A recent Third Circuit decision, Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (2022), considered whether a commercial website that allows third parties to track customer input may violate Pennsylvania’s wire-tapping statute. Reversing the district court, the Third Circuit held that such actions may violate the statute and give rise to liability. It remanded the case to determine whether the customer had implicitly consented to the tracking.
Ashley Popa searched the internet for a set of pet stairs. She browsed the website of Harriet Carter Gifts, added a set of stairs to her cart, but then left the website without making a purchase. She later discovered that, unbeknownst to her as she was browsing the website, a third-party marketing service Harriet Carter was using, NaviStone, tracked her activities across the site. Navistone used the website to implant a small piece of Javascript code, often called a “cookie,” on her browser, which then transmitted her search and “add to cart” selection to its own servers. Popa sued under Pennsylvania’s Wiretapping and Electronic Surveillance Control Act.
The Third Circuit first noted that under Pennsylvania’s law, to show liability Popa would have to show that the defendants “intercepted” her communications. But the statute gives that term a broad meaning, basically any “acquisition of the contents of any wire, electronic or oral communication through the use of any electronic, mechanical or other device.” The defendants’ acts qualified.
Next it dealt with a line of cases that held that where the interception takes place by the intended recipient, there is no violation. Although many Pennsylvania cases had so held, the Third Circuit noted that the Legislature, in codifying this law, had limited it to law enforcement, and even then prior approval of a supervising officer is required. The implication is that other than law enforcement, the wiretap law can be violated by the recipient.
Another issue was whether Popa had consented to this interception. Pennsylvania is a “two-party consent state,” meaning that both parties to a conversation must consent to its recording. Most states, and federal law, provide that the consent of one party suffices. But California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington require consent of both parties.
Pennsylvania law does not require express consent or actual knowledge; implicit consent, or a showing that the party “should have known” her conversation was being recorded suffices to avoid liability. The Defendants argued that the website’s privacy policy alerted Popa to the possibility her information would be tracked. The Third Circuit remanded for consideration of this issue.
The use of cookies and other tracking devices on commercial websites is common. Operators are well advised to make clear disclosure of this fact, and perhaps require affirmative agreement before the site can be used.
Ashley Popa searched the internet for a set of pet stairs. She browsed the website of Harriet Carter Gifts, added a set of stairs to her cart, but then left the website without making a purchase. She later discovered that, unbeknownst to her as she was browsing the website, a third-party marketing service Harriet Carter was using, NaviStone, tracked her activities across the site. Navistone used the website to implant a small piece of Javascript code, often called a “cookie,” on her browser, which then transmitted her search and “add to cart” selection to its own servers. Popa sued under Pennsylvania’s Wiretapping and Electronic Surveillance Control Act.
The Third Circuit first noted that under Pennsylvania’s law, to show liability Popa would have to show that the defendants “intercepted” her communications. But the statute gives that term a broad meaning, basically any “acquisition of the contents of any wire, electronic or oral communication through the use of any electronic, mechanical or other device.” The defendants’ acts qualified.
Next it dealt with a line of cases that held that where the interception takes place by the intended recipient, there is no violation. Although many Pennsylvania cases had so held, the Third Circuit noted that the Legislature, in codifying this law, had limited it to law enforcement, and even then prior approval of a supervising officer is required. The implication is that other than law enforcement, the wiretap law can be violated by the recipient.
Another issue was whether Popa had consented to this interception. Pennsylvania is a “two-party consent state,” meaning that both parties to a conversation must consent to its recording. Most states, and federal law, provide that the consent of one party suffices. But California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington require consent of both parties.
Pennsylvania law does not require express consent or actual knowledge; implicit consent, or a showing that the party “should have known” her conversation was being recorded suffices to avoid liability. The Defendants argued that the website’s privacy policy alerted Popa to the possibility her information would be tracked. The Third Circuit remanded for consideration of this issue.
The use of cookies and other tracking devices on commercial websites is common. Operators are well advised to make clear disclosure of this fact, and perhaps require affirmative agreement before the site can be used.