• by Wendy Davis , Yesterday

Siding with Microsoft, a federal appellate panel has refused to revive a Pennsylvania resident's privacy lawsuit alleging that the company recorded her activity on the ecommerce site PetSuppliesPlus.com.

In a ruling issued Tuesday, a three-judge panel of the 9th Circuit Court of Appeals said the plaintiff, Ashley Popa, lacked "standing" to proceed because she failed to show that she was injured by the alleged privacy violation.

"Popa identifies no embarrassing, invasive, or otherwise private information collected by Clarity," U.S. District Court Judge Jed Rakoff wrote, referring to Microsoft's analytics service.

He added that Microsoft's alleged monitoring of Popa's interactions with PetSuppliesPlus.com "seems most similar to a store clerk’s observing shoppers in order to identify aisles that are particularly popular or to spot problems that disrupt potential sales."

Circuit Judges Johnnie Rawlinson and Milan Smith, Jr. joined Rakoff's opinion.

Microsoft is one of many companies to face recent privacy lawsuits over analytics software.

So far, those cases have met with a mixed reception in court.

For instance, earlier this month the 3rd Circuit Court of Appeals sided with GameStop and refused to revive claims that it violated a privacy law by using Clarity session replay code to track visitors' activity. In that matter, as with Popa's lawsuit, the judges said the allegations, even if proven true, wouldn't show that GameStop visitors suffered a "concrete" injury.

But two months ago a different panel of the 9th Circuit Court of Appeals revived claims that Bloomingdale's violated a California privacy law by allegedly using session replay technology provided by an ad-tech company.

Tuesday's ruling comes in a lawsuit brought by Popa in 2022, when she alleged that Microsoft violated Pennsylvania's wiretap law and engaged in "intrusion upon seclusion" by providing code that recorded her "mouse movements, clicks, keystrokes" and other interactions on PetSuppliesPlus.com.

U.S. District Court Judge James Robart in Seattle dismissed Popa's complaint in October 2023, ruling that she failed to show the kind of injury that would warrant a federal lawsuit.

"Ms. Popa does not allege that she entered any personally identifiable information into [PetSuppliesPlus's] website, that such information was captured by defendants, or that defendants were able to connect the information Clarity collected to her identity," Robart wrote. "Because she has not alleged that Defendants engaged in conduct that invaded historically protected privacy interests, she has not alleged an injury in fact that is sufficient to confer ... standing."

Popa then appealed to the 9th Circuit, arguing that the "surreptitious collection and disclosure of a plaintiff’s private electronic communications" in itself is harmful.

"From the moment her browser loaded www.petsuppliesplus.com, the hidden software monitored everything she did on the website, including which links she clicked on, how long she hovered over specific content, and many other aspects of her communication with the site," her counsel argued to the 9th Circuit.

"The type of privacy harm Popa experienced has been traditionally recognized and redressable in American courts," counsel added.

Microsoft opposed Popa's request, arguing that her allegations, even if proven true, wouldn't show that it "intercepted a private conversation, email, text message, or any other personal sensitive information of hers."

"The sort of session replay technology Popa attacks here is a common type of analytics software that helps website owners... analyze website use to improve the site and user experience," Microsoft wrote.

The Interactive Advertising Bureau, Chamber of Commerce and other groups backed Microsoft in a friend-of-the-court brief.

"At bottom, Popa seeks to hold defendants-appellees liable because they use session replay technology, which enhances consumers’ web-browsing experiences, even though she has experienced no cognizable harm from that practice and it has not been outlawed by the Pennsylvania legislature," those groups wrote. "There is virtually no limit on the number of cases that could be brought under her theory, as short visits to any of the millions of websites using session replay or other website analytics technologies could be cited to manufacture injury-less claims against innocent defendants."