Third Circuit Rejects Standing in Tracking Users’ Website Interactions for Lack of Concrete Injury

In Cook v. GameStop, Inc., the Third Circuit ruled that tracking users’ website interactions without recording or disclosing personal or sensitive data does not constitute a concrete injury under Article III.

Duane Morris reports that the court affirmed dismissal of the putative class action alleging privacy violations, ruling that the claimed harms, which related only to the tracking of clicks and browsing patterns, did not bear a close relationship to traditionally recognized torts or harms.

The dispute originated when plaintiff Amber Cook sued GameStop for using Microsoft’s Clarity software to record mouse movements, scrolls, and time spent on its site.

Cook alleged violations of the Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA) and intrusion upon seclusion. The district court dismissed the complaint for lack of standing, finding no connection between the data gathered and Cook’s personal identity.

Cook’s appeal argued that the tracking itself created a privacy injury and that WESCA independently supported standing.

The Third Circuit disagreed, reasoning that the allegations lacked the type of concrete, real-world harm required under TransUnion and related precedents. The court found the tracked information to be neither sensitive nor personal, and noted that it was not alleged to have been publicly disclosed.

It also rejected the argument that WESCA could bypass Article III’s requirements, emphasizing that Congress or state legislatures cannot convert a non-harmful act into a legally cognizable injury.

The decision provides important clarity for companies facing privacy-based litigation involving website analytics and session replay tools. It signals that plaintiffs cannot rely solely on session replay or website tracking to establish standing.

Website operators collecting non-identifiable, functional browsing data, without disclosing or misrepresenting their practices, are less likely to face viable federal privacy claims.