• by Wendy Davis , October 3, 2025

Again siding with Microsoft, a federal appellate court on Thursday refused to grant a new hearing to a web user who attempted to sue the company over its alleged use of "session replay" technology.

The 9th Circuit Court of Appeals didn't give a reason for its move, other than to say that none of the judges in the circuit voted to rehear the matter.

Unless the Supreme Court intervenes, the 9th Circuit's order brings an end to a battle dating to 2022, when Pennsylvania resident Ashley Popa alleged that Microsoft violated Pennsylvania's wiretap law and engaged in "intrusion upon seclusion" -- meaning committed a highly offensive privacy violation -- by providing code that recorded her "mouse movements, clicks, keystrokes" and other interactions on PetSuppliesPlus.com.

U.S. District Court Judge James Robart in Seattle dismissed Popa's complaint in October 2023, ruling that she failed to show the kind of injury that would warrant a federal lawsuit.

He said in the ruling that Popa didn't allege that she entered personally identifiable information into PetSuppliesPlus's website, or that Microsoft was able to connect any data it allegedly collected to her identity.

She appealed to the 9th Circuit, which in August upheld Robart's ruling.

"Popa identifies no embarrassing, invasive, or otherwise private information collected by Clarity," Judge Jed Rakoff wrote, referring to Microsoft's analytics service.

He added that Microsoft's alleged monitoring of Popa's interactions with PetSuppliesPlus.com "seems most similar to a store clerk’s observing shoppers in order to identify aisles that are particularly popular or to spot problems that disrupt potential sales."

Earlier this month, Popa asked the 9th Circuit to reconsider its ruling, arguing it's inconsistent with other decisions that have allowed consumers to sue companies over online tracking.

"The right to conduct one's affairs away from prying eyes (whether those affairs are sensitive or not) has long been protected in America, and this Court and other courts have repeatedly affirmed legislatures' ability to prohibit technology-assisted eavesdropping, regardless of the topic of the conversation," her attorneys argued.

Microsoft is one of many companies to face recent privacy lawsuits over analytics software. To date, judges have issued mixed rulings in those cases.

For instance, the 3rd Circuit Court of Appeals recently sided with GameStop and refused to revive claims that it violated a privacy law by using Clarity session replay code to track visitors' activity. In that matter, as with Popa's lawsuit, the judges said the allegations, even if proven true, wouldn't show that GameStop visitors suffered a "concrete" injury.

But two months ago a different panel of the 9th Circuit Court of Appeals revived claims that Bloomingdale's violated a California privacy law by allegedly using session replay technology provided by an ad-tech company.

The dispute between Popa and Microsoft drew the attention of the The Interactive Advertising Bureau, Chamber of Commerce and other groups, which backed Microsoft in a friend-of-the-court brief.

"At bottom, Popa seeks to hold defendants-appellees liable because they use session replay technology, which enhances consumers’ web-browsing experiences, even though she has experienced no cognizable harm from that practice and it has not been outlawed by the Pennsylvania legislature," those groups wrote. "There is virtually no limit on the number of cases that could be brought under her theory, as short visits to any of the millions of websites using session replay or other website analytics technologies could be cited to manufacture injury-less claims against innocent defendants."