Opinion
Civil Action 22-4880
12-11-2023
BRITTANY VONBERGEN, Plaintiff v. LIBERTY MUTUAL INSURANCE COMPANY, Defendant
MEMORANDUM
PRATTER, J.
Brittany Vonbergen and the Proposed Class Members claim the unlawful interception of their electronic communications by Liberty Mutual on Liberty Mutual's website through the use of session replay software. Ms. Vonbergen alleges that by intercepting and recording her electronic communications, Liberty Mutual violated the Pennsylvania Wiretap and Electronic Surveillance Control Act (“Pennsylvania Wiretap Act”). Liberty Mutual seeks to dismiss Ms. Vonbergen's; complaint under Federal Rules of Civil Procedure 12(b)(2) and 12(b)(6). The Court denies Liberty Mutual's motion to dismiss.
Background
Liberty Mutual Insurance Company uses session replay software on its website, Session replay software allegedly records and captures website users' interactions with a website. The software permits companies like Liberty Mutual to view users' interactions with their website in real-time, produces a “playback of individual browsing sessions” as well as detailed profiles of i individual visitors, and analytically reformats the collected data. According to Ms. Vonbergen, the i session replay software utilized by Liberty Mutual “is not a traditional website cookie, tag, web beacon, or analytics tool. It is a sophisticated computer software that allows the Session Replay Provider to contemporaneously intercept, capture, read, observe, re-route, forward, redirect and receive incoming electronic communications to [Liberty Mutual's] website.”
Ms. Vonbergen alleges that Liberty Mutual unlawfully procured the interception of her and the Proposed Class Members' electronic communications through third-party session replay software, which allowed Liberty Mutual to watch and record Ms. Vonbergen's and the Proposed Class Members' visits to its website. Specifically, Liberty Mutual used session replay software from third-party session replay providers Clicktale and Datadog, who contemporaneously intercepted Ms. Vonbergen's purported electronic computer-to-computer data communications with Liberty Mutual's website. The data collected included how Ms. Vonbergen interacted with the website, her mouse movements and clicks, keystrokes, search terms, information, and personally identifiable information (PH) inputted into the website, as well as pages and content viewed while visiting the website. Ms. Vonbergen alleges that Liberty Mutual knowingly and intentionally facilitated these third parties' interception, recording, processing, and storage of this electronic data, which was created when Ms. Vonbergen visited Liberty Mutual's website, without obtaining prior consent.
Ms. Vonbergen alleges that the Proposed Class is defined as “All persons residing within the State of Pennsylvania (1) who visited Defendant's website and (2) whose electronic communications were intercepted by Defendant or on Defendant's behalf (3) without their prior consent.” Am. Compl. At ¶ 70. She alleges that Liberty Mutual intercepted the electronic communications of at least 5,000 individuals. Because there are over 5,000 anticipated class members, Ms. Vonbergen avers that the numerosity requirement under Rule 23 is satisfied. She further contends that there are common questions of law and fact affecting all of the Class Members, and that her claims in the present action are typical of the claims of the Class. Finally, Ms. Vonbergen alleges that a class action is superior to other methods of adjudication, and that she will adequately represent and protect the interests of the Class Members. '
Ms. Vonbergen avers that Liberty Mutual's use of session replay software injured her and the Proposed Class Members by violating their privacy rights under the Pennsylvania Wiretap Act.
I. Factual Background
Ms. Vonbergen visited Liberty Mutual's website in or around March 2022 while she was physically located in Pennsylvania. During this visit, she filled out a Pennsylvania-specific online auto insurance quote form in which she was required to communicate the following personal information, zip code, name, birthdate, address, how long she had lived at that address, email address, license plate number or Vehicle Identification Number, whether she owned, financed, or leased her vehicle, frequency of commuting to New York or New Jersey, where she kept her vehicle, the year she bought her vehicle, whether she was married, gender identity, age when she got her license, phone number, current auto insurance information, prior insurance coverage, employment status, education, and whether she rented or owned her home.
Ms. Vonbergen alleges that during this visit, she “transmitted substantive information via electronic communications in the form of instructions to [Liberty Mutual's] computer servers utilized to operate the website. The commands were sent as messages instructing [Liberty Mutual] what content was being viewed, clicked on, requested and/or inputted by [Ms. Vonbergen].” As an example, Ms. Vonbergen alleges that when she was filling out the information for an online auto insurance quote, she was asked whether she rented or owned her home. When she clicked the selection for “rent,” an electronic communication was sent which conveyed Ms. Vonbergen's; response and triggered the online form to proceed to the next question. The purported electronic communications included the following actions taken by Ms. Vonbergen while on the website mouse clicks and movements, keystrokes, search terms, information and PII inputted by Ms. Vonbergen, pages and content viewed by Ms. Vonbergen, scroll movements, and copy and paste actions. Liberty Mutual then responded to these purported electronic communications by processing the inputted information and supplying the requested information. Ms. Vonbergen alleges that the session replay software used by Liberty Mutual contemporaneously and instantaneously created a duplicate request-and-response communication for her actions and routed these purp or ted communications to session replay providers' servers without her knowledge or consent. The session replay software used by Liberty Mutual allegedly intercepted and stored the computer-to-computer data communications between Ms. Vonbergen's computer and the hardware utilized by Liberty Mutual to operate its website. The data collected and stored by the session replay software included the personal information Ms. Vonbergen inputted into the auto insurance form. This data could also be used by Liberty Mutual to create a video playback of Ms. Vonbergen's visit to the website.
Ms. Vonbergen alleges that she reasonably expected her visit to Liberty Mutual's website would be private and that a third party would not be tracking and recording her interaction with the website. She alleges that she was not presented any disclosure or consent alerting her to a third-party's recording of her activity on Liberty Mutual's website. For example, no pop-up disclosing the website's use of session replay software appeared when Ms. Vonbergen first entered the website, nor was Ms. Vonbergen required to review a privacy policy and affirm that she understood the terms prior to filling out the online auto insurance form.
II. Procedural Background
In response to Liberty Mutual's motion to dismiss her original complaint, Ms. Vonbergen filed an amended complaint. Ms. Vonbergen asserts only one count in her amended complaint violations of the Pennsylvania Wiretap Act, 18 Pa. Cons. Sat. § 5701, etseq., on behalf of herself and the Proposed Class Members under Federal Rule of Civil Procedure 23.
Liberty Mutual moved to dismiss the amended complaint for lack of personal jurisdiction under Federal Rule of Civil Procedure 12(b)(2) and for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6). Ms. Vonbergen and Liberty Mutual subsequently filed response and reply briefs, as well as over a dozen notices of supplemental authority relating to the motion to dismiss. The motion, having now been more than fully briefed and argued, is ripe for resolution.
Discussion
I. Motion to Dismiss Under Rule 12(b)(2) for Lack of Personal Jurisdiction
In ruling on a Rule 12(b)(2) motion to dismiss for lack of personal jurisdiction, the Court takes the allegations of the complaint as true. See Dayhoff Inc. v. HJ Heinz Co., 86 F.3d 1287, 1302 (3d Cir. 1996) (citing Narco Avionics, Inc. v. Sportsman's Mkt., Inc., 792 F.Supp. 398, 402 (E.D. Pa. 1992)). However, once a jurisdictional defense is raised, the plaintiff bears the burden of proving, through affidavits or competent evidence, contacts with the forum state sufficient to establish personal jurisdiction. Id. The plaintiff must establish those contacts “with reasonable particularity.” Mellon Bank (E.) PSFS, Nat'lAss'n v. Farino, 960 F.2d 1217, 1223 (3d Cir. 1992). Once the plaintiff makes out a prima facie case in support of personal jurisdiction, the burden shifts to the defendant to establish that some other considerations exist which would render the exercise of personal jurisdiction unreasonable. Carteret Sav. Bank, FA v. Shushan, 954 F.2d 141, 150 (3d Cir. 1992).
Federal district courts exercise personal jurisdiction according to the law of the state where the court sits. O'Connor v. Sandy Lane Hotel Co., Ltd., 496 F.3d 312, 316 (3d Cir. 2007). This Court applies Pennsylvania's long-arm statute, which provides for jurisdiction “to the fullest extent allowed under the Constitution of the United States . .. based on the most minimum contact with th[e] Commonwealth allowed under the Constitution of the United States.” 42 Pa. Cons. Stat. § 5322(b); see O'Connor, 496 F,3d at 316. Due process requires that the defendant “have certain minimum contacts with [the forum state] such that the maintenance of the suit does not offend traditional notions of fair play and substantial justice.” Int 7 Shoe Co. v Washington, 326 U.S. 310, 316(194 5) (internal quotations omitted).
There are two types of personal jurisdiction: general and specific. O'Connor, 496 F.3d at 317. The parties do not dispute that the Court cannot exercise general personal jurisdiction over Liberty Mutual because Liberty Mutual is organized under the laws of Massachusetts and maintains its principal place of business in Massachusetts. Therefore, Liberty Mutual is not “at home” in Pennsylvania and cannot be subject to the general jurisdiction of this Court. Daimler AG v. Bauman, 571 U.S. 117, 137 (2014) (providing that a corporation is “at home” only in its place of incorporation and its principal place of business); see also Goodyear Dunlop Tire Operations, S.A. v. Brown, 564 U.S. 915, 919 (2011) (“A court may assert general jurisdiction over foreign . . . corporations . . . when their affiliations with the State are so ‘continuous and systematic' as to render them essentially at home in the forum State.”). However, Pennsylvania expressly permits its courts to exercise “general personal jurisdiction” over registered foreign corporations, 42 Pa. Cons. Stat. § 5301(a)(2)(i), and the Supreme Court has explained that a foreign corporation consents to this general personal jurisdiction by complying with Pennsylvania's registration requirements, see Mallory v. Norfolk Southern Railway Co., 600 U.S. 122, 134-35 (2023). Ms. Vonbergen's Complaint is silent about the registration status of Liberty Mutual.
“Specific jurisdiction. . . depends on an affiliatio[n] between the forum and the underlying controversy, principally, activity or an occurrence that takes place in the forum State and is therefore subject to the State's regulation.” Goodyear, 564 U.S. at 919 (internal quotation marks omitted). “[S]pecific jurisdiction is confined to adjudication of issues deriving from, or connected with, the very controversy that establishes jurisdiction.” Id. (internal quotation marks omitted). The Court of Appeals for the Third Circuit employs a three-part test to analyze whether a party's contacts are sufficient to permit the exercise of specific jurisdiction in accordance with the mandates of due process: (1) “the defendant must have purposefully directed its activities at the forum”; (2) “the litigation must arise out of or relate to at least one of those activities”; and (3) the exercise of jurisdiction must “comport[] with traditional notions of fair play and substantial justice.” O Connor, 496 F.3d at 317, 324 (internal quotation marks omitted).
Ms. Vonbergen alleges that this Court can exercise personal jurisdiction over Liberty Mutual because
[Liberty Mutual] specifically directs, markets, and provides its business activities throughout the State of Pennsylvania, and makes its active commercial website, including Pennsylvania specific material, available to residents of Pennsylvania for those interested in entering into contracts over the Internet with [Liberty Mutual], For example, Pennsylvania residents seeking to obtain an auto insurance quote from [Liberty Mutual] s website are specifically asked about their weekly commuting activities to New York and New Jersey. Indeed, [Liberty Mutual] 's website contains marketing pages specific to Pennsylvania residents and allows residents of Pennsylvania to both submit information and make purchases utilizing the website.Am, Compl. at ¶ 18. Liberty Mutual also “solicited and processed Pennsylvania specific insurance quote forms submitted through its website and entered into contracts for the sale of services with residents of Pennsylvania that involved the knowing and repeated transmission of computer data over the Internet.” Liberty Mutual generated revenue from its sale of services to residents in Pennsylvania. Ms. Vonbergen further alleges that the Court has personal jurisdiction over Liberty Mutual because its * tortious conduct against [Ms. Vonbergen] occurred in substantial part within this District and because [Liberty Mutual] committed the same wrongfill acts to other individuals within this judicial district, such that [Liberty Mutual's] acts complained of herein occurred within this District, subjecting [Liberty Mutual] to jurisdiction here.”
Liberty Mutual argues that the Court cannot exercise personal jurisdiction over it for two reasons. First, Liberty Mutual argues that Ms. Vonbergen's allegations foil under the Calder effects test because Ms. Vonbergen fails to allege that Liberty Mutual expressly aimed its allegedly tortious conduct-intercepting electronic communications in violation of Pennsylvania's Wiretap Act at Pennsylvania. Second, Liberty Mutual argues that Ms. Vonbergen fails to demonstrate that Liberty Mutual has purposefully directed its activities at Pennsylvania. Further, even if the Court were to find that Liberty Mutual purposefully directed its activities at Pennsylvania, according to Liberty Mutual Ms. Vonbergen fails to demonstrate that her claims regarding the session replay software arise out of Liberty Mutual's contacts with Pennsylvania.
A. Calder Effects Test
When a plaintiff claims that a defendant committed an intentional tort, the Court must consider whether jurisdiction is appropriate under the Calder effects test, See Calder v. Jones, 465 U.S. 783, 788-90 (1984). Under the Calder effects test, the plaintiff must show that: “(1) [t]he defendant committed an intentional tort; (2) [t]he plaintiff felt the brunt of the harm in the forum such that the forum can be said to be the focal point of the harm suffered by the plaintiff as a result i of that tort; [and] (3) [t]he defendant expressly aimed his tortious conduct at the forum such that the forum can be said to be the focal point of the tortious activity.” IMO Indus., Inc. v. KeikertAG, 155 F,3d 254, 265-66 (3d Cir. 1998). To satisfy the third prong, “the plaintiff must show that the i defendant knew that the plaintiff would suffer the brunt of the harm caused by the tortious conduct in the forum.” Id. at 266 (emphasis added).
The Third Circuit has described the difference between the Calder effects test and the traditional three-part test as follows:
The effects test and traditional specific jurisdiction analysis are different, but they are cut fiom the same cloth. Just as the standard test prevents a defendant from be[ing] haled into a jurisdiction solely as a result of random, fortuitous, or attenuated contacts, the effects test prevents a defendant from being haled into a jurisdiction solely because the defendant intentionally caused harm that was felt in the forum state if the defendant did not expressly aim his conduct at that state.Marten v. Godwin, 499 F.3d 290, 297 (3d Cir. 2007) (internal citations omitted).
“[T]he mere allegation that the plaintiff feels the effect of the defendant's tortious conduct in the forum because the plaintiff is located there is insufficient to satisfy Calder.” IMO Indus., 155 F.3d at 263, Instead, the plaintiff must “point to other actions that adequately demonstrate!] that the defendants targeted (or ‘expressly aimed' their conduct at) the forum, and thereby show that the forum was the focal point of the tortious activity.” Id. “There is [also] a critical difference between an act which has an effect in the forum and one directed at the forum itself” Surgical Laser Techs., Inc. v C.R. Bard, Inc., 921 F.Supp. 281, 285 (E.D. Pa. 1996). “[A]bsent some conduct by defendant directed at Pennsylvania rather than simply directed at plaintiff, Pennsylvania is not a reasonably foreseeable forum.” Id. at 285 n.6.
When a court applies the effects test' in the context of Internet usage, the jurisdictional framework set out in Zippo [Manufacturing] v. Zippo Dot Com, Inc., 952 F.Supp. 1119 (W.D. Pa. 1997), is widely accepted as the best approach to assess whether a nonresident defendant's internet usage justifies the exercise of personal jurisdiction.” Pacheco v. Padjan, No. 16-cv-3625, 2017 WL 3217160, at *3 (E.D. Pa. July 28, 2017) (citing Gorman v. Jacobs, 579 F. Supp, 2d 541, 547 (E.D. Pa. 2009) (collecting cases from federal circuit courts)), Zippo sets forth the test as follows:
At one end of the spectrum are situations where a defendant clearly does business over the internet. If the defendant enters into contracts with residents of a foreign jurisdiction that involve the knowing and repeated transmission of computer files over the Internet, personal jurisdiction is proper. At the opposite end are situations where a defendant has simply posted information on an Internet Web site which is accessible to users in foreign jurisdictions. A passive Web site that does little more than make information available to those who are interested in it is not grounds for the exercise [of] personal jurisdiction. The middle ground is occupied by interactive Web sites where a user can exchange information with the host computer. In these cases, the exercise of jurisdiction is determined by examining the level of interactivity and commercial nature of the exchange of information that occurs on the Web site.Zippo, 952 F, Supp. at 1124 (internal citations omitted). In any case, “the mere operation of a commercially interactive web site should not subject the operator to jurisdiction anywhere in the world.” Toys “R" Us, Inc. v. Step Two, S.A., 318 F.3d 446, 454 (3d Cir. 2003). “Rather, there must be evidence that the defendant ‘purposefully availed' itself of conducting activity in the forum state, by directly targeting its web site to the state, knowingly interacting with residents of the forum state via its web site, or through sufficient other related contacts.” Id.
“A court has discretion to allow discovery when considering a motion to dismiss for lack of personal jurisdiction.” Streamlight, Inc. v. ADT Tools, Inc., No. Civ.A. 03-1481, 2003 WL 22594316, at *4 (E.D. Pa. Oct. 9, 2003) (citing Mass. Sch. of L. at Andover, Inc. v. Am. Bar Ass'n, 107 F.3d 1026,1042 (3d Cir. 1997); Renner v. Lanard Toys Ltd, 33 F.3d 277,283 (3d Cir. 1994)). The rule of the Third Circuit Court of Appeals “is generally that jurisdictional discovery should be allowed unless the plaintiffs claim is clearly frivolous.” Mass. Sch. of L., 107 F.3d at 1042 (internal quotation marks omitted). “If a plaintiff presents factual allegations that suggest ‘with reasonable particularity' the possible existence of the requisite ‘contacts between [the defendant] and the forum state,' the plaintiff s right to conduct jurisdictional discovery should be sustained.” Toys “R ” Us, 318 F.3d at 456 (quoting Mellon Bank, 960 F.2d at 1223). Where this threshold has been met, courts “have sustained the right to conduct discovery before the district court dismisses for lack of personal jurisdiction.” Id. (collecting cases). !
Here, Ms. Vonbergen has satisfied the first two prongs of the Calder effects test, and the Court will allow a period of jurisdictional discovery regarding the third prong. First, she has alleged that Liberty Mutual committed an intentional tort-intentionally invading her reasonable expectation of privacy by intercepting her electronic communications using session replay software in violation of the Pennsylvania Wiretap Act. Second, Ms. Vonbergen has pled that she felt the brunt of the harm in Pennsylvania because she was located in Pennsylvania when Liberty Mutual allegedly invaded her privacy and intercepted her electronic communications. However, the parties disagree as to whether Ms. Vonbergen has established that Liberty Mutual expressly aimed its conduct at Pennsylvania.
Liberty Mutual argues Ms. Vonbergen fails to show that Liberty Mutual's use of session replay software, which gives rise to Ms. Vonbergen's alleged injury, was expressly aimed at Pennsylvania. Although Ms. Vonbergen has pled that Liberty Mutual marketed and sold insurance products aimed at and tailored to the Commonwealth of Pennsylvania, Liberty Mutual argues that its alleged marketing and selling of insurance products and services in Pennsylvania is irrelevant to [Ms. Vonbergen's] claim, which is premised solely on website-monitoring activity.” Liberty Mutual therefore argues that Ms. Vonbergen's allegations are conclusory and insufficient as a matter of law. See Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007).
On the other hand, Ms. Vonbergen argues that she has established Liberty Mutual expressly aimed its conduct at Pennsylvania because Liberty Mutual targeted aspects of its website at consumers in Pennsylvania-including the Pennsylvania-specific auto-insurance form Ms. Vonbergen filled out. Liberty Mutual also intentionally implemented software that it knew, or should have known, would gather the electronic communications of Pennsylvania residents, including the information Pennsylvania residents inputted into the Pennsylvania-specific auto insurance form. Thus, she asserts that Liberty Mutual knowingly aimed its tortious conduct at Pennsylvania, satisfying the third prong of the Calder effects test. See, e.g., YD. v. Hytto Ltd., No. 18-CV-688, 2019 WL 8333519, at *4 (N.D. Cal. May 15,2019) (finding that the “express aiming” requirement was satisfied where the defendant was “aware of its significant American customer i base” and by intercepting electronic transmissions, the defendant “targeted its wrongfill conduct at customers, some of whom [the defendant] knew, at least constructively, were residents of the U.S.”). Ms. Vonbergen protests that Liberty Mutual's “argument seems to rest on the assertion that since its tortious conduct was additionally aimed at other states, [Liberty Mutual] is exempt from jurisdiction over its Pennsylvania targeted conduct,” In other words, she argues that the third prong of the Calder Effects Test is indifferent to the fact that, in addition to targeting Pennsylvania, Liberty Mutual has also aimed its tortious conduct elsewhere, 1, Express Aiming
Liberty Mutual's allegedly tortious conduct is using session replay software to intercept Ms. Vonbergen's and the Proposed Class's browsing activities and personally identifiable information on Liberty Mutual's website. Thus, Ms. Vonbergen must allege that Liberty Mutual expressly aimed its use of session replay software at Pennsylvania for the Court to find that the exercise of jurisdiction is proper under the Calder effects test. See IMO Indus., 155 F.3d at 266 (enumerating third prong of Calder effects test that “defendant expressly aimed his tortious conduct at the forum such that the forum can be said to be the focal point of the tortious activity”).
Ms. Vonbergen has certainly pled that Liberty Mutual expressly aimed its website at Pennsylvania by furnishing Pennsylvania-specific forms that ask Pennsylvania-specific questions in order to obtain Pennsylvania-specific insurance from Liberty Mutual. This is not a case where Liberty Mutual simply operates a nationally accessible, interactive website that does not aim at any particular forum. Cf. Toys "R ” Us, Inc., 318 F.3d at 454 (3d Cir. 2003) (“the mere operation of a commercially interactive website should not subject the operator to jurisdiction anywhere in the world”). By way of illustration, such an aimless website was at issue in Jones v. Papa John's, where the Missouri district court observed, “[n]othing in the record suggests Papa John's ‘directed' its website and app at Missouri any more than any other state.” Jones v. Papa John's International, Inc., No. 4:23-cv-00023-SRC, 2023 WL 7155562, at *7 (E.D. Mo. Oct. 31, 2023) Although Missourians, Pennsylvanians, and Coloradoans might all access the same Papa John's website to get a pizza to their front doors, see Jones, 2023 WL 7155562, at *5, those same Missourians, Pennsylvanians, and Coloradoans each access distinct forms, answer distinct questions, and navigate distinct webpages to buy auto insurance that is appropriate in their respective states from Liberty Mutual. In Ms. Vonbergen's case, she was required to disclose her zip code, name, birthday, address, length of residency at that address, email, license plate number or VIN, vehicle ownership status, commuting practices to and from New York and New Jersey, vehicle storage practices, timing of vehicle purchase, marital status, gender identity, age at which she obtained her driver's license, phone number, insurance coverage information, employment status, educational attainment, and home ownership status. It follows that the interception of this Pennsylvania-specific information may have harmed Ms. Vonbergen's and the Proposed Class's privacy rights in a Pennsylvania-specific manner.
On the Zippo sliding scale, Liberty Mutual's website falls on the “active” end, which supports jurisdiction, because Liberty Mutual “clearly does business over the internet and enters into contracts with residents of [Pennsylvania] that involve the knowing and repeated transmission of computer files over the Internet.” 952 F.Supp. at 1124. On the other hand, the existence of an interactive website alone is insufficient for jurisdiction. Toys "R" Us, 318 F.3d at 454; see also Massie v Gen. Motors Co., No. 20-cv-1560, 2021 WL 2142728, at *4, *6 (E.D. Cal. May 26, 2021) (“[T]he Court finds there is no specific personal jurisdiction here” because “a passive website, which ‘lacks file exchange through [the] website or interactive features targeting California customers' . . . do[es] not establish personal jurisdiction.”). Thus, Zippo helps Ms. Vonbergen establish the Court's personal jurisdiction over Liberty Mutual, but it is insufficient to conclusively establish that jurisdiction.
Ms, Vonbergen further avers that the session replay software on Liberty Mutual's website intercepted the information she and the Proposed Class Members inputted into the Pennsylvania- specific auto insurance form. Liberty Mutual may have expressly aimed its use of the session replay software at Pennsylvania by specifically targeting the auto-insurance form at Pennsylvania and intercepting the information inputted into this form using session replay software. Cf Massie, 2021 WL 2142728, at *4 (“There is no evidence of file exchange through GM's website or interactive features targeting California customers”) (emphasis added).
Though the Court cannot presently conclude that Ms. Vonbergen has established Liberty Mutual's targeting of Pennsylvania with session replay software, it can find that Ms. Vonbergen's jurisdictional allegations are not “clearly frivolous,” Toys “R '' Us, 318 F.3d at 456 (quoting Mass. Sch. of I., 107 F.3d at 1042). Her allegations suggest “with reasonable particularity” the possibility that Liberty Mutual expressly aimed its allegedly tortious conduct at Pennsylvania by both (1) eliciting Pennsylvania-specific information from Ms. Vonbergen and (2) intercepting the communication of that information by employing session replay software. Id. (citing Mellon Bank, 960 F.2d at 1223), This renders a period of jurisdictional discovery on this issue of express aiming under the third prong of the Calder effects test appropriate, See id.
2. Knowledge
To establish the third prong of the Calder effects test, Ms. Vonbergen must also show that Liberty Mutual knew she “would suffer the brunt of the harm caused by the tortious conduct in the forumf.] IMO Indus., 155 F.3d at 266. Ms. Vonbergen cannot establish this knowledge requirement by merely alleging that Liberty Mutual: (1) “knowingly and intentionally procured undisclosed third parties to intercept” the communications of the Proposed Class Members and (2)“knew or should have known that it was causing harm to [the Proposed Class Members] while they were in Pennsylvania such that it was foreseeable to [Liberty Mutual] that its interceptions would harm [Ms. Vonbergen] and other similarly-situated individuals located in Pennsylvania.” These allegations come close to being conclusory, “threadbare recitals” of the elements of the Calder effects test. See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Twombly, 550 U.S. At 555). However, Ms. Vonbergen has also plausibly alleged that Liberty Mutual both knowingly aimed its website at Pennsylvanians and knowingly used allegedly tortious software on that website. The Court is not convinced that these two allegations against Liberty Mutual are analytically distinct. If they are analytically distinct, and Liberty Mutual's use of session replay software is completely unrelated to its targeting of Pennsylvania, then the Court may not have personal jurisdiction over Liberty Mutual. However, the Court is cognizant of Ms. Vonbergen's argument that such a rigid distinction vitiates this Court's personal jurisdiction over Liberty Mutual merely because its allegedly “tortious conduct was additionally aimed at other states[.]” Thus, the Court will allow a limited period of jurisdictional discovery regarding whether Liberty Mutual knew that its use of session replay software would be directed at the same Pennsylvanians that it targeted by means of its website.
Ms. Vonbergen's allegations, at this stage, are insufficient to establish “with reasonable particularity” that Liberty Mutual knew that Ms. Vonbergen would suffer the brunt of its tortious conduct in Pennsylvania. However, her jurisdictional allegations are not “clearly frivolous.” Toys “R” Us, 318 F.3d at 456 (quoting Massachusetts School of Law, 107 F.3d at 1042), Ms. Vonbergen's allegations establish with “reasonable particularity” that Liberty Mutual both knowingly aimed its website at Pennsylvania and knowingly aimed session replay software at that website. Id. (quoting Mellon Bank, 960 F.2d at 1223), This renders a period of jurisdictional discovery on the issue of knowledge under prong three of the Calder effects test appropriate. Id.
3. Jurisdictional Discovery
Based on her current pleading, Ms, Vonbergen has alleged “the possible existence of the requisite contacts” between Liberty Mutual and the forum state of Pennsylvania. Id. (internal citation omitted). Ms. Vonbergen's allegations demonstrate that Liberty Mutual expressly aimed its website at Pennsylvania and suggest the possibility that Liberty Mutual knew the brunt of the harm would be suffered in Pennsylvania. Ms. Vonbergen's claim is not “clearly frivolous.” Massachusetts School of Law, 107 F.3d at 1042. Accordingly, Ms, Vonbergen will be afforded the opportunity to engage in a limited period of jurisdictional discovery.
The Court denies without prejudice Liberty Mutual's motion to dismiss under Rule 12(b)(2) for lack of personal jurisdiction, A limited period of jurisdictional discovery is warranted.
II. Motion to Dismiss Under Rule 12(b)(6) for Failure to State a Claim
Liberty Mutual argues that even if the Court has personal jurisdiction, it should dismiss the amended complaint under Federal Rule of Civil Procedure 12(b)(6) because the alleged conduct does not violate the Pennsylvania Wiretap Act.
An action may be dismissed if it “fail[s] to state a claim upon which relief can be granted.” Fed.R.Civ.P. 12(b)(6). At the motion to dismiss stage, the Court must accept factual allegations as true, but it is not compelled to accept unsupported conclusions and unwarranted inferences, or a legal conclusion couched as a factual allegation.” Baraka v. McGreevey, 481 F.3d 187, 195 (3d Cir. 2007) (internal citations and quotation marks omitted). “To survive a motion to dismiss, a complaint must contain sufficient factual matter ... to state a claim to relief that is plausible on its face.” Iqbal, 556 U.S. at 678 (internal quotation marks omitted). A claim is facially plausible when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id.
Pennsylvania s Wiretap Act prohibits the (1) intentional interception, or procurement of another to intercept, any wire, electronic, or oral communication; (2) intentional disclosure of “the contents of any wire, electronic or oral communication, or evidence derived therefrom, knowing or having reason to know that the information was obtained through the interception of a wire, electronic or oral communication;” and (3) intentional use of “the contents of any wire, electronic or oral communication, or evidence derived therefrom, knowing or having reason to know, that the information was obtained through the interception of a wire, electronic or oral communication.” 18 Pa. Cons. Stat. § 5703. “Any person whose wire, electronic, or oral communication is intercepted, disclosed, or used in violation of this chapter shall have a civil cause of action against any person who intercepts, discloses or uses or procures any other person to intercept, disclose or use, such communication.” Id. § 5725(a).
“Intercept” is defined by the relevant statute as any “[a]ural or other acquisition of the contents of any wire, electronic or oral communication through the use of any electronic, mechanical or other device.” Id. § 5702; see also Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121, 126 (3d Cii, 2022) (The [Pennsylvania Wiretap Act's] use of‘ intercept' thus reduces to acquiring certain communications using a device.”). “Contents,” “[a]s used with respect to any wire, electronic or oral communication, is any information concerning the substance, purport, or meaning of that communication.” 18 Pa. Cons. Stat. § 5702. “Electronic communication” is defined as “[a]ny transfer of signs, signals, writing, images, sounds, data or intelligence of any nature transmitted in whole or in part by a wire . . . except [a]ny communication from a tracking device.” Id. “Electronic, mechanical or other device” is defined as “[a]ny device or apparatus, including, but not limited to, an induction coil or a telecommunication identification interception device, that can be used to intercept a wire, electronic or oral communication.” Id. “Tracking device” is defined as “[a]n electronic or mechanical device which permits only the tracking of the movement of a person or object.” Id.
Although “acquisition” is not defined in Pennsylvania's Wiretap Act, the Third Circuit Court of Appeals has concluded that based on the word's “common and approved usage,” “acquisition means the act of acquiring!,] [a]nd acquire, in turn, means to come into possession or control of, or to gain [or] obtain ” Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121, 130 (3d Cir. 2022) (internal citations and quotations omitted). “The result is that an interception occurs where there is an act taken to gain possession of communications using a device.” Id., So, “[e]lectronic communications are .. . ‘intercepted' when software reroutes communications to an interceptor.” Id.
A. Session replay software is a “device” under the Pennsylvania Wiretap Act.
The Pennsylvania Wiretap Act broadly defines an electronic or medical device as “any device or apparatus . . . that can be used to intercept a wire, electronic or oral communication.” Id., (emphasis added). The word “any” clearly indicates an inclusive understanding of whatever follows. See Popa v. Harriet Carter Gifts, Inc., 426 F.Supp.3d 108, 117 (W.D. Pa. 2019) (explaining that “any” in front of “device or apparatus” indicates the reference to devices or' apparatuses is “without distinction or limitation”) (citing Any, Oxford English Dictionary (3d ed. 2016)). Notwithstanding this apparent inclusivity, Liberty Mutual invites the Court to find that software, including session replay software, cannot constitute a “device” under the Pennsylvania Wiretap Act as a matter of law. The Court declines the invitation.
Liberty Mutual appears to argue for an implicit “tangibility” requirement in the Pennsylvania Wiretap Act's definition of “device.” Apparently in furtherance of that argument, Liberty Mutual directs the Court to Ideal Aerosmith, Inc. v Acutronic USA, Inc., No. 07-1029, 2007 WL 4394447 (E.D. Pa. 2007), where the court found that the “drive or server on which an e-mail is received does not constitute a device” under the Pennsylvania Wiretap Act. Ideal Aerosmith, 2007 WL 4394447, at *4. However, the Ideal Aerosmith court merely concluded that no “interception” takes place when an email is sent to a server; “tangibility” is not a factor in its analysis at all. See id. at *4-5. Although Ideal Aerosmith summarily cites Crowley for the proposition that an email server does not constitute a device under the Pennsylvania Wiretap Act, id. at *4 (citing Crowley v. Cybersource Corp., 166 F.Supp.2d 1263, 1269 (N.D. Cal. 2001)), this conclusion alone does not support a “tangibility” requirement for “devices” implicit in the Pennsylvania Wiretap Act. Thus, the Court declines to find a “tangibility” requirement for devices under the Pennsylvania Wiretap Act.
Ideal Aerosmith instead focused on the fact that the defendant, as owner of an email server, was “a direct party to the communication” and therefore no “interception” under the Pennsylvania Wiretap Act took place. Id. at *5 (citing Crowley, 166 F.Supp.2d at 1269 (“[Defendant] acted as no more than the second party to a communication”)). But the present case is not about email servers. Ms. Vonbergen never sent an email to Liberty Mutual. She has instead alleged that session replay software used by Liberty Mutual intercepted her electronic communications and transferred those communications to “outside vendors),” who were allegedly not parties to Ms. Vonbergen's communications with Liberty Mutual on its website. Given the distinct fact pattern here, the Court cannot rely on Ideal Aerosmith to find as a matter of law that session replay software is excluded from the broad, inclusive category of “devices” under the Pennsylvania Wiretap Act. i
This conclusion agrees with many courts that have considered the matter. Focusing on one contrary jurisdiction, Liberty Mutual cites a Florida state court for the proposition that “other courts have held that software, email servers, and drives [do] not constitute devices under the wiretapping statutes.” Jacome v Spirit Airlines, Inc., No. 2021-000947-CA-01, 2021 WL 3087860, at *5 (Fla. Cir. Ct. June 17,2021). However, a closer look at these “other courts” reveals the superfluity of that court's “device” analysis. The Florida court chiefly cites Potter v. Havlicek, No. 3.06-CV-211, 2008 WL 2556723 (S.D. Ohio June 23, 2008), which did not cite a single legal authority directly supporting its conclusory analysis of dueling dictionary definitions of “device.” See Potter, 2008 WL 2556723, at *8-9; see also United States v Hutchins, 361 F.Supp.3d 779, 794 (E.D. Wis. 2019) (“The Havlicek court did not cite any cases directly in support of its conclusion, and this Court finds its definitional logic faulty[.]”). The Florida court further relied on Ideal Aerosmith, Crowley, and one other District of Maryland case which also dealt with the i email-server fact pattern discussed and distinguished above. See Jacome, 2021 WL 3087860, at *5 (citing Ideal Aerosmith, 2007 WL 4394447, at *4; Crowley, 166 F.Supp.2d at 1269; and Ultimate Outdoor Movies, LLC v. FunFlicks, LLC, No. CV SAG-18-2315, 2019 WL 2233535, at *21 (D. Md. May 23, 2019) (finding email servers not to constitute a “device”)).
By contrast, many courts to have considered the issue agree that software can constitute a “device” under the Pennsylvania Wiretap Act and similar anti-wiretapping statutes. See Hutchins, 361 F.Supp.3d at 795 (collecting cases); see, e.g., Commonwealth v Smith, 136 A.3d 170, 178' (Pa. Super. Ct. 2016) (finding smartphone “voice memo” app to constitute a “device” under Pennsylvania Wiretap Act); see also United States v. Barrington, 648 F.3d 1178, 1203 (11th Cir. 2011) (“Conceivably, the . . . software at issue here could be . . . within the definition of... ‘a device or apparatus' ” under the federal anti-wiretapping statute); Makkinje v. Extra Space Storage, Inc., No. 8:21-cv-2234-WFJ-SPF, 2022 WL 80437, at *2 (M.D. Fla. Jan. 7, 2022) (finding at motion to dismiss stage that determinations whether session replay software constitutes “device” and violates Florida's anti-wiretapping statute were “more appropriately addressed at the summary judgment stage”). Given the early stage of these proceedings, this Court will wait to determine whether session replay software constitutes a device under the Pennsylvania Wiretap Act on a 5 more fulsome record.
Thus, the Court finds that Ms. Vonbergen has sufficiently alleged that session replay software is a “device” under the Pennsylvania Wiretap Act to survive Liberty Mutual's motion to dismiss.
B. Ms. Vonbergen's “browsing activity”
Liberty Mutual advances two arguments for the dismissal of Ms, Vonbergen's claims insofar as they are based on the alleged interception of what Liberty Mutual terms her “browsing activity,” Under the heading of “browsing activity,” Liberty Mutual refers to Ms. Vonbergen's allegations relating to the interception of “mouse clicks and movements, keystrokes, search terms, . . . pages and content viewed by Plaintiff, scroll movements, and copy and paste actions.”
Liberty Mutual first argues that this “browsing activity” does not constitute the “contents” of a communication protected under the Pennsylvania Wiretap Act. However, at this early juncture, the Court is reluctant to find, as a matter of law, that Liberty Mutual's alleged interception of Ms. Vonbergen's “browsing activities” could not constitute a violation of the Pennsylvania Wiretap Act. Liberty Mutual's argument-that Ms. Vonbergen's allegedly intercepted “browsing activities” lack the “contents” that are the hallmark of illegal “interceptions” under the act-may i or may not be borne out after discovery. Thus, the Court declines to dismiss Ms. Vonbergen's claims based on interceptions of her “browsing activities.”
The Court recognizes that some courts in other jurisdictions have dismissed wiretapping claims based on the interception of digital matter that may turn out to be analogous to Ms. Vonbergen's “browsing activities.” See, e.g., In re Zynga Privacy Litigation, 750 F.3d 1098,1102 08 (9th Cir. 2014) (affirming dismissal of federal wiretapping claims for transmission of “referer information”-i.e. the page being viewed when a particular link was clicked and the Facebook name of the clicker-insofar as that information was not the “contents” of a communication); Goldstein v. Costco Wholesale Corp., 559 F.Supp.3d 1318, 1321 (S.D. Fla. 2021) (analogizing Defendant's tracking of user movement on website to “information Defendant could have obtained through a security camera at a brick-and-mortar store”). However, discovery is necessary to evaluate those analogies. For example, Ms. Vonbergen has alleged that Liberty Mutual intercepted, among other things, what Ms. Vonbergen searched for on Liberty Mutual's website. The Court cannot conclude as a matter of law that intercepting the object of Ms. Vonbergen's search through I her browsing activity is necessarily the same as intercepting a patron's movements through a brick- i and-mortar store while they search for some undisclosed object.
Seveial courts in the Third Circuit have also declined to dismiss analogous wiretapping claims at this early juncture. See, e.g., Popa v. Harriet Carter Gifts, Inc., 426 F.Supp.3d 108, 119 (W.D, Pa. 2019) (declining to decide at Rule 12 stage whether plaintiffs clicks and keystrokes constituted content because “[t]he Court [would] be better equipped to do so after a record is developed that places the alleged conduct of Defendants into context vis-a-vis the nature of ‘content' for a claim under [the Pennsylvania Wiretap Act]”); Byrd v. Aaron's, Inc., 14 F.Supp.3d 667, 675 (W.D. Pa. 2014) (“Whether an actual interception of an electronic communication took place will be born[e] out through discovery, and [Defendant] is free to raise these arguments again on a more developed record, as a motion for summary judgment”); see also Worrell v. Harshe, No. 16-2398, 2017 WL 1398650, at *2 (D.N.J. Apr. 18, 2017) (declining to dismiss federal wiretapping claim because “Plaintiffs have not yet had the benefit of discovery to know exactly what Defendant did, or did not, do with regard to Plaintiffs email accounts and the transmission and interception of electronic communications”). Mindful that, at this stage, Ms. Vonbergen need only plead a claim for relief that is “plausible on its face,” Iqbal, 556 U.S. at 678, the Court declines to find that Ms. Vonbergen's “browsing activities” lack “contents” sufficient to make out a claim at this early juncture, Liberty Mutual's second argument is that Ms. Vonbergen's “browsing activities” do not constitute “electronic communications” under the Pennsylvania Wiretap Act, so their alleged interception could not violate the act's prohibition against intercepting “electronic communications.” 18 Pa. Cons, Stat. § 5703 (prohibiting the interception of “any wire, electronic or oral communication), To make this argument, Liberty Mutual relies upon on an express exception contained within the Pennsylvania Wiretap Act's definition of “electronic communications” for “tracking devices.” 18 Pa. Cons. Stat. § 5702. The act defines a “tracking device” as “[a]n electronic or mechanical device which permits only the tracking of the movement of a person or object.” Id. According to Liberty Mutual, because Ms. Vonbergen's “browsing activities relate solely to [her] virtual online movement,” they constitute a mere “tracking device” and not communications.
The Court finds that the plain language of the Pennsylvania statute does not bear this restrictive interpretation. Specifically, the definition of a “tracking device” is expressly limited to devices that permit “only the tracking of the movement of a person or object.” 18 Pa. Cons. Stat. § 5702 (emphasis added). The Court cannot conclude as a matter of law that “mouse clicks and movements, keystrokes, search terms,... pages and content viewed by Plaintiff] scroll movements, and copy and paste actions exclusively track an individual's movements. For example, mouse clicks and movements could communicate preferences among presented options; keystrokes and search terms could communicate objects of the user's curiosity; pages and content scrolled through could communicate the depth of a user's interest; and copy and paste actions could communicate substantive information about a user's life or their browsing history on other websites. Liberty Mutual's reliance on Florida cases interpreting Florida's anti-wiretapping statute, which excludes the word “only” in its coordinate “tracking device” provision, is misplaced. Mot. to Dismiss (Doc. No. 23), at 18 (citing Jacome, 2021 WL 3087860, at *3; Goldstein, 559 F.Supp.3d at 1321); Fla. Stat. § 934.02(12)(c) (excluding “[a]ny communication from an electronic or mechanical device which permits the tracking of the movement of a person or an object” from Florida's definition of “electronic communication”). The Court therefore declines to find as a matter of law at tins early juncture that Ms. Vonbergen's “browsing activities” fall under the “tracking device” exception to the category of “electronic communications” under the Pennsylvania Wiretap Act.
Thus, the motion to dismiss Ms. Vonbergen's claims under Rule 12(b)(6) insofar as they relate to her “browsing activities” is denied.
C. Consent
In addition to intercepting her “browsing activities,” Ms. Vonbergen has alleged that Liberty Mutual unlawfully intercepted “information and PII inputted into the website.” Liberty Mutual argues that by entering her personal information into its website, Ms. Vonbergen consented to Liberty Mutual recording that information. The Court declines to find at this early juncture that the act of entering personal information into Liberty Mutual's website necessarily implies Ms. Vonbergen consented to the recording of that information by a third party.
The Pennsylvania Wiretap Act contains an exception to its prohibition on the interception of electronic communications “where all parties to the communication have given prior consent to such interception.” 18 Pa. Cons. Stat. § 5704(4). The Court of Appeals for the Third Circuit has recently observed that “prior consent” in this context does not require all parties to the communication to have “actual knowledge” of the interception. Popa, 52 F.4th at 132, Instead, prior consent “can be demonstrated when the person being recorded knew or should have known[] that the conversation was being recorded.” Id., (quoting Commonwealth v. Byrd, 235 A.3d 311, 319 (Pa. 2020)). i
Liberty Mutual attempts to demonstrate Ms, Vonbergen's prior consent by arguing that any reasonable person would know that [Liberty Mutual] would store the information that [Ms. Vonbergen] submitted via an online auto insurance form.” This argument is compelling with respect to two of the relevant parties: Liberty Mutual and Ms. Vonbergen. However, Ms.Vonbergen has alleged that Liberty Mutual procured third parties to intercept her electronic communications, and the Court is reluctant to find that any reasonable person entering his or her information into an online form implicitly consents to its interception by a third party. The express language of the Pennsylvania Wiretap Act provides a cause of action against one who “procures any other person to intercept” an electronic communication. 18 Pa. Cons. Stat. § 5725(a). Significantly, Ms. Vonbergen has pled that she “was not presented with any type of pop-up disclosure or consent form alerting [her] that her visit to the website was being recorded by [Liberty Mutual] through a third party.” Though Liberty Mutual may have consented to the alleged third-party interception of Ms, Vonbergen's information, the Pennsylvania Wiretap Act “requires all parties-not just a party-to consent to that interception.” Popa, 52 F.4th at 133 (original emphasis). Ms. Vonbergen has sufficiently pled that she did not consent to third-party session i replay software providers' interception of her communications.
Liberty Mutual cites a trio of Pennsylvania criminal cases in support of its consent argument, each of which is distinguishable from the present case. In Byrd, a jailhouse telephone system expressly alerted a detained defendant that his call with a visitor was “being processed” and “may be monitored or recorded.” Byrd, 235 A.3d at 313. The Pennsylvania Supreme Court found that the defendant and visitor mutually consented to the interception of their communication by proceeding to speak after these warnings. Id. at 320, By contrast, Ms. Vonbergen has pled that Liberty Mutual's website presented no warning at all, so Byrd's consent analysis is inapposite.
The other two cases relied upon by Liberty Mutual for its consent analysis concern police officers impersonating the intended recipients of electronic messages. In Proetto, a police officer j impersonated a 15-year-old girl in an online chatroom, and the defendant asked “her” for a nude video. Commonwealth v. Proetto, 771 A.2d 823, 827 (Pa. Super. Ct. 2008). In Cruttenden, a police officer impersonated a drug dealer in text messages to a drug purchaser, and the purchaser j designated a rendezvous for the transaction. Commonwealth v. Cruttenden, 58 A.3d 95, 96 (Pa. 2012). The Pennsylvania Wiretap Act was violated in neither case because, as the Pennsylvania Supreme Court explained, “[t]hat a police officer . . . misrepresents his or her identity[] does not change the fact that he or she is a direct party to the conversation, and by virtue of being a direct party ... is deemed the intended recipient of the conversation under whatever identity the officer has set forth.” Id. at 100 (explaining the holding of Proetto). By electronically communicating with a direct party, both defendants consented to the recording of those communications. Id.; Proetto, 771 A.2d at 829 (“Any reasonably intelligent person, savvy enough to be using the Internet. . . would be aware of the fact that messages are received in a recorded format. ., and can be downloaded or printed by the party receiving the message”). However, the present case is not, like Proetto and Cruttenden, one of mistaken identity. The chat in Proetto and the text messages in Cruttenden were both between two people-the respective defendants and police officers-but Ms. Vonbergen's electronic communication was allegedly between at least three entities-Ms. Vonbergen, Liberty Mutual, and the third-party session replay software provider(s) that Liberty Mutual allegedly procured but did not disclose to Ms. Vonbergen. Though Ms. Vonbergen may have consented to Liberty Mutual recording her personal information inputted into the website, she has plausibly alleged that she was not aware Liberty Mutual had procured an undisclosed third party to intercept that information too.
Finally, Liberty Mutual urges this Court to follow the district courts in California, which have found that website operators are not liable under the California Invasion of Privacy Act when they procure third-party session replay software because those third parties are mere extensions of i the website operator. However, this proposed factual finding-namely that session replay software providers are mere extensions of Liberty Mutual- only serves to underscore the Court's impression that the issues raised by Liberty Mutual's motion to dismiss under Rule 12(b)(6) are inappropriate to settle as matters of law at this early juncture in the proceedings.
Conclusion
The Court denies Liberty Mutual's motion to dismiss and finds a period of jurisdictional discovery is warranted. An appropriate order follows.