Third Circuit revives privacy claims over hidden website tracking

A federal appeals court in the Third Circuit gave two Bass Pro Shops and Cabela’s shoppers another chance to press privacy claims over hidden website tracking. The companies used JavaScript session-replay code, software that records and can replay how a visitor moves through a page, and the panel said that kind of tracking can amount to a concrete privacy injury when it captures sensitive purchase information.

That matters because federal court is not open to every complaint about online surveillance. Plaintiffs have to show Article III standing, the constitutional requirement that they suffered a real injury. For two of the shoppers, the alleged recording of names, addresses and payment details was enough to keep their claims alive.

What the sites recorded

Bass Pro Shops and Cabela’s used the code on their websites to capture and store user interactions, including mouse movements, text entries and clicks. The shoppers said the practice happened without their consent and violated state and federal privacy laws.

Eight named plaintiffs brought the case, but the district court threw it out for lack of standing. The appeals court reversed only in part, sending back the claims of the two plaintiffs who entered purchase information while using the sites.

Where the line fell

The other six plaintiffs stayed out of court. They had only browsed the websites, and the panel said that was not enough, by itself, to show the kind of harm federal law recognizes.

That split is the story. Ordinary web traffic did not carry the case over the line, but the alleged capture of shopping details did. For retailers and other sites that use session-replay tools, the ruling is a reminder that background tracking can turn into litigation when it reaches beyond generic browsing and into personal information.

The claims for the two surviving plaintiffs return to the district court for more proceedings.