CURRENT MONTH (December 2024)
Plaintiff Alleging Privacy Invasion Against Website Owner Lacked Standing
By Alan S. Wernick, Esq., Wernick & Associates, LTD.
In Jones v. Bloomingdales.com, LLC and Jones v. Papa John’s International, Inc., the United States Court of Appeals for the Eighth Circuit reviewed two cases, both involving websites using session replay software. Both were filed by the same plaintiff, one against Bloomingdales.com and the other against Papa John’s International. The cases alleged that Plaintiff’s visiting Defendants’ respective websites resulted in the invasion of Plaintiff’s privacy. Both cases were dismissed by the District Courts, and their appeals were consolidated by the Court of Appeals in its December 24, 2024, decision. The Court of Appeals affirmed their dismissal.
The Eighth Circuit stated that “Jones alleges that she visited the companies’ websites and, unbeknownst to her, they employed ‘session replay’ technology that allowed them to discern and record things like her ‘mouse movements, clicks, keystrokes (such as text being entered into an information field or text box), search terms, URLs of web pages visited, as well as . . . what [she] searched for, what [she] looked at, the information [she] inputted, and what [she] clicked on.’ She says that this technology compiles what ‘is essentially a video of [her] entire visit’ that can be replayed any time.”
The Court accepted Plaintiff’s argument that companies like the Defendants that use session replay technology value the information collected. But, the Court stated, “that does not mean that the information gathered is information that a website visitor could reasonably expect to keep private from the website owners or their agents. Just as a security camera at a physical store might record how customers react to a display of products, session-replay technology captures how a store’s online customers react to digital displays, to the extent ‘clicks’ and ‘hovers’ might reveal those reactions. We fail to see how this invades Jones’s privacy, especially when she voluntarily conveyed the information she says is private to the defendants, and when the allegations don’t suggest that she provided information that would identify her” (citations omitted).
The Court of Appeals, in affirming the District Courts’ dismissals, held “that Jones has not plausibly alleged that she suffered a concrete injury, and so she lacks standing to bring these suits. We do so not because we think she experienced only a slight invasion of her privacy, but because her allegations do not plausibly suggest that she suffered any such invasion at all” (citation omitted).
There are many valid business reasons retailers have security cameras and other technologies in place in their physical brick-and-mortar stores (e.g., security monitoring; data analytics such as traffic counts, customer flow and understanding what product displays appear to attract more customer attention than others). Similarly, website owners have many valid business reasons for using monitoring technologies on their websites (e.g., data analytics such as clicks, hover time, and return visitors; protection of intellectual property rights).
The bottom line is that the legal outlines of privacy are evolving as technologies evolve. The parameters of reasonable expectations for visitors (potential customers) to websites will depend on the facts, including, without limitations, the disclosures the website owners make about the information they collect when visitors choose to visit the website, the terms of use and privacy policy set forth by the website owner, the technologies in use, the information actually disclosed by the website visitor, etc.
© 2024 Alan S. Wernick.
