On Christmas Eve 2024, the U.S. Court of Appeals for the Eighth Circuit released an opinion in Jones v. Bloomingdales.com, LLC, an important precedent at the evolving intersection of legal standing and digital privacy.1  In sum, the Eighth Circuit joined the vast majority of district courts that have concluded mere breezy allegations of privacy harm do not constitute concrete injuries required for Article III standing to sue in federal courts—notably characterizing such allegations as tantamount to “intangible reputational harm[s]” and reiterating that a “naked assertion of reputational harm, devoid of further factual enhancement, falls short of plausibly establishing injury.”2  In other words, the district court properly dismissed Jones’ case “not because . . . she experienced only a slight invasion of her privacy . . . but because her allegations do not plausibly suggest she suffered any such invasion at all.” 3

To fully appreciate the importance of the Eighth Circuit’s decision, consider its procedural posture:  Jones was a plaintiff in two cases, Bloomingdales.com and Jones v Papa Johns—each with virtually identical allegations, namely, that she filed her lawsuits after learning that two websites she had visited had permitted others to record her electronic communications with the sites.4  The cases are among an epidemic of privacy class actions filed in recent years, which allege invasions of privacy and violation of state wiretapping statutes in connection with companies’ use of “session-replay technology” that allegedly creates “unique ‘fingerprints’ of individual users using information obtained from a user’s visit to any website” monitored and processed by a session-replay provider.5  At bottom, Jones contended that the sites she visited had invaded her privacy, in violation of Missouri law and federal wiretap statutes.6

Taking a step back, the district court in Bloomingdales.com initially dismissed Jones’ complaint—but did so for reasons that were not “offered” by Bloomingdales in the district court proceedings.  Rather, the district court took notice of the reasoning of a sister court in Adams v. PSP, LLC, 691 F. Supp. 3d 1031 (E.D. Mo. 2023), a different case involving session-replay technology, adopted its reasoning, and dismissed the case for lack of standing under Article III.  Similarly, in Papa John’s the defendant had not challenged the plaintiff’s standing in the district court.

The Eighth Circuit had consolidated Adams, along with the Bloomingdales and Papa Johns appeals, had been consolidated for oral argument.7  However, shortly before oral argument, the appeals court stayed the Adams appeal due to the filing of a bankruptcy petition by its corporate parent.  The defendant in Adams had similarly argued that while it is conceivable that some privacy allegations might rise to the level of an injury—and even a concrete injury—the invasion of privacy claims failed because Missouri law required “the existence of a secret and private subject matter” as an element of the tort.8  The Adams defendant further argued for dismissal on the grounds that no expectation of privacy arose in the context of mere observation of a customer’s digital information—either by the recipient of intentional communications or by service providers aiding them in the operation of their websites.  The Eighth Circuit adopted the Adams district court opinion’s reasoning on standing—and, in the process, joined “the overwhelming number of district courts to hold that plaintiffs lack standing in cases like these where they don’t allege the interception of private information.”9

Like many of the plaintiffs in these actions, Jones argued that the information she provided voluntarily to the websites she visits has value.  The Eighth Circuit did not disagree that companies might value the information gathered by the technology used on their websites.  The panel, however, concluded that it could not reasonably infer from the facts alleged how a company’s receipt of this information could invade Jones’ privacy—particularly where she had voluntarily conveyed it and there was no suggestion that the technology “capture[d]” data of a particularly sensitive nature or her personally identifying information.10

The district court in Adams and the consolidated appeals had bluntly concluded that merely alleging an invasion of privacy did not satisfy Article III’s standing requirements.  The Eight Circuit’s decision is more textured.  Observing that “[f]ederal courts are not much concerned with labels and unsupported characterizations,” the panel held that even though Jones alleged her privacy had been invaded, the court was unpersuaded that “her allegations plausibly show that is the case.”11  This conclusion—that Jones’ allegations, in context, were implausible to establish Article III standing—was in keeping with the court’s own precedents and the Supreme Court’s seminal TransUnion decision.12  The panel makes the core observation that standing involves a fundamental question about who may access the federal courthouse—in the words of Justice Scalia, “to have standing, a plaintiff must be able to give a good answer to the question, ‘what’s it to you?’”  In holding that no privacy injury exists simply because one blithely labels their claim as a privacy injury, based on the allegations presented, the Eighth Circuit wisely answered, “nothing.”

In the end, not all circuits may agree.  The Ninth Circuit, for instance, is hearing oral argument in another session-replay class action today (January 16), Popa v. PSP Group LLC and Microsoft Corp.,13 where the district court dismissed for lack of standing.  The Supreme Court may soon be asked to answer whether the mere utterance of the words “invasion of privacy” requires a reflexive conclusion that standing exists.  The Court’s ruling in TransUnion is abundantly clear:  it does not.  That issue may well carry the day in the final calculus.  In the meantime, the Eighth Circuit’s straightforward decision in Jones serves as a helpful reminder.

Notes

  1. Jones v. Bloomindales.com, LLC, No. 23-3606 (8th Cir. Dec. 24, 2024).
  2. Id. at *6 (citing Auer v. TransUnion, LLC, 902 F.3d 873, 878 (8th Cir. 2018)).
  3. Id. at *7.
  4. Id. at *2–3.
  5. See, e.g., In re BPS Direct, LLC, 705 F. Supp. 3d 333, 356 (E.D. Pa. 2023); Jones v. Papa John’s Int’l, Inc., No. 4:23-cv-00023-SRC, 2023 U.S. Dist. LEXIS 195047, at *1 (E.D. Mo. Oct. 31, 2023); Hasson v. Fullstory, Inc., No. 2:22-cv-1246, 2023 U.S. Dist. LEXIS 127761, 2023 WL 4745961, at *2 (W.D. Pa. July 25, 2023); Saleh v. Nike, Inc., 562 F. Supp. 3d 503, 511 (C.D. Cal. 2021).
  6. Jones, No. 23-3606, at *3.
  7. See generally Adams v. PSP Grp., LLC, No. 4:22-CV-1210 (E.D. Mo. 2022).
  8. Jones, No. 23-3606, at *4-5 (quoting Ruzicka Elec. & Sons, Inc. v. Int’l Bd. of Elec. Workers, Local 1, 427 F.3d 511, 524 (8th Cir. 2005)).
  9. Id. at *6 (citing Arndt v. Gov’t Emps. Ins. Co., 2024 WL 4335644, at *5 (D. Md. Sept. 26, 2024) (collecting cases)).
  10. For example, Jones’ social security number, medical history, bank account figures, or  credit  card  information—or even more basic personal data like “her contact information or even her name.”  See id.
  11. Id. (emphasis added).
  12. See id. at *5-7.
  13. No. 24-14. WLF joined the Chamber of Commerce of the USA, NetChoice LLC, and the Interactive Advertising Bureau on an amicus curiae brief supporting the appellees.