On October 18, 2022, in Popa v. Harriet Carter Gifts Inc. et al., Case Number 21-2203, the Third Circuit denied rehearing on its ruling that allows a class action alleging wiretapping claims based on the use of session replay software to proceed. The Third Circuit’s ruling and subsequent denial of a request for rehearing is a reminder that session replay litigation is not dead but very much alive. Companies should remain informed of these developments.
By way of background, the plaintiff filed a class action lawsuit against Harriet Carter Gifts, Inc. and NaviStone, Inc. in the U.S. District Court for the Western District of Pennsylvania, alleging that defendants illegally intercepted online shoppers’ communications with Harriet Carter’s website through the use of session replay software. Plaintiff alleged that the session replay software violated Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (“WESCA”).
In June 2021, the district court granted summary judgment for defendants, finding that defendants were direct parties to the communication, and therefore there was no interception of information under WESCA. In August 2022, the Third Circuit vacated the district court’s decision. It held that Pennsylvania’s WESCA bars wiretapping except when all parties consent and that there is no direct-party exception to liability under WESCA. The Third Circuit went on to hold that the point of “interception” occurred when electronic communications were sent from the plaintiff’s browser to NaviStone’s servers (rather than when communications reached the servers). Because that location could not be determined by the record, it remanded that issue to the district court. Most recently, and as noted above, the Third Circuit denied Harriet Carter and NaviStone’s petition for rehearing.
Litigation involving session replay technology surged in the last few years, with most cases initially filed in Florida and California. Though there appeared to have been a lull recently, this decision and other recently filed lawsuits show that session replay litigation is not a flash in the pan. To minimize risk of liability exposure, companies need to be aware of the session replay and other website tracking software they use on their websites, how such software is being used, and their disclosures to consumers regarding the use of such software.
