On August 16, 2022, in Popa v. Harriet Carter Gifts, Inc., the United States Court of Appeals for the Third Circuit held that using web analytics to track visitors actions on websites could violate the Pennsylvania Wiretapping and Electronic Surveillance Control Act (“Wiretap Act”). This is important because many businesses use web tracking tools, such as cookies, to gather data from their customers. This data may then be used for both targeted marketing and optimizing websites.

These businesses may now face suit for using industry standard web analytics tools. In fact, Houston Harbaugh is already aware of class action lawsuits that have been filed since the Popa decision. The breadth of the decision reaches even out-of-state parties. The Third Circuit found that the Pennsylvania Wiretap Act applied even though the website in question was hosted outside of Pennsylvania. The court reasoned that the cookie was placed on Popa’s phone in Pennsylvania, and that cookie rerouted Popa’s information to the out-of-state server. Effectively, the cookie “tapped” the device in Pennsylvania.

On October 18, 2022, the Third Circuit amended its prior opinion. The amended opinion upheld the original ruling and reinforced that consent is required to intercept a communication. However, the amended opinion still emphasizes that actual knowledge is not required to consent to tracking. Instead, the test is whether the person knew or should have known that their actions were being tracked. The Third Circuit further stated that it was specifically declining to determine whether a privacy policy located on the website was sufficient to establish implied consent. The implication here is that a posted privacy policy, even if not read by a website visitor, may insulate a business from a wiretap claim.

Based on the Papa case, businesses should immediately take steps to protect themselves. For example, a privacy policy should be posted on the website detailing the information being gathered. Additionally, prior to any data being gathered, visitors should be provided with a popup notification requiring consent to the privacy policy.

This is an evolving area of law that will likely change in the near future.