There has been a wave of “wiretap” litigation involving session replay software—i.e., a tool that provides companies with anonymous, video-like reconstructions of an individual user's interactions with their websites. Tools like this allow companies to identify bugs and improve users' experiences on their websites. However, in these litigations, plaintiffs assert that this software violates state wiretapping laws that require two-party consent (e.g., California, Pennsylvania, and Maryland).

Last week, in a win for defendants, the Eastern District of Pennsylvania dismissed wiretap claims against Spirit Airlines on standing grounds, because plaintiffs “alleged no concrete harm from Spirit's use of Session Replay software.” See Smidga v. Spirit Airlines, No. 2:22-CV-1578-MJH, 2024 WL 1485853, at *2 (W.D. Pa. Apr. 5, 2024). The court credited the declaration submitted by Spirit Airlines' Chief Information Officer, which stated that all information collected by the Session Replay software was anonymized—and was collected merely to “ensure Spirit's website functionality during users’ interactions and to optimize a consumer's experience and perspective of the website.” The court, however, indicated that the recording of personal credit card information could constitute concrete injury, and provided plaintiffs the opportunity to amend their complaint to allege that they “actually entered credit card information" on the website.  

This case echoes a December ruling by the same court, which similarly dismissed several proposed wiretap class actions against Bass Pro Shops and Cabela's on standing grounds.  See In re BPS Direct, LLC, No. 22-CV-4709, 2023 WL 8458245 (E.D. Pa. Dec. 5, 2023). The court held that plaintiffs could not establish standing because they did not disclose—and the software thus didn't record—“highly sensitive personal information such as medical diagnosis information or financial data from banks or credit cards." Instead, the session replay code merely captured mouse clicks, keystrokes, pages and content viewed. The court reasoned: “This is no different than what Bass and Cabela's employees would have been able to observe if Website Users had gone into a brick-and-mortar store and began browsing the inventory. Website Users do not have a personal privacy interest in their shopping activity.”

These rulings are encouraging for companies seeking to dismiss wiretap claims based on session-replay software, especially where the content tracked does not contain sensitive medical or financial data.