Farst v. Autozone, Inc.

IN THE UNITED STATES DISTRICT COURT FOR THE MIDDLE DISTRICT OF PENNSYLVANIA MATTHEW FARST, individually and : CIVIL ACTION NO. 1:22-CV-1435 on behalf of all others similarly : situated, : (Judge Conner) : Plaintiff : : v. : : AUTOZONE, INC., : : Defendant : MEMORANDUM Plaintiff Matthew Farst brings this putative class action against defendant AutoZone Parts, Inc. (“AutoZone”)1 for violations of the Pennsylvania Wiretapping and Electronic Surveillance Control Act (“WESCA”), 18 PA. CONS. STAT. § 5701 et seq. AutoZone moves to dismiss Farst’s complaint for lack of subject-matter jurisdiction and failure to state a claim pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6), respectively.2 We will grant AutoZone’s motion and dismiss Farst’s complaint for want of jurisdiction. I. Factual Background & Procedural History This case arises out of Farst’s interactions with AutoZone’s website. AutoZone is a corporation that sells and distributes automotive replacement parts 1 The complaint names “Autozone, Inc.” as defendant. (See Doc. 1 at 1). Defendant avers it was incorrectly named in the complaint and refers to itself as “AutoZone Parts, Inc.” (See Doc. 46 at 1). 2 Farst requests oral argument regarding AutoZone’s motions. (See Doc. 16 at 1; Doc 49 at 1, 10). We find the parties’ briefing sufficient to dispose of the motions without the need for argument. See M.D. PA. L.R. 7.9. and accessories across the United States. (See AutoZone, About AutoZone, https://about.autozone.com (last visited Oct. 18, 2023)). As part of its business, AutoZone owns and operates the website www.autozone.com. (See Doc. 1 ¶ 22). Farst avers AutoZone used session replay software on its website from September 2020 until at least August 2022. (See id. ¶ 30). The software purportedly allows AutoZone to contemporaneously observe, record, and store visitors’ interactions with the website the moment they access the site. (See id. ¶¶ 5, 30). Farst claims AutoZone purchased the software from a third-party provider and uses an outside vendor to store its session replay recordings. (See id. ¶¶ 5, 7, 30-31, 44). AutoZone allegedly uses these recordings to better understand website visitors’ shopping habits and preferences. (See id. ¶¶ 34, 62). Farst claims he visited AutoZone’s website and was subject to its session replay software at least 10 times between September 2021 and August 2022. (See id. ¶¶ 23-24). During these visits, AutoZone allegedly recorded Farst’s “mouse clicks and movements, keystrokes, search terms, information inputted by [him], pages and content viewed by [him], scroll movements, and copy and paste actions.” (See id. ¶ 26 ). AutoZone did not notify Farst that he was being recorded. (See id. ¶¶ 28, 57). The session replay software purportedly “revealed personalized and sensitive information about [Farst’s] internet activity and habits” and allowed AutoZone to “capture, observe, and divulge [his] personal interests, browsing history, queries, and habits.” (See id. ¶¶ 40, 46). Farst asserts AutoZone violated his statutory rights under WESCA, invaded his privacy, interfered with his right to control his personal data, and exposed his private information. (See id. ¶ 63). On September 14, 2022, Farst filed a complaint against Autozone on behalf of himself and others similarly situated raising a single count for violating WESCA. AutoZone initially moved to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6), and later filed a notice of supplemental authority, which the court construed as a motion to dismiss for lack of jurisdiction pursuant to Rule 12(b)(1). The motions are fully briefed and ripe for disposition. II. Legal Standard Federal Rule of Civil Procedure 12(b)(1) provides that a court may dismiss a claim for lack of subject matter jurisdiction. See FED. R. CIV. P. 12(b)(1). Such jurisdictional challenges take one of two forms: (1) parties may levy a “factual” attack, arguing that one or more of the pleading’s factual allegations are untrue, removing the action from the court’s jurisdictional ken; or (2) they may assert a “facial” challenge, which assumes the veracity of the complaint’s allegations but nonetheless argues that a claim is not within the court’s jurisdiction. See Lincoln Benefit Life Co. v. AEI Life, LLC, 800 F.3d 99, 105 (3d Cir. 2015) (quoting CNA v. United States, 535 F.3d 132, 139 (3d Cir. 2008)). In either instance, it is the plaintiff’s burden to establish jurisdiction. See Mortensen v. First Fed. Sav. & Loan Ass’n, 549 F.2d 884, 891 (3d Cir. 1977). When assessing a facial attack, the court applies the same standard of review as when assessing a motion to dismiss under Rule 12(b)(6). See Const. Party of Pa. v. Aichele, 757 F.3d 347, 358 (3d Cir. 2014) (citing In re Schering Plough Corp. Intron/Temodar Consumer Class Action, 678 F.3d 235, 243 (3d Cir. 2012)). Courts reviewing facial challenges “must only consider the allegations of the complaint and documents referenced therein and attached thereto, in the light most favorable to the plaintiff.” See Gould Elec. Inc. v. United States, 220 F.3d 169 , 176 (3d Cir. 2000) (citing Mortensen, 549 F.2d at 891 ; Pension Benefit Guar. Corp. v. White Consol. Indus., Inc., 998 F.2d 1192, 1196 (3d Cir. 1993)). Article III standing requires allegations that “(1) [plaintiff] suffered an injury in fact, (2) [the injury] is fairly traceable to the challenged conduct of the defendant, and (3) [the injury] is likely to be redressed by a favorable judicial decision.” See Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61 (1992)). To establish an injury in fact, a plaintiff must show “he suffered an invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical.” See id. at 339 (quoting Lujan, 504 U.S. at 560 ) (cleaned up). A plaintiff must allege he suffered a concrete injury “even in the context of a statutory violation.” See TransUnion LLC v. Ramirez, 594 U.S. ___ , 141 S. Ct. 2190, 2205 (2021) (quoting Spokeo, 578 U.S. at 341 ); see also Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 110-11 (3d Cir. 2019). Concrete injuries fall into two broad categories: tangible and intangible harms. See TransUnion, 141 S. Ct. at 2204 . Intangible harms include “injuries with a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts.” See id. (citing Spokeo, 578 U.S. at 340-41 ). A plaintiff need not show that the harm they alleged has “an exact duplicate in American history and tradition”—a close relationship to a “historical or common-law analogue” is sufficient. See id. Historical examples of concrete intangible harms include “the disclosure of private information and intrusion upon seclusion.” See Clemens v. ExecuPharm Inc., 48 F.4th 146, 154 (3d Cir. 2022) (citing TransUnion, 141 S. Ct. at 2204 ). III. Discussion AutoZone asserts a facial challenge to Farst’s standing, arguing he has not adequately pled a concrete harm sufficient to constitute an injury in fact because he has not alleged the company recorded any private facts about him. (See Doc. 46 at 2, 5-6, 8). Farst rejoins that AutoZone’s surreptitious use of session replay software is a concrete injury in and of itself, which he likens to intangible harms such as intrusion upon seclusion and disclosure of private information. (See Doc. 49 at 1-3). Because plaintiff has the burden to establish jurisdiction, we will address Farst’s arguments seriatim. A. Alleged WESCA Violation Our court of appeals has made clear that alleging a “bare procedural violation” is insufficient to establish Article III standing. See Kamal, 918 F.3d at 111 (quoting Spokeo, 578 U.S. at 341 ). Instead, plaintiffs invoking statutory rights must claim they suffered a harm that has “long been seen as injurious.” See id. (quoting In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 638 (3d Cir. 2017)); see also id. (quoting In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 274 (3d Cir. 2016) (characterizing unlawful disclosure of private information as a “de facto injury”)). Only when a statutory right protects against such a harm will an alleged violation constitute an injury in fact “in and of itself.” See id. (quoting Spokeo, 578 U.S. at 634 ). Here, Farst’s allegations involve the novel application of WESCA in the online shopping context. This is clearly not something that has “long been seen as injurious.” See Kamal, 918 F.3d at 111 (quoting Horizon, 846 F.3d at 638 ). We thus reject Farst’s claim that AutoZone’s use of session replay software, without more, is sufficient to constitute a concrete harm. (See Doc. 49 at 1, 4, 9). To establish standing, then, Farst must demonstrate his alleged harm is closely related to an injury traditionally recognized by American courts. B. Intangible Harms at Common Law Farst asserts he suffered an intangible harm closely related to the wellestablished torts of intrusion upon seclusion and public disclosure of private information. (See Doc. 49 at 2). He contends that precedent does not require him to allege a harm with an “exact duplicate in American history and tradition.” (See id. (quoting TransUnion, 141 S. Ct. at 2204 )). With that in mind, he claims AutoZone’s use of session replay software caused a harm sufficiently similar in type—even if not in degree—to the aforementioned common-law privacy torts. (See id. at 3-4). 1. Intrusion Upon Seclusion At common law, intrusion upon seclusion generally required a plaintiff to show the defendant intentionally intruded “upon the solicitude or seclusion of another or his private affairs or concerns,” and that such intrusion “would be highly offensive to a reasonable person.” See Popa v. Harriet Carter Gifts, Inc., 426 F. Supp. 3d 108 , 120 (W.D. Pa. 2019) (quoting RESTATEMENT (SECOND) OF TORTS § 652B (Am. L. Inst. 1972)). A plaintiff’s obligation to show his affairs were private “confirms that the nature of the information [allegedly intruded upon] is paramount.” See Cook v. GameStop, Inc., --- F. Supp. 3d ----, No. 2:22-CV-1292, 2023 WL 5529772 , at *4 (W.D. Pa. Aug. 28, 2023). Our court of appeals has held that such an invasion of privacy contemplates causing the victim “mental suffering, shame or humiliation.” See Clemens, 48 F.4th at 152 (quoting Pro Golf Mfg., Inc. v. Tribune Rev. Newspaper Co., 809 A.2d 243, 248 (Pa. 2002)). Farst claims AutoZone intruded on his private affairs by procuring a thirdparty service provider to watch and record his “mouse clicks and movements, keystrokes, search terms, information inputted by [him], pages and content viewed by [him], scroll movements, and copy and paste actions.” (See Doc. 1 ¶ 26; see also Doc. 49 at 4-5). Farst further alleges he had a “justified and reasonable expectation” of privacy while on AutoZone’s website. (See Doc. 1 ¶ 83). He emphasizes that AutoZone’s “surreptitious tracking” was particularly offensive to his privacy expectations because it was not “reasonably known or discoverable.” (See Doc. 49 at 7 (emphasis in original) (citing In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 606 (9th Cir. 2020), cert. denied, 141 S. Ct. 1684 (2021))). We disagree. Our court of appeals has held that a company’s online tracking practices, even when directed towards children’s internet behavior, is not “sufficiently offensive, standing alone,” for a claim of intrusion upon seclusion to survive a motion to dismiss. See In re Nickelodeon, 827 F.3d at 294-95 . Unlike the plaintiffs in In re Nickelodeon, Farst does not allege AutoZone engaged in deceit or made any sort of promise not to record his interactions on its publicly accessible website. See id. at 295 ; see also In re Google Inc. Cookie Placement Consumer Priv. Litig., 934 F.3d 316, 325 (3d Cir. 2019). AutoZone’s collection of Farst’s keystrokes, mouse clicks, and search history while he surfed its website “is simply not the type of highly offensive act to which liability can attach.” See Popa, 426 F. Supp. 3d at 122. Farst has failed to allege he suffered anything comparable to intrusion upon seclusion. Nor does Farst’s purported injury bear a close relationship to the commonlaw tort. Shopping on a public website, like shopping in a public store, is not an activity one can reasonably expect to keep private from the retailer. See Cook, 2023 WL 5529772 , at *5. The mere fact Farst used “a personal laptop or cell phone” while “sit[ting] in the privacy of his home” does not entitle him to a heightened expectation of privacy. (See Doc. 49 at 4-5). The difference in fora between online and in-person shopping outlets does not transform the generally public nature of shopping into a “private affair.” See RESTATEMENT (SECOND) OF TORTS § 652B. Reasonable people understand that what they “do on the Internet is not completely private. How could it be?” See Nickelodeon, 827 F.3d at 266 . Farst’s visits to AutoZone’s commercial website are not exempt from this basic truth. Other courts within our circuit have similarly found that a company’s tracking of a customer’s shopping activity using session replay software is not closely related to the tort of intrusion upon seclusion. See Cook, 2023 WL 5529772 , at *4-5; Massie v. Gen. Motors LLC, No. 21-CV-787, 2022 WL 534468 , at *5 (D. Del. Feb. 17, 2022).3 We echo their compelling analyses. Farst’s reliance on Third Circuit caselaw is also misplaced. (See Doc. 49 at 5- 6, 8 (citing In re Google, 934 F.3d at 325 ; In re Nickelodeon, 827 F.3d at 294 ; In re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125, 153 (3d Cir. 2015))). Those cases involve defendants who deceived plaintiffs by secretly collecting their private data after promising they would not. Farst makes no such claim here. The type of data collected in those cases is also distinguishable. The defendants in both Google cases ostensibly circumvented privacy settings, compiled users’ internet-wide search histories, created detailed user profiles, and served individualized ads based on those profiles. See In re Google, 806 F.3d at 131, 134 ; In re Google, 934 F.3d at 325 . The defendant in Nickelodeon allegedly disclosed “legally protected information,” including, inter alia, plaintiffs’ genders, birthdates, IP addresses, browser settings, and unique device identifiers. See In re Nickelodeon, 827 F.3d at 269, 274 . Farst, by contrast, merely claims AutoZone 3 Various courts in other circuits have reached the same conclusion based on similar allegations. See Popa v. PSP Grp., LLC, No. 23-294, 2023 WL 7001456 , at *1, 4 (W.D. Wash. Oct. 24, 2023); Jones v. Bloomingdales.com, LLC, No. 4:22-CV-1095, 2023 WL 6064845 , at *2 (E.D. Mo. Sept. 18, 2023); Adams v. PSP Grp., LLC, --- F. Supp. 3d ---, No 4:22-CV-1210, 2023 WL 5951784 , at *7-8 (E.D. Mo. Sept. 13, 2023); Straubmuller v. Jetblue Airways Corp., --- F. Supp. 3d ----, No 23-CV-384, 2023 WL 5671615 , at *4-5 (D. Md. Sept. 1, 2023); Mikulsky v. Noom, Inc., --- F. Supp. 3d ----, No. 3:23-CV-285, 2023 WL 4567096 , at *5 (S.D. Cal. July 17, 2023); Lightoller v. Jetblue Airways Corp., No 23-CV-361, 2023 WL 3963823 , at *4 (S.D. Cal. June 12, 2023); Byars v. Sterling Jewelers, Inc., No 5:22-CV-1456, 2023 WL 2996686 , at *3 (C.D. Cal. Apr. 5, 2023); see also I.C. v. Zynga, Inc., 600 F. Supp. 3d 1034 , 1049-50 (N.D. Cal. 2022); Goldstein v. Costco Wholesale Corp., 559 F. Supp. 3d 1318 , 1321 (S.D. Fla. 2021). observed and recorded his general actions on its website, revealing his shopping preferences regarding the company’s products. (See Doc. 1 ¶¶ 34, 62). He has not alleged AutoZone deceived him or tracked anything beyond his shopping habits on its website. Hence, Farst has failed to adequately plead he suffered an injury analogous to intrusion upon seclusion at common law. C. Disclosure of Private Information To recover damages for disclosure of private information a plaintiff must allege “the matter publicized is ‘(1) publicity, given to (2) private facts, (3) which would be highly offensive to a reasonable person, and (4) is not of legitimate concern to the public.’” See Boring v. Google Inc., 362 F. App’x 273, 280 (3d Cir. 2010) (nonprecedential)4 (quoting Harris by Harris v. Easton Pub. Co., 483 A.2d 1377, 1384 (Pa. Super. Ct. 1984)); see also RESTATEMENT (SECOND) OF TORTS § 652D. A plaintiff may also meet this burden by alleging an injury that is “‘imminent’ rather than ‘actual,’” as long as the plaintiff’s “exposure to the risk of future harm itself causes a separate concrete harm.” See Clemens, 48 F.4th at 155 (emphasis in original) (quoting TransUnion, 141 S. Ct. at 2210-11 ). Farst’s complaint is devoid of facts supporting this species of tort. As an initial matter, Farst does not allege AutoZone disclosed his information so widely “that the matter must be regarded as substantially certain to become one of public 4 The court acknowledges that nonprecedential decisions are not binding upon federal district courts. However, we cite these nonprecedential decisions because we have carefully considered each decision and we are persuaded by each panel’s ratio decidendi. knowledge.” See RESTATEMENT (SECOND) OF TORTS § 652D cmt. a. He only claims AutoZone disclosed his information to its third-party session replay provider. (See Doc. 1 ¶¶ 84, 86). The sole allegation that comes close to a public disclosure is Farst’s averment AutoZone knew its third-party provider would “disclose that information to other users of its Session Replay Provider’s code as part of its effort to de-anonymize visitors.” (See id. ¶ 79). But Farst does not even suggest how many people that group might comprise, let alone that his information would be disseminated far and wide. Assuming, arguendo, this act constitutes a public disclosure, Farst’s claim still fails because he has not sufficiently alleged AutoZone disclosed his “private facts.” See Boring, 362 F. App’x at 280 (nonprecedential); see also RESTATEMENT (SECOND) OF TORTS § 652D. For instance, Farst does not aver AutoZone disclosed his home address, credit card, bank account, social security number, or any other information that could potentially be used to identify him or materially increases his risk of future harm. See Cook, 2023 WL 5529772 , at *4, Massie, 2022 WL 534468 , at *5; see also Clemens, 48 F.4th at 155 . Given Farst’s failure to specify private information he provided to AutoZone through his “clicks, keystrokes, [and] search terms,” (see Doc. 1 ¶ 3), we cannot conclude his allegation that AutoZone disclosed his private facts is plausible, see Mathias v. Kershaw, No. 1:09-CV-1515, 2010 WL 1329067 , at *23 (M.D. Pa. Mar. 29, 2010) (Conner, J.). Farst’s interactions with AutoZone’s website might reveal some of his shopping preferences and habits, but that is akin to what would be revealed during a visit to AutoZone’s brick and mortar store. See Cook, 2023 WL 5529772 , at *5, Massie, 2022 WL 534468 , at *3. Making “scroll movements,” viewing “pages and content,” and engaging in “mouse clicks and movements” are the online analogues of walking down aisles, looking at inventory, and handling products. (See Doc. 1 ¶ 26). Farst’s shopping activity on AutoZone’s website betrays no “private facts” about him. The facts Farst identifies are also easily distinguishable from those at issue in the cases finding public disclosures of private information upon which he relies. See, e.g., Davis v. Fed. Election Comm’n, 554 U.S. 724, 733 (2008) (compelled disclosure of private personal campaign expenditures); Bohnak v. Marsh & McLennan Companies, Inc., 79 F.4th 276, 289 (2d Cir. 2023) (disclosure of plaintiff’s social security number). Farst has not plausibly alleged AutoZone’s actions were “highly offensive” because he fails to identify any sufficiently private facts the company purportedly disclosed. See Popa, 426 F. Supp. at 122. Farst has also failed to plausibly allege AutoZone’s use of session replay software exposed him to a future risk which caused a “separate concrete harm.” See Clemens, 48 F.4th at 155 (emphasis omitted) (quoting TransUnion, 141 S. Ct. at 2211 ). He merely speculates AutoZone’s actions “may cause sensitive information . . . to leak to third parties” and “may expose website visitors to identity theft, online scams, and other unwanted behavior.” (See Doc. 1 ¶ 11) (emphasis added). But Farst does not claim there has ever been a data breach, or that he suffered a concrete injury by investing his time and money to mitigate such a risk. See Clemens, 48 F.4th at 158 . If AutoZone has been using session replay software for over two years, as Farst alleges, (see Doc. 1 ¶ 30), his failure to identify even one incident during that time cuts against his argument. Short of that kind of averment, a “future, hypothetical risk of identity theft or fraud” is not creditable as a concrete injury in fact because it is “dependent on entirely speculative, future actions of an unknown third-party.” See Clemens, 48 F.4th at 153 (quoting Reilly v. Ceridian Corp., 664 F.3d 38, 42 (3d Cir. 2011)). Farst’s failure to allege he took any measures to mitigate this ostensible risk also supports our finding that the risk is purely speculative. Consequently, Farst has failed to allege a harm closely related to the tort of public disclosure of private information. In sum, Farst’s decision to visit AutoZone’s publicly accessible website rather than its physical store did not increase his expectation of privacy or expose him to a concrete harm that otherwise did not exist. We decline to endorse his novel theory of injury because it runs counter to well-settled Article III principles. See TransUnion, 141 S. Ct. at 2205 . Farst lacks standing and we must dismiss his complaint for lack of subject matter jurisdiction. D. Leave to Amend Courts generally should grant leave to amend when “the proposed amendment is not facially meritless” and justice so requires. See Newark Branch, N.A.A.C.P. v. Town of Harrison, 907 F.2d 1408, 1417 (3d Cir. 1990); see also FED R. CIV. P. 15(a)(2); cf. Phillips v. Allegheny County, 515 F.3d 224, 245 (3d Cir. 2008). Here, Farst seeks leave to amend any deficiencies that undercut his standing to bring this suit. (See Doc. 49 at 8-9). Many of the deficiencies identified herein with respect to the concreteness of Farst’s asserted injury are factual and thus potentially curable. We will provide Farst an opportunity to cure these deficiencies by granting him leave to amend Count I of his complaint. IV. Conclusion We will grant AutoZone’s motion to dismiss Farst’s complaint for lack of subject matter jurisdiction without prejudice and deny AutoZone’s motion to dismiss for failure to state a claim as moot. An appropriate order shall issue. /S/ CHRISTOPHER C. CONNER Christopher C. Conner United States District Judge Middle District of Pennsylvania Dated: November 1, 2023