NEWS & INSIGHTS

In Popa v. Harriet Carter Gifts, Inc., the United States District Court for the Western District of Pennsylvania addressed an increasingly important issue for businesses operating online: how far companies can go in tracking website visitor activity before it crosses the line into an invasion of privacy. The plaintiff alleged that Harriet Carter Gifts and its marketing technology vendor, NaviStone, violated Pennsylvania’s Wiretap and Electronic Surveillance Control Act (“WESCA”) by collecting information about her browsing activity on the retailer’s website without her knowledge or consent. The technology at issue allowed NaviStone to identify users who visited the website, viewed products, and abandoned their shopping carts, so that marketing materials could later be sent to those consumers.

The lawsuit focused heavily on whether Harriet Carter’s website privacy policy adequately informed consumers that their online activity could be tracked and shared with third-party vendors. The Court reviewed the company’s privacy disclosures, including statements explaining that cookies and other technologies were used to improve customer experience, analyze user behavior, and support marketing activities. Importantly, the Court noted that the privacy policy also disclosed that third-party vendors could collect and use website visitor information in connection with those services. Because the plaintiff continued using the website after the policy was made available, the Court concluded that a reasonable internet user would have understood that some level of tracking and data collection was occurring.

A significant aspect of the Court’s reasoning was its recognition that internet users today generally understand that websites routinely use cookies, analytics tools, and tracking technologies as part of standard online business operations. The Court observed that modern e-commerce websites depend heavily on data collection to personalize advertising, monitor customer behavior, and improve sales performance. While the plaintiff argued that the tracking occurred secretly, the Court found that the disclosures in the privacy policy, combined with the ordinary expectations of internet users, defeated her claim that the communications were unlawfully intercepted. Ultimately, the Court granted summary judgment in favor of Harriet Carter and NaviStone, ending the case before trial.

The decision is particularly noteworthy because Pennsylvania’s WESCA statute has recently become the basis for numerous lawsuits involving website tracking technologies, including session replay software, cookies, chat tools, and analytics platforms. Businesses across many industries — especially retailers, healthcare providers, and professional service firms — have faced increased scrutiny over how they collect and share consumer data online. This case provides some reassurance that courts may be willing to recognize implied consent where businesses provide reasonably clear and accessible privacy disclosures. However, the ruling should not be viewed as a blanket approval of all website tracking practices. Courts continue to closely examine how disclosures are presented and whether consumers are given meaningful notice of data collection activities.

From a practical risk-management perspective, the case serves as a reminder that businesses should regularly review their website privacy policies, cookie notices, and third-party vendor agreements. Companies should ensure that disclosures are written in plain language, easy for users to locate, and broad enough to address evolving technologies used for analytics and marketing purposes. Businesses should also evaluate whether their websites use tools such as session replay software, chat features, behavioral advertising tools, or data-sharing integrations that could create additional exposure under state privacy and wiretap laws. As privacy-related litigation continues to expand nationwide, proactive compliance efforts and transparent consumer disclosures remain some of the best defenses against costly litigation and regulatory scrutiny.

This case is on appeal to the United States Court of Appeals for the Third Circuit, and we will keep you updated as this issue evolves.

If you have any questions about your website and its compliance with WESLA and/or this judicial opinion, please contact Dan Lynch via our contact form or at 724-776-8000.