The Third Circuit continues to draw a firm line on Article III standing in website “wiretapping” cases. Just weeks after the court’s decision in Harriet Carter Gifts, the court has issued yet another decision reinforcing that the alleged collection of data through third party tools does not create a concrete injury unless the tools capture truly sensitive, identifying information.
In In re BPS Direct, LLC; Cabela’s, LLC Wiretapping Litig., — F.4th –, 2026 WL 1280969 (3d Cir. May 11, 2026), eight plaintiffs sued online retailers alleging that their use of session replay code—third party software used on their websites that records mouse movements, clicks, scrolls, keystrokes, and text entries—violated the federal Wiretap Act, the Computer Fraud and Abuse Act, and state privacy laws. The Third Circuit affirmed dismissal of six of the eight plaintiffs’ claims for lack of standing, but revived the claims of the other two plaintiffs. Three key elements of the Third Circuit’s ruling stand out:
- The disclosure of website users’ clicks, scrolls, and searches does not create a concrete injury. As a result, six plaintiffs who browsed defendants’ websites without making purchases—and did not input sensitive information—had no standing. The court found their interactions were “no more private than the physical browsing countless shoppers do daily in BPS’s brick-and-mortar stores.”
- Allegations about third parties’ theoretical capabilities cannot establish standing. Plaintiffs argued that because session replay providers “can” and “often [do]” aggregate data into browser “fingerprints,” even users who submitted no personal information had standing because their browsing history could be “de-anonymized.” The court rejected this outright, calling it “only a theoretical path to injury, not an actual one.” And even if third parties were allegedly doing this, that still would not plead a concrete injury caused by defendants.
- The collection of highly sensitive information through third party tools can establish a concrete injury. Two of the plaintiffs did have standing because their names and complete credit card or debit card numbers—information “rightly viewed as highly sensitive” according to the Third Circuit—were allegedly collected. The court found that the capture of this information was analogous to the tort of intrusion upon seclusion, because one expects a customer’s payment information “to be free from prying eyes.”
We will continue to watch for further developments as the Third Circuit—and other circuits—grapple with where to draw the standing line in website wiretapping litigation.