• by Wendy Davis , August 11, 2025

Siding with GameStop, federal appellate judges late last week refused to revive privacy claims over allegations that it logged website visitors' activity.

In a decision handed down Thursday, a three-judge panel of the 3rd Circuit Court of Appeals said the allegations, even if proven true, wouldn't show that GameStop.com visitors suffered a "concrete" injury.

The ruling stems from a lawsuit by Pennsylvania resident Amber Cook, who alleged in a 2022 class-action complaint that GameStop used session replay code provided by Microsoft Clarity to capture data about consumers' activity on the site.

Clarity "captures a user’s interactions with a website, logging every website user’s mouse movements and clicks, scrolling window resizing, user inputs, and more," and provides a "specific user ID" to all visitors in order to monitor their activity over time, Cook alleged.

Her complaint included a claim that GameStop violated Pennsylvania's wiretapping law, which prohibits companies from intercepting communications without all parties' consent.

U.S. District Court Judge Nicholas Ranjan in the Western District of Pennsylvania dismissed the case in August 2023, ruling that Cook couldn't proceed in federal court because her allegations, even if true, wouldn't show that she was harmed by GameStop.

On Thursday, the 3rd Circuit upheld that finding.

"The information captured by the session replay code was not sensitive or personal," Circuit Judge D. Michael Fisher wrote in an opinion joined by Thomas Hardiman and David Porter.

Fisher added that Cook "did not share her name, contact information, address, or billing information while on GameStop’s website."

He also wrote that even though Cook alleged that Clarity assigned a user ID to visitors, her complaint failed to allege that GameStop actually identified her. 

GameStop is one of numerous companies to recently face privacy lawsuits over tracking software.

So far, those cases have met with a mixed reception in court. For instance, a different federal appeals court, the 9th Circuit Court of Appeals, recently revived claims that Bloomingdale's violated a California privacy law by allegedly using session replay technology provided by an ad-tech company.

It's not yet clear whether the 3rd Circuit's ruling in favor of GameStop will lead to the dismissal of other privacy complaints over online tracking because the allegations against GameStop might differ from allegations against other companies, according to Santa Clara University law professor Eric Goldman.

For instance, he says, the lawsuit against GameStop was brought under Pennsylvania's version of a wiretap law, but other suits center on different variations of wiretap laws.

Goldman also notes the 3rd Circuit emphasized that Cook's complaint failed to allege either that she made a purchase at GameStop, or that the company actually identified her as a result of the tracking software.

She didn't "connect the dots to show that the information collected from her session replay could be connected to her as an individual," Goldman says, adding that a different plaintiff might have been able to make that showing.