Duane Morris Takeaways: On August 7, 2025, in an opinion authored by Circuit Judge D. Michael Fisher, the United States Court of Appeals for the Third Circuit issued a precedential decision in Cook v. GameStop, Inc., 148 F.4th 153 (3d Cir. 2025), affirming the U.S. District Court for the Western District of Pennsylvania's dismissal for lack of standing of a putative class action asserting privacy causes of action against a website operator monitoring clicks. The Third Circuit found that merely tracking internet users' browsing time and website interactions — without recording or disclosing sensitive or personal information — fails to constitute the type of concrete injury required to confer Article III standing. The decision is instructive for corporate counsel dealing with privacy issues and defense of class action litigation.
Case Background
Plaintiff Amber Cook ("Cook" or "Plaintiff") was an internet user that visited GameStop's website in Pennsylvania. See Cook, 148 F.4th 153, 156. Through third-party vendor Microsoft and its programming script called Clarity, GameStop was tracking internet user's browsing history and interaction with its website. Id. The script Clarity creates is known as a "session replay code" that aggregates data about how long the user browsed the website, mouse movement, links clicked, scrolling, search bar entries, and products added and removed from the "cart." Id. The script creates a unique id and profile for each user and recaptures each user's session through a video which GameStop could review to improve functionality and user experience. Id. The unique ids and profiles do not utilize personally identifying information such as names, addresses, and the like. Id. at 160. GameStop's website has a privacy policy describing the script and information collected but this policy is "buried at the very bottom of the website." Id. at 156.
Cook sued GameStop for its use of the Clarity script, alleging that it violated the Pennsylvania Wiretapping and Electronic Surveillance Control Act ("WESCA") and asserting a common law cause of action for intrusion upon seclusion. Cook alleged that the WESCA and privacy tort for intrusion upon seclusion prohibit the interception of electronic communications without prior consent and she suffered an injury in fact "''when her communications with . . . GameStop's website were intercepted' by the session replay code." GameStop moved to dismiss the First Amended Complaint at the District Court level pursuant to Federal Rule of Civil Procedure 12(b)(6) and 12(b)(1). See Case No. 2:22-CV-01292, ECF No. 25-27. The District Court granted GameStop's motion under Rule 12(b)(1) with prejudice and, in the alternative, held that Cook failed to "plead the necessary facts to support her claims for violation of [WESCA] or intrusion upon seclusion." See Case No. 2:22-CV-01292, ECF No. 45-46. Specifically, the District Court concluded that Cook's harms were not analogous to the traditional intangible harms recognized by privacy torts because none of the data gathered "could connect her browsing activity to her." See Case No. 2:22-cCV01292, ECF No. 46, at 8 (emphasis in the original). Cook appealed the District Court's decision on standing to the Third Circuit.
The Third Circuit's Ruling
Reviewing whether Cook's allegations met the Article III standing threshold de novo, the Third Circuit determined that the appeal concerned only the first element of the analysis, or whether Cook had sufficiently alleged an injury in fact (as opposed to the other requirements of traceability and redressability). The Third Circuit adopted the standard articulated in Barclift and Transunion that — to determine whether a plaintiff has suffered a concrete injury — the framework is whether the harm asserted bears a "close relationship to a harm traditionally recognized as providing a basis for a lawsuit in American courts — such as physical harm, monetary harm, or various intangible harms including . . . reputational harm." Id. at 158 (citing Barclift v. Keystone Credit Servs., LLC, 93 F.4th 136, 141, 145 (3d Cir. 2024); TransUnion LLC v. Ramirez, 594 U.S. 413, 417 (2021)).
The Third Circuit clarified that it would not take as "rigid" of an approach as other federal circuits but that it would consider the privacy torts that Cook identified of disclosure of private information and intrusion upon seclusion to determine if the harm she alleges is "the kind of harm caused by the comparator tort[s]." The Third Circuit found that she failed to identify sufficiently concrete harms under either analogy.
- Tracking Information That Is Not Personal Or Sensitive Nor Disclosed Publicly Not Sufficient To Allege Concrete Injury
With regard to the disclosure of private information analogy, the Third Circuit found that the information captured by the session replay code — recording clicks, mouse hovers, and search bar searches — was neither sensitive or personal. In support of this conclusion, the Third Circuit reasoned that the disclosure of such information cannot plausibly be said to result in embarrassment or humiliation. Cook did not share her name, contact information, address, or billing information while on GameStop's website. Further, though Cook alleged that GameStop obtained information about her device and browser and created a unique ID and profile for her to capture the session replay information, she did not allege that GameStop identified her through this information. Id. at 160. Cook alleged only that if a user "eventually identifies themselves" then GameStop could "back-reference all of that user's other web browsing." Id. The Third Circuit found these allegations were too hypothetical to meet Article III's injury-in-fact requirement.
Going one step further, the Third Circuit found that "even assuming the information was the type that could cause Cook humiliation under 'public scrutiny,'" Cook did not allege that the information was ever publicized or disclosed publicly. Id. Cook alleged only that the information was disclosed to third-party vendor Microsoft, "not the broader public." Id.
As the information collected was not personal or sensitive, the Third Circuit also rejected Cook's intrusion upon seclusion analogy. As an additional basis for rejecting this tort analogy, the Third Circuit acknowledged that "[m]ost of us understand that what we do on the Internet is not completely private." Id. (citation omitted).
2. The WESCA Does Not Provide A Statutory Avenue For Circumventing The Injury-In-Fact Requirement For Standing
The Third Circuit next considered and rejected Cook's argument that the WESCA provides a separate avenue to circumvent Article III's injury-in-fact requirement. In making this argument, Cook relied on language in the TransUnion decision that the legislature can "'elevate harms that exist in the real world' to make them legally actionable" and went on to claim the WESCA did just that in protecting a "wider range of information" from collection during electronic communications. The Third Circuit disagreed with this logic and reading of the TransUnion decision, determining that the theory "contradicts the fundamental holding of TransUnion" which instructs courts to consider the concrete harm actually alleged by the Plaintiff rather than the "harm the statutory cause of action typically protects against." Id.at 161 (emphasis added). The Third Circuit analyzed that a statutory violation of the WESCA for tracking web browsing information does not dispense with the Article III standing inquiry and Cook was still required to articulate a harm existing in the "real world" under TransUnion, as legislatures cannot "transform something that is not remotely harmful into something that is." Id.
3. Precedent In Which Website Operators Affirmatively Represented They Would Not Track Information Are Not Controlling
The Third Circuit further opined that the Nickelodeon and Google II decisions — which Cook cited in favor of her argument that tracking internet browsing history has been found to constitute a concrete harm — were not controlling. The Third Circuit explained that Nickelodean involved claims that a website operator was collecting minors' personal information despite affirmatively representing that it would not do so. Id. at 162 (citing In Re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 269 (3d Cir. 2016)). And, similarly, Google II involved allegations that Google bypassed browser privacy settings through the use of browser cookies to track user information. Id. (citing In Re Google Inc. Cookie Placement Consumer Priv. Litig., 934 F.3d 316, 321 (3d Cir. 2019) (Google II)). The Third Circuit found that both were instances of affirmative "promises not to" collect information that the website operator collected in any event. Id. Here, by contrast, Cook failed to identify an affirmative representation on the part of GameStop to refrain from tracking user browsing and website usage information.
4. Current Status of GameStop Action
A mandate was issued on September 12, 2025 transferring the action back to the jurisdiction of the District Court, where the matter is still pending.
Implications for Website Operators Tracking Browsing History and Use:
The Third Circuit has provided a helpful roadmap for website operators — at least in this jurisdiction — that merely tracking clicks and interaction with a website is insufficient to confer standing in federal court to potential plaintiffs challenging such tracking. It is critical that the tracking at issue in GameStop, however, did not collect personal or sensitive information nor disclose the same. GameStop also did not affirmatively represent that it would not track website use and interaction. Website operators would be well-advised to review any website tracking using this rubric and to seek legal advice in the event of doubt or ambiguity.
Disclaimer: This Alert has been prepared and published for informational purposes only and is not offered, nor should be construed, as legal advice. For more information, please see the firm's full disclaimer.
