, INC.,

)

)

Defendant. )

OPINION

This putative class action is the latest in a series of lawsuits filed across the

country against online retailers over the alleged use of Session Replay Code. Session

Replay Code allows website operators to record, save, and replay website visitors’

interactions with a website, including “all mouse movements, clicks, scrolls, zooms,

window resizes, keystrokes, text entry, and numerous other forms of a user’s

navigation and interaction through a website.” ECF 22, ¶ 25.

Plaintiff Amber Cook brings this latest installment on behalf of herself and

those similarly situated after she allegedly browsed for products on Defendant

GameStop, Inc.’s public website. She claims that GameStop used Session Replay

Code to record her “mouse movements, clicks, keystrokes (such as text being entered

into an information field or text box), URLs of web pages visited, and/or other

electronic communications in real-time[.]” Id. ¶ 1. According to her, GameStop’s

conduct violates the Pennsylvania Wiretapping and Electronic Surveillance Control

Act, 18 Pa.C.S. § 5701, et seq., and constitutes the tort of intrusion upon seclusion.

Id. ¶¶ 3, 82-111.

GameStop moves to dismiss Ms. Cook’s amended complaint pursuant to

Federal Rule of Civil Procedure 12(b)(1) for lack of subject matter jurisdiction and

pursuant to Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim. ECF

25.

After careful consideration, the Court joins the increasing number of courts

that have found that the type of conduct pled in Ms. Cook’s amended complaint does

not amount to a sufficiently concrete harm to confer standing and therefore will grant

GameStop’s motion under Rule 12(b)(1). But Ms. Cook’s amended complaint would

have a fundamental flaw even if she did have standing to pursue her claims. That’s

because she has failed to plead the necessary facts to support her claims for violation

of the Wiretap Act or intrusion upon seclusion. That failure provides the Court with

an alternative basis to dismiss the case under Rule 12(b)(6).

BACKGROUND

GameStop is an online and brick-and-mortar retailer for gaming consoles,

games, and accessories. ECF 22, ¶ 42. GameStop operates the website

www.gamestop.com, as well as its subpages. Id. GameStop procures and embeds

various Session Replay Code from Session Replay Providers on its website to track

and analyze website user interactions with www.gamestop.com and its subpages. Id.

¶ 43. One such Session Replay Provider with whom GameStop does business is

Microsoft, which owns and operates a Session Replay Code called Clarity. Id. ¶ 45.

Session Replay Code allows website operators to record, save, and replay

website visitors’ interactions with a given website. Id. ¶ 22. Once the events have

been recorded by a Session Replay Code, a website operator can view a visual

reenactment of the user’s visit through the Session Replay Provider, usually in the

form of a video. Id. ¶ 27.

Ms. Cook visited www.gamestop.com and “browsed for different products for

sale.” Id. ¶ 58. While browsing, she used “her mouse to hover and click on certain

products and typ[ed] search words into the search bar.” Id. She also “selected a

product to add to her shopping cart by clicking ‘add to cart’,” but ultimately did not

purchase anything. Id. She alleges that GameStop’s Session Replay Code

instantaneously captured her website browsing activities. Id. ¶ 59.

After Ms. Cook filed her original complaint, GameStop moved to dismiss her

claims. ECF 11. In response, and with GameStop’s consent, Ms. Cook filed an

amended complaint to purportedly “address issues raised in [GameStop’s First]

Motion to Dismiss[.]” ECF 21. Not satisfied with that amendment, GameStop met

and conferred with Ms. Cook a second time, as required by this Court’s Practices and

Procedures, “to determine whether the identified pleading deficiencies may be cured

by amendment, and determined that they could not.” ECF 26, p. 24. GameStop then

filed the motion that is now before the Court. ECF 25. The Court held an oral

argument on the motion on July 27, 2023. ECF 41.

DISCUSSION & ANALYSIS

I. Ms. Cook lacks standing to bring her claims.

GameStop argues that Ms. Cook lacks Article III standing to bring her claims

in this case because she has not alleged that she suffered an injury in fact. The Court

agrees.1

To establish standing under Article III, a plaintiff must have “(1) suffered an

injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant,

and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v.

Robins, 578 U.S. 330, 338 (2016). “The plaintiff, as the party invoking federal

jurisdiction, bears the burden of establishing these elements.” Id.

1 A district court may treat a party’s motion to dismiss for lack of subject-matter

jurisdiction under Rule 12(b)(1) as either a facial or factual challenge to the court’s

jurisdiction. Gould Elecs. Inc. v. United States, 220 F.3d 169, 176 (3d Cir. 2000)

(citation omitted). GameStop’s Rule 12(b)(1) motion focuses on the allegations in Ms.

Cook’s complaint, and so the Court construes GameStop’s motion as making a facial

attack. “In reviewing a facial attack, the court must only consider the allegations of

the complaint and documents referenced therein and attached thereto, in the light

most favorable to the plaintiff.” Id. (citation omitted).

The “first and foremost” element—an injury in fact—is the one at issue here.

Id. (cleaned up). “To establish an injury in fact, a plaintiff must show that he or she

suffered an invasion of a legally protected interest that is concrete and particularized

and actual or imminent, not conjectural or hypothetical.” Id. at 339 (cleaned up).

“That a suit may be a class action adds nothing to the question of standing, for even

named plaintiffs who represent a class must allege and show that they personally

have been injured, not that injury has been suffered by other, unidentified members

of the class to which they belong.” Id. at 338 n.6 (cleaned up).

Even if a plaintiff alleges a statutory violation, like Ms. Cook does here, Article

III standing still “requires a concrete injury[.]” TransUnion LLC v. Ramirez, 141

S.Ct. 2190, 2205 (2021) (cleaned up). As the Supreme Court explained in

TransUnion, it is not enough that “a statute grants a person a statutory right and

purports to authorize that person to sue to vindicate that right” because “an injury in

law is not an injury in fact.” Id. (cleaned up). Congress “may not simply enact an

injury into existence, using its lawmaking power to transform something that is not

remotely harmful into something that is.” Id. (cleaned up). Rather, “[o]nly those

plaintiffs who have been concretely harmed by a defendant’s statutory violation may

sue that private defendant over that violation in federal court.” Id. (emphasis in

original). In other words, “for standing purposes,” an “important difference exists

between (i) a plaintiff’s statutory cause of action to sue a defendant over the

defendant’s violation of federal law, and (ii) a plaintiff’s suffering concrete harm

because of the defendant’s violation of federal law.” Id.

There are “certain harms” that “readily qualify as concrete injuries under

Article III.” Id. at 2204. For example, “traditional tangible harms, such as physical

harms and monetary harms” are “obvious[ly]” concrete. Id. Other, intangible harms

are closer calls. These harms can be “concrete” if they bear “a close relationship to

harms traditionally recognized as providing a basis for lawsuits in American courts.”

Id. (citation omitted). “In looking to whether a plaintiff’s asserted harm has a close

relationship to a harm traditionally recognized as providing a basis for a lawsuit in

American courts, we do not require an exact duplicate.” Id. at 2209 (cleaned up).

Here, Ms. Cook alleges that she has suffered the intangible harm of an

“invasion of privacy,” and analogizes that harm to “the age-old common law

prohibitions and protections from and against invasion of privacy.” ECF 43, 23:1-4.

According to her, the Court need not analyze “the sensitivity of the information” that

she alleges GameStop intercepted because there has been historical protection

against “the idea of somebody eavesdropping on you, somebody intruding on your

privacy, regardless of what the intrusion yields them.” Id. at 56:20-57:5. Put simply,

the mere fact that GameStop recorded any information about Ms. Cook’s visit to

GameStop’s website is injury enough to give her standing to sue. But that circular

reasoning simply folds back onto a bare statutory violation, which the Supreme Court

has clarified cannot be the basis for standing.

Breaking down Ms. Cook’s argument makes this point clear. Ms. Cook asks

the Court to start its analysis with the violation of the wiretapping statute—that is,

GameStop’s alleged act of recording Ms. Cook’s interactions with its website through

the Session Replay Code. Id. at 25:10-14. After that, according to Ms. Cook, “the

question then becomes do you have Article III harm because of that?” Id. at 25:15-

16. Ms. Cook posits that, yes, you do, because “the act of the wiretap … intrudes upon

your privacy.” Id. at 25:16-22. And that harm is historically protected by wiretapping

statutes, which means, in turn, that it is a traditionally recognized harm. See id. at

25:25-26:21 (analogizing Session Replay Code to wiretapping telephone lines). In

other words, Ms. Cook is saying that the Court should analogize the harm under the

wiretapping statute … to a violation of the wiretapping statute. Or something that

looks like this:

ster withvcation

*spainet wiretapping, "nchoopiy

Ms. Cook gave away the game when she pointedly argued that “the act of the wiretap

... intrudes upon your privacy” and that’s both the “injury under the statute” and the

“analog to the injury under the tort.” Jd. at 25:15-24. Under Ms. Cook’s argument,

then, the Court’s analysis should begin and end with the statutory violation.

Such an argument is no longer viable, however, because it runs directly counter

to the Supreme Court’s clarification that a “legislature’s creation of a statutory

prohibition or obligation and a cause of action does not relieve courts of their

responsibility to independently decide whether a plaintiff has suffered a concrete

harm under Article III.” Lightoller v. Jetblue Airways Corp., No. 23-361, 2023 WL

3963823, at *3 (S.D. Cal. June 12, 2023) (citing TransUnion, 141 S. Ct. at 2205). To

be sure, courts can no longer “treat an injury as concrete for Article III purposes based

only on Congress’s say-so.” TransUnion, 141 S. Ct. at 2205 (cleaned up). To put a

fine point on it: “a bare [statutory] violation by itself is insufficient to demonstrate

Article III injury in fact.” Lightoller, 2023 WL 3963823, at *3; see also Byars v.

Sterling Jewelers, Inc., No. 22-1456, 2023 WL 2996686, at *3 (C.D. Cal. Apr. 5., 2023)

(rejecting the contention that “any violation of CIPA necessarily constitutes an injury

in fact without the need for an additional showing of harm” because it conflicts with

the holding in TransUnion); Massie v. Gen. Motors LLC, No. 21-787, 2022 WL 534468,

-6-

at *2, 5 (D. Del. Feb. 17, 2022) (dismissing statutory claims for lack of standing

because plaintiff failed to allege a concrete injury).

So what does that mean for resolving GameStop’s motion to dismiss? It means

that the Court must examine the nature of the information that GameStop allegedly

intercepted and determine whether the interception of that kind of information

amounts to an invasion of privacy interests that have been historically protected. See

Massie, 2022 WL 534468, at *4 (“Whether there is a concrete harm depends on the

nature of the allegations; to say otherwise would be at odds with the Supreme Court’s

clarification of standing doctrine in TransUnion.”). “[B]oth the common law and the

literal understandings of privacy encompass the individual’s control of information

concerning his or her person.” U.S. Dep’t of Justice v. Reporters Comm. For

Freedom of Press, 489 U.S. 749, 763 (1989) (emphasis added). This point is made

clearer when one examines the two torts that Ms. Cook expressly mentions as being

closely related to the conduct here: disclosure of private information and intrusion

upon seclusion. ECF 31, pp. 5-12.

A claim for public disclosure of private information requires, obviously,

“private facts” or information that the plaintiff does not leave “open to the public eye.”

Restatement (Second) of Torts § 652D cmt. b. A claim for intrusion upon seclusion

requires a plaintiff to show that a defendant intentionally intruded “upon the solitude

or seclusion of another or his private affairs or concerns,” and that “the intrusion

would be highly offensive to a reasonable person.” Popa v. Harriet Carter Gifts, Inc.,

426 F. Supp. 3d 108, 120 (W.D. Pa. 2019) (Stickman, J.) (quoting Restatement

(Second) of Torts § 625B). The requirement of private facts or private affairs in both

torts confirms that the nature of the information is paramount. And “[e]avesdropping

on communications that do not involve personal information, personally identifiable

information, or information over which a party has a reasonable expectation of

privacy does not amount to a concrete injury.” Massie, 2022 WL 534468, at *5; see

also TransUnion, 141 S. Ct. at 2204 (concrete harm exists where alleged injury bears

“a close relationship to harms traditionally recognized as providing a basis for

lawsuits in American courts,” such as “disclosure of private information” and

“intrusion upon seclusion”).

The information that GameStop allegedly intercepted does not clear this

threshold. Ms. Cook alleges that GameStop intercepted data regarding her “mouse

movements, clicks, keystrokes (such as text being entered into an information field

or text box), URLs of web pages visited, and/or other electronic communications in

real-time[.]” ECF 22, ¶ 1; see also id. ¶ 46. More specifically, Ms. Cook claims that

during a visit to GameStop’s website, she “browsed for different products for sale,”

“communicated with GameStop’s website by using her mouse to hover and click on

certain products and typing search words into the search bar[,]” and “selected a

product to add to her shopping cart by clicking ‘add to cart.’” Id. ¶ 58.

Perhaps more notable than what she allegedly did on GameStop’s website is

what she did not do. Ms. Cook did not enter any personally identifying information

at any point during her interaction. Not her name. Not her address. Not her credit

card information. Nothing that could connect her browsing activity to her. She also

doesn’t allege that GameStop did anything to figure out who she was, either. In effect,

everything Ms. Cook did on GameStop’s website was completely anonymous. So, her

allegations do not set forth a concrete harm.2 See, e.g., Lightoller, 2023 WL 3963823,

2 That Ms. Cook’s browsing activity here was anonymous is particularly significant

and dooms any attempt to establish a concrete injury in fact. Massie, 2022 WL

534468, at *5 (“Plaintiffs do not have a reasonable expectation of privacy over the

anonymized data captured by the Session Replay software at issue here.”). That said,

at least one court has found that no concrete injury exists even when a plaintiff

provides very basic identifying information—like a name, address, and phone

number—during the browsing session. See, e.g., I.C. v. Zynga, Inc., 600 F. Supp. 3d

1034, 1049-50 (N.D. Cal. 2022) (finding disclosure of “basic contact information,

including one’s email address, phone number, or … username” inadequate to

establish Article III standing based on the “insufficient fit between the loss of

at *4 (“Although Plaintiff alleges that Defendant monitored and recorded her

communications via software when she visited Defendant’s website, Plaintiff does not

allege that she disclosed any personal information when she visited the website. As

such, no personal information was intercepted and recorded.”); Massie, 2022 WL

534468, at *3 (“Here, Plaintiffs do not allege that any of their information collected

by the Session Replay software was personal or private within the common law

understanding of a privacy right.”).

But even if Ms. Cook’s browsing activity could have somehow been connected

to her, it still wouldn’t be enough. At most, the information that GameStop

intercepted related to her product preferences. Product preference information is not

personal information. This information is no different from what GameStop

employees would have been able to observe if Ms. Cook had gone into a brick-and-

mortar store and began browsing the inventory. Her physical movements in the store

are like her mouse movements, her pauses to look at inventory are like her mouse

pointer hovering over products, and her picking up video games off the shelf are like

placing those same titles in her virtual cart. Ms. Cook certainly doesn’t have a

reasonable expectation of privacy in this kind of public shopping behavior in the

physical world, and she doesn’t have it in the digital world, either.

Ms. Cook’s three main arguments in opposition do not move the needle. First,

she relies on pre-TransUnion Third Circuit decisions in In re Nickelodeon Consumer

Priv. Litig., 827 F.3d 262 (3d Cir. 2016), and In re Google Inc. Cookie Placement Cons.

information alleged here and the common law privacy torts of … disclosure of private

facts and intrusion upon seclusion.”); Brignola v. Home Properties, L.P., No. 10-3884,

2013 WL 1795336, at *12 (E.D. Pa. Apr. 26, 2013) (“The information alleged to be

reported (and included in the exhibits) are Plaintiff’s name, address, phone number,

etc. These are not private facts actionable for an intrusion upon seclusion claim or

publication of private life claim.”). The Court need not address this issue because Ms.

Cook didn’t even provide her basic information when she browsed the GameStop

website.

Priv. Litig., 934 F.3d 316 (3d Cir. 2019). A close look at those decisions reflects that

they might be abrogated by TransUnion.3 But even if they weren’t, they are

distinguishable.

In Nickelodeon, the plaintiffs alleged that Viacom tracked children’s “web

browsing and video-watching habits on Viacom’s websites” and then used that

browsing information, together with user account information including the child’s

username/alias, gender, and birthdate, “to sell targeted advertising based on users’

web browsing.” 827 F.3d at 269. In Google, the plaintiffs similarly claimed that

Google bypassed their cookie blockers and placed tracking cookies on their web

browsers, thereby collecting private data about their personal internet browsing

information. 934 F.3d at 321, 325. In both cases, the plaintiffs’ personal information

was captured—i.e., registered account information in Nickelodeon, and tracking

cookies embedded within the plaintiffs’ personal computers and browsers in Google.

In other words, the “private facts” disclosed included some form of personal

information. As discussed above, Ms. Cook does not allege that GameStop captured

any such personal information.

Second, Ms. Cook argues that the Court should not look to Massie for guidance

because it is “an outlier” and “wrongly decided.” ECF 31, p. 9. According to Ms. Cook,

the court in Massie improperly “required the privacy interests the plaintiffs alleged

be identical to the right to privacy recognized at common law.” Id. at pp. 9-10

3 In Nickelodeon, the Third Circuit reasoned that a concrete injury in fact existed

because “Congress has long provided plaintiffs with the right to seek redress for

unauthorized disclosures of information that, in Congress’s judgment, ought to

remain private.” 827 F.3d at 274. And the Third Circuit in Google simply cited

Nickelodeon. 934 F.3d at 325 (“The Nickelodeon decision … dictates that we recognize

standing here.”). Of course, the Supreme Court in TransUnion, as noted above,

emphasized that courts can no longer “treat an injury as concrete for Article III

purposes based only on Congress’s say-so.” TransUnion, 141 S. Ct. at 2205 (cleaned

up). In Nickelodeon and Google, there is no analysis of any “close historical or

common-law analogue for the[] asserted injury” apart from the statute. Id. at 2204.

(emphasis in original). The court in Massie did no such thing, however. Instead, the

court there compared the conduct alleged to the analogous harms of invasion of

privacy and an encroachment on the plaintiffs’ “interest in controlling their personal

information” and found that there was not a close relationship between the two.

Massie, 2022 WL 534468, at *3-5. That is precisely what the Supreme Court

instructed lower courts to do in TransUnion.

Third, Ms. Cook’s citation to a recent post-TransUnion case as supplemental

authority does not alter the analysis. ECF 44 (citing Brown v. Google LLC, No. 20-

3664, 2023 WL 5029899 (N.D. Cal. Aug. 7, 2023)). In Brown, the court recognized

that “the standing analysis is contextual,” and the context of that case was materially

different. There, the court denied a motion for summary judgment for lack of

standing where plaintiffs had evidence that “Google store[d] users’ regular and

private browsing data in the same logs; it use[d] those mixed logs to send users

personalized ads; and, even if the individual data points gathered are anonymous by

themselves, when aggregated, Google can use them to uniquely identify a user with

a high probability of success.” Id. at *6. The court found that was “enough” to “confer

standing given the sensitivity” of the private browsing activity at issue, which the

court noted could include searching for “health conditions without being stigmatized,”

“ways to exit a relationship without notifying [an] abuser],” and “date same-sex

partners without being outed.” Id. at *6 n.9. There are no similar allegations in this

case.

One final matter on standing. Ms. Cook has not asked for leave to amend

(either in her briefing or at oral argument), she did not submit a proposed second

amended complaint, and she did not try to explain how another pleading might help

her plead standing (indeed, she has taken a position that no amendment is necessary

because the kind of information at issue is irrelevant). Her failure in this regard

weighs against giving her another chance at supplementing her allegations. E.g.,

Davis v. Holder, 994 F. Supp. 2d 719, 727 (W.D. Pa. 2014) (Gibson, J.) (dismissing

with prejudice where “Davis has not filed a proposed amendment with the Court nor

has he explained how he would amend Count Three of the complaint to allege state

action”); Adelman v. Jacobs, No. 18-607, 2019 WL 1651612, at *6 (W.D. Pa. Apr. 17,

2019) (Fischer, J.) (“Plaintiffs already filed an amended pleading in this matter and

have not affirmatively sought leave to file a second amended complaint nor supplied

this Court with a proposed pleading such that leave to amend may be denied on these

grounds as well.” (citations omitted)). The Court therefore finds that amendment

would be inequitable and futile and will grant GameStop’s motion to dismiss with

prejudice. See Lightoller, 2023 WL 3963823, at *5.4

II. Ms. Cook has not stated a claim for a violation of the Wiretap Act.

Even if Ms. Cook had standing, she hasn’t adequately stated a claim under

Pennsylvania’s Wiretap Act.5

The Wiretap Act, which is patterned after its federal counterpart, the

Electronic Communications Privacy Act, 18 U.S.C. § 2510, et seq., prohibits the

interception of an electronic communication without prior consent. 18 Pa.C.S. §

4 Indeed, if Ms. Cook could have amended to plead an injury in fact, she would have.

She already amended once. Then, before GameStop filed its second motion to dismiss,

she had the chance to amend again, as the Court’s procedures require the parties to

meet and confer before a motion to dismiss is filed. JUDGE RANJAN’S PRACTICES &

PROCEDURES, § II(d). After the motion was filed, she could have amended in response

to the motion under Rule 15(a), too. Granting leave to amend at this point would be

inequitable.

5 To survive a motion to dismiss for failure to state a claim, “a complaint must contain

sufficient factual matter, accepted as true, to state a claim to relief that is plausible

on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (cleaned up). “A claim has

facial plausibility when the plaintiff pleads factual content that allows the court to

draw the reasonable inference that the defendant is liable for the misconduct

alleged.” Id. Any reasonable inferences should be considered in the light most

favorable to the plaintiff. See Lula v. Network Appliance, 255 F. App’x 610, 611 (3d

Cir. 2007) (citing Rocks v. City of Phila., 868 F.2d 644, 645 (3d Cir. 1989)).

5725(a).6 The statute defines “intercept” as the “[a]ural or other acquisition of the

contents of any wire, electronic or oral communication through the use of any

electronic, mechanical or other device.” 18 Pa.C.S. § 5702 (emphasis added).

“Contents” is defined as “any information concerning the substance, purport, or

meaning of that communication.” Id. So, “contents,” in this context, “refers to the

intended message conveyed by the communication, and does not include record

information regarding the characteristics of the message that is generated in the

course of the communication.” In re Zynga Priv. Litig., 750 F.3d 1098, 1106 (9th Cir.

2014) (interpreting Federal Wiretap Act). Thus, determining whether a plaintiff has

adequately pled a violation of the statute often comes down to deciding whether the

acquired information can best be characterized as either “record information” or “the

message conveyed by the communication.” See Goldstein v Costco Wholesale Corp.,

559 F. Supp. 3d 1318, 1321 (S.D. Fla. 2021) (“The touchtone in many cases arising

under [Florida’s wiretap statute] and similar statutes is the definition of contents.

Courts interpreting contents under the [federal wiretap statute] distinguish between

a record or other information pertaining to a customer (known as ‘record information’)

and the contents—i.e., ‘substance, purport, or meaning’—of the communication

itself.” (cleaned up)).

Ms. Cook argues that she “sufficiently alleged the interception of the ‘contents’

of her Website Communications with GameStop’s website” by pointing to six

paragraphs in her amended complaint. ECF 31, pp. 15-16 (citing ECF 22, ¶¶ 1, 25,

6 The Supreme Court has recognized that the Wiretap Act is the “Pennsylvania

analog” of the ECPA. Bartnicki v. Vopper, 532 U.S. 514, 526 (2001). Because the

relevant provisions and statutory definitions (e.g., “intercept” and “contents”) from

the Wiretap Act are identical to those in the ECPA, the Court can look to decisions

applying those provisions and definitions for guidance. See Com. v. Proetto, 771 A.2d

823, 829 (Pa. Super. Ct. 2001) aff’d, 837 A.2d 1163 (Pa. 2003); Popa, 426 F. Supp. 3d

at 120-21.

46, 51, 60, 61). Upon close inspection, the Court concludes that there are at least two

serious problems with Ms. Cook’s core allegations (as she has identified) in this case.

First, Ms. Cook’s allegations lack sufficient detail to support a claim.

Paragraph 1 comes the closest to giving the Court a starting point for determining

whether Ms. Cook has pled the elements of her wiretap claim, but even the

allegations in that paragraph come up short. In paragraph 1, Ms. Cook alleges that

the code captured her “mouse movements, clicks, keystrokes (such as text being

entered into an information field or text box), URLs of web pages visited, and/or other

electronic communications in real-time[.]” ECF 22, ¶ 1. This allegation, though, lacks

critical necessary details for the Court’s analysis of the type of information allegedly

captured by GameStop’s Session Replay Code. What mouse movements? What did

she hover over? What did she click? Which keystrokes did she enter? What kind of

webpages did she visit? All this information should be available to Ms. Cook; after

all, she is the one who allegedly browsed GameStop’s website. But it is absent from

the amended complaint.

The allegations in several of the other paragraphs cited by Ms. Cook are

problematic because they aren’t specific to GameStop. For example, the allegations

in paragraph 25 set forth claims about how Session Replay Code works “in general”—

notably absent are any specific allegations about whether GameStop’s code operated

in the manner described. ECF 22, ¶ 25 (conceding that the “types of events captured

by Session Replay Code vary by specific product and configuration, but in general are

wide-ranging and can encompass virtually every user action[.]”). The same is true

for Paragraphs 46 and 51, which merely describe the capabilities of Clarity. Id. ¶¶

46, 51. Missing are allegations about how GameStop implemented Clarity.

It’s not enough for Ms. Cook to allege the potential capabilities of the Session

Replay Code. Rather, she needed to allege that GameStop, in fact, harnessed the

capabilities she describes, and it had the result of capturing the contents of specific

communications. But she did not do that. E.g., id. ¶¶ 25 (“The Types of events

captured by Session Replay Code vary by specific product and configuration”

(emphasis added)), 28 (regarding Session Replay Code, “researchers have found that

a variety of highly sensitive information can be captured in event responses from

website visitors” (emphasis added)), 29 (“Session Replay Code may capture data that

the user did not even intentionally transmit to a website during a visit” (emphasis

added)), 30 (“Session Replay Code does not necessarily anonymize user sessions”

(emphasis added)), 49 (“Clarity offers three standard approaches when it comes

to masking sensitive information collected from a user’s interaction with a website”

(emphasis added)).

The allegations in the remaining paragraphs aren’t connected to Ms. Cook.

Paragraph 61 describes information captured by Clarity from an unidentified visitor

to GameStop’s website, but Ms. Cook does not plead facts that would allow the Court

to conclude that she engaged in similar activity on GameStop’s website. Id. ¶ 61.

The result of these pleading deficiencies is that the Court is forced to speculate

about how GameStop’s Session Replay Code was configured and operated and how

Ms. Cook’s visits to GameStop’s website unfolded, which it cannot do.

Second, even giving the most liberal construction to Ms. Cook’s allegations and

construing all inferences in her favor, the allegations are not enough to state a

wiretap claim. Recall, Ms. Cook claims that she “communicated with GameStop’s

website by using her mouse to hover and click on certain products and typing search

words into the search bar.” Id. ¶ 58. She also allegedly “selected a product to add to

her shopping cart,” but did not complete the purchase. Id. Broken down into three

categories, then, Ms. Cook alleges GameStop “intercepted” her mouse movements and

clicks, keystrokes, and URLs of web pages visited. Id. ¶ 1. None of this information

constitutes the “content” of “communications.”

Mouse movements and clicks. When a website user moves the cursor or

clicks the mouse, it does not plausibly reveal the substance of any communication. It

could be construed, at most, in two ways. First, as the kind of “routing information”

that has historically not been recognized as content. When a user moves his or her

mouse and clicks on a link, that click is a request for the computer to take the user to

a specific location within the webpage’s architecture. Navigating through a website’s

multiple pages is not the substance of a communication; it’s an action taken to go to

a digital location.

Alternatively, these mouse movements and clicks could be considered “the

cyber analog to record information [GameStop] could have obtained through a

security camera at a brick-and-mortar store.” Goldstein, 559 F. Supp. 3d at 1321.

That is, these movements and clicks literally constitute a record of her movements

within a digital space. Any “substance” that can flow from these movements must be

inferred from the observer, and are therefore not communicative.

Consider a customer at one of GameStop’s brick-and-mortar stores. If a

customer walked over to a section of the store devoted to sports video games, that

could mean the customer was interested in sports video games, but it could also mean

any number of other things. The customer could just be wandering around the store.

Or the customer could be admiring the photograph of the cover athlete for the game

because that player plays for the customer’s favorite team, but the customer has no

interest in purchasing or learning more about the game itself. The point is that the

customer isn’t intending to communicate anything to anyone by walking around the

store. He or she is just walking around the store. The observer must guess at what,

if anything, those movements mean. The same thing goes for a website visitor’s

navigation around a website. That’s what differentiates this kind of activity from a

substantive communication like a verbal conversation or text message.7

URLs. Ms. Cook also alleges that GameStop captured a record of the URLs of

web pages she visited while on GameStop’s site. ECF 22, ¶ 1. A URL is a Uniform

Resource Location, “used to identify the physical location of documents on servers

connected to the internet.” In re Nickelodeon Cons. Priv. Litig., No. 12-7829, 2014

WL 3012873, at *15 (D.N.J. July 2, 2014) (cleaned up). Location identifiers, like

URLs, “have classically been associated with non-content means of establishing

communication.” In re Google Inc. Cookie Placement Cons. Priv. Litig., 806 F.3d 125,

136 (3d Cir. 2015) (cleaned up). That’s because they are usually “addressing

information and do not necessarily reveal any more about the underlying contents of

communications than do phone numbers.” In re Zynga, 750 F.3d at 1108 (cleaned

up). But that’s not to say URL information could never be considered the substance

of a communication. “Under some circumstances, a user’s request to a search engine

for specific information could constitute a communication such that divulging … that

search term to a third party could amount to disclosure of the contents of a

communication.” Id. at 1108-09; see also In re Google, 806 F.3d at 139 (“[W]e are

persuaded that—at a minimum—some queried URLs qualify as content.”). So, in the

final calculus, “whether a URL involves ‘contents’” depends “on how much

information would be revealed by disclosure of the URL.” In re Google, 806 F.3d at

138.

The Court simply has no way of knowing that information based on the

amended complaint. Ms. Cook pleads that she typed “search words into the search

7 Ms. Cook argues that these movements and the rest of her interactions are like her

calling the store and asking for information. ECF 43, 24:13-25:14. That analogy falls

flat. A phone call is different in that on a phone call, one side of the conversation

must speak and communicate substance to the other side or else the conversation will

not function.

bar,” but doesn’t say what those searches were, whether she hit “enter” after typing

the searches, and whether that action generated a new URL that could be recorded

by the Session Replay Code.8 At most, then, the Court can only reasonably infer that

the URLs corresponded to different physical locations of pages, documents, and files

on GameStop’s servers, which is the kind of non-content information that is not

covered by the Wiretap Act.

Keystrokes. Ms. Cook generically alleges that her “keystrokes” were

recorded, but the Court has no idea what those keystrokes could be, other than the

search words mentioned above. Because that crucial information is not pled in the

amended complaint, the Court cannot find that these “keystrokes” amounted to the

content of a communication.

Ms. Cook’s rebuttal to the analysis above is to broadly argue “[e]verything

about what happens in your interaction with the website is communicative in

nature.” ECF 43, 59:8-9. In short, it’s Ms. Cook’s position that “[o]nce you’re on the

website, you’ve communicated.” Id. at 59:11-12. But there’s simply no support for

this position in the caselaw,9 and it contradicts the reality of how websites operate.

8 Ms. Cook’s screenshot supposedly showing information that Clarity captured from

an unidentified www.gamestop.com visitor doesn’t change the analysis. ECF 22, ¶

61. That screenshot is not connected to anything that Ms. Cook did on GameStop’s

website and it’s not even clear what that screenshot represents because Ms. Cook

hasn’t provided enough context. Id.

9 Ms. Cook’s citation to Oliver v. Noom, Inc., No. 2:22-cv-1857 (W.D. Pa.) (Stickman,

J.) does not help her cause. ECF 44. The alleged information that was intercepted

in that case was wholly different—there, the plaintiff alleged that the defendant

“collected personal information she input[ted] as part of Noom’s 10-minute online

quiz, including her height, weight, gender, age, reason for wanting to lose weight,

how active she is, how often she eats, and whether she is at risk for specific health

issues.” ECF 44-1, p. 14. Those kinds of affirmative survey responses revealing

highly personal information did communicate substance to the defendant. That kind

of particularized allegation is absent here, though.

And such an expansive interpretation would impermissibly render the distinction

between content and non-content in the statute superfluous. United States v. Cooper,

396 F.3d 308, 312 (3d Cir. 2005) (“It is a well-known canon of statutory construction

that courts should construe statutory language to avoid interpretations that would

render any phrase superfluous.” (cleaned up)). Thus, Ms. Cook has failed to state a

claim under the Wiretap Act.10

III. Ms. Cook has not stated a claim for intrusion upon seclusion.

To state a claim for intrusion upon seclusion under Pennsylvania law, a

plaintiff must show that a defendant “intentionally intrude[d], physically or

otherwise, upon the solitude or seclusion of another or his private affairs or concerns,”

and that “the intrusion would be highly offensive to a reasonable person.” Popa, 426

F. Supp. 3d at 120 (quoting Restatement (Second) of Torts § 625B). For an invasion

to give rise to an actionable claim for intrusion upon seclusion, it must be “of the sort

which would cause mental suffering, shame, or humiliation to a person of ordinary

sensibilities.” Chicarella v. Passant, 494 A.2d 1109, 1114 (Pa. Super. Ct. 1985)

(cleaned up).

Ms. Cook’s claim fails at the outset because, as discussed above, there’s no

allegation that GameStop intruded upon her “private affairs or concerns.” And even

10 The Court is not granting leave to amend because the principal basis for dismissal

is lack of standing, and as noted above, it would be futile and inequitable to allow

amendment on that issue. As to the alternative ground for dismissing the Wiretap

Act claim, the Court is not convinced that Ms. Cook can or even would want to amend

to correct these core deficiencies. In response to GameStop’s first motion to dismiss,

Ms. Cook amended her allegations. ECF 22. That first motion to dismiss raised

identical issues to those addressed by the Court in this Opinion. See ECF 15. It’s no

surprise, then, that the nature of Ms. Cook’s interactions with the website, as pled by

her, would be critical to the Court’s analysis of this motion. Yet she failed to come

back with the kind of detail on specific communications that might state a plausible

claim. That was clearly a tactical decision. Allowing Ms. Cook to alter her tactics by

amending the complaint and forcing GameStop to respond to further amendment

would be inequitable.

if the information could fit into the category of private information, the collection and

disclosure of a website visitor’s activity does not constitute the highly objectionable

conduct needed to state a claim. See, e.g., In re Nickelodeon, 827 F.3d at 294-95 (use

of third-party tracking cookies on a website geared towards children not offensive

enough to withstand a motion to dismiss); In re Google, Inc. Priv. Pol’y Litig., 58 F.

Supp. 3d 968, 988 (N.D. Cal. 2014) (no intrusion upon seclusion claim where Google

collected and disclosed users’ data, including their browsing histories). Nor has Ms.

Cook alleged how GameStop’s use of Session Replay Code caused her “mental

suffering, shame, or humiliation.” The allegations in the amended complaint simply

do not pass muster as to this claim.

CONCLUSION

For these reasons, it is hereby ORDERED that GameStop’s motion to dismiss

(ECF 25) will be GRANTED, and the amended complaint will be dismissed with

prejudice. An appropriate order follows.

Date: August 28, 2023 BY THE COURT:

/s/ J. Nicholas Ranjan

United States District Judge