Background

In 2018, an individual used her iPhone to visit Harriet Carter Gift’s (HCG) website (“HCG Website”) with the goal of purchasing a product. Upon visiting the HCG Website, a pop-up window asked the individual for her email address, which she provided.  Next, she searched for her desired product and added it to her cart, but never completed the checkout process. As she clicked links, used the search function, and tabbed through form fields on the HCG Website, her browser simultaneously communicated with two entities: (1) HCG, and (2) a third-party marketing service, NaviStone (“Marketing Service”), which HCG was using to identify which of its customers may be receptive to promotional mailings in the future. 

The individual knew she communicated with HCG through the HCG Website, but did not know she communicated with the Marketing Service. She communicated with the HCG Website through software which told it what to display on her screen and what to place in her cart. The individual communicated with the Marketing Service through certain software that alerted the Marketing Service how she was interacting with the HCG Website (which pages she visited, when she filled in an email address, when she added an item to her cart, and so on). 

The individual (“Plaintiff”) sued HCG and the Marketing Service (collectively, “Defendants”) in Pennsylvania state court, alleging that the Defendants’ use of software which communicated information from the HCG Website to the Marketing Service without her consent violated the Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA). 

The WESCA allows “[a]ny person whose wire, electronic or oral communication [that] is intercepted, disclosed or used in violation of [the statute]” to bring suit against “any person who intercepts, discloses or uses or procures any other person to intercept, disclose or use, such communication.” 

The Plaintiff argued that the Marketing Service violated the WESCA by intercepting her communications with the HCG Website, and that HCG violated the WESCA by procuring the Marketing Service to intercept her communications.

The Defendants removed the case to federal district court and moved for summary judgment. In that motion, the Defendants argued (i) that the Marketing Service, as a direct party to the relevant communications, could not have “intercepted” them, (ii) that, even if an “interception” occurred, it occurred outside of Pennsylvania and thus could not give rise to WESCA liability, and (iii) that the Plaintiff consented to the interceptions. The Third Circuit—agreeing with the Defendants’ direct party exception and extraterritoriality arguments and declining to weigh in on their consent argument­­—granted the motion for summary judgment. The Plaintiff appealed that decision to the Third Circuit.

The Third Circuit’s decision

The Third Circuit reversed and remanded the case back to the district court. First, it rejected the Defendants’ argument (which the district court had previously adopted) that no interception occurs under the WESCA when a direct recipient is one of the parties acquiring the communications. The Defendants argued that, without a direct party exception, website operators and third-party marketing companies would be subjected to expansive litigation, but the Third Circuit disagreed, stressing that the WESCA contains “many exceptions from liability,” including “the all-party consent exception.” It accordingly held that the WESCA requires all parties to consent to an interception (except in certain law enforcement related situations), and that HCG and the Marketing Service could be liable for violation of the WESCA if they did not obtain consent from the Plaintiff before allowing the Marketing Service to collect her electronic data. 

Turning to the Defendants’ extraterritoriality argument, the Third Circuit disagreed with the district court there too, and held that there remained a genuine issue of material fact as to whether the relevant interceptions occurred within Pennsylvania.

Finally, the Third Circuit addressed the Defendants’ contention that the Plaintiff consented to the communications because the HCG Website’s privacy policy informed her that her data would be disclosed to third parties. The Plaintiff argued that she did not read the privacy policy, that she did not agree to the privacy policy, and that there was no evidence that the privacy policy existed at the time she visited the HCG Website. The Third Circuit explained that, under the WESCA, consent to an interception can be implied when one party should have known that the communication would be intercepted. It determined that the district court, on remand, should determine if consent existed through the HCG Website’s privacy policy. 

Key takeaways

• The Third Circuit determined that companies using third-party entities to collect website visitors’ information without the visitors’ consent violates the Pennsylvania wiretapping statute, which requires the consent of all parties to such interceptions. It will be interesting to see if other courts adopt this same reasoning.
• Eleven states’ anti-wiretapping laws require all parties to consent to the interception of communications. Currently, nine of those states — California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Nevada, Pennsylvania, and Washington — allow for a private cause of action for a violation of the respective anti-wiretapping laws. In many of these states, class action wiretapping litigation based on website tracking is on the rise.
• A central issue in a significant number of recent anti-wiretapping cases has been whether the plaintiff consented to the interception of their communications. Courts have reached differing conclusions on what constitutes consent in this context.
• Entities operating websites that are utilizing third-party entities to collect website visitors’ information should consider whether the website visitors have consented to any sharing of their data with the third-party services. Third-party entities performing such services should also ensure that the client’s website visitors have consented to any collection of their information, in order to avoid anti-wiretapping violations.

* * * * *

Contributors: Michael McCutcheon, Nancy Sims, Michael Boardman, Michelle Chung, Paul Chander, Shane Kelly, Jeff Butler, and Crofton Kelly