While California’s wiretapping statute, the California Invasion of Privacy Act (CIPA), tends to dominate the conversation about the recent rise in wiretapping litigation, plaintiffs are also turning to other states’ wiretapping laws to target web tracking and session-replay tools. The U.S. Court of Appeals for the Third Circuit recently held that a website visitor could not pursue a Pennsylvania wiretapping claim in federal court because she did not allege a concrete enough injury to satisfy Article III of the U.S. Constitution. The case, Popa v. Harriet Carter Gifts, Inc., involves claims against a retailer, Harriet Carter, and its marketing-services provider, over alleged tracking of the plaintiff’s activity while she browsed the retailer’s website.
Article III standing is the threshold requirement to be in federal court, and it means that a plaintiff must show they were personally harmed in a concrete way, not just that a statute may have been violated. If a plaintiff cannot show a concrete injury, a federal court lacks power to decide the case. In Popa, the standing question was shaped by the Third Circuit’s earlier decision in Cook v. GameStop, Inc. 148 F.4th 153, 157 (3d Cir. 2025). There, the court held that routine website interactions, such as moving a mouse, clicking, using a search function, or adding items to a cart, do not by themselves amount to a sufficiently concrete injury for federal standing when the plaintiff did not enter sensitive or personal information during the session.
Applying that approach, the Popa panel noted that the plaintiff conceded she did not suffer an Article III injury, and the court therefore could not reach the merits of her Pennsylvania Wiretapping and Electronic Surveillance Control Act claims. Before this appeal, and prior to the Cook decision, the federal trial court had granted summary judgment to the defendants, ending the case in their favor without a trial. Because the federal courts lacked jurisdiction, the Third Circuit vacated the prior federal summary judgment ruling and instructed the district court to send the case back to state court.
For companies dealing with website-tracking claims, Popa is a reminder that in the Third Circuit, federal jurisdiction may hinge on what the user actually did on the site and whether the alleged tracking plausibly involved capturing sensitive or personal inputs, as opposed to ordinary browsing. That puts renewed focus on understanding what data a website and its vendors collect at each step of the user journey and aligning disclosures and consent mechanisms with how the technology works. And even when a case cannot stay in federal court, Popa highlights that a dispute may simply continue in state court, where the litigation may turn less on constitutional standing and more on the state statute’s scope and the specific facts of the implementation.
