As Varnum has previously reported, a surge of lawsuits and pre-suit demand letters has targeted companies that use routine analytics tools, such as session-replay scripts, pixels, and similar code, to understand how visitors interact with their websites. Plaintiffs typically allege violations of California privacy statutes and common-law torts, hoping the threat of costly discovery will produce a quick, nuisance-value settlement.
Recently, however, the 9th U.S. Circuit Court of Appeals dealt a significant blow to those tactics, ruling that ordinary web-tracking when standing alone, is neither sufficiently harmful nor “highly offensive” enough to support the statutory or tort-based claims based on website tracking.
In Popa v. Microsoft Corporation, Case No. 24-14, — F.4th –, 2025 WL 2448824 (9th Cir. 2025), the 9th Circuit made clear that the mere collection of website-interaction data does not, by itself, establish the “concrete harm” needed for Article III standing. The court also found that routine tracking falls well short of the “highly offensive” conduct required for claims such as intrusion-upon-seclusion or public disclosure of private facts. Instead, the Court likened monitoring user interactions to “a store clerk’s observing shoppers in order to identify aisles that are particularly popular or to spot problems that disrupt potential sales.”
Implications for Businesses
Popa gives companies that deploy session-replay, pixel, or similar tracking technologies on their websites another defense against demand letters and complaints alleging privacy violations. By holding that routine web-tracking does not, without more, rise to the “highly offensive” level required for either intrusion-upon-seclusion or public disclosure of private facts, the Court narrowed the field of viable claims available to plaintiffs.
Companies can now cite Popa at the pleading stage to seek dismissal of claims based solely on the passive collection of interaction data. The decision should disrupt the prevailing plaintiff strategy of threatening costly discovery to wring out nuisance-value settlements. Defendants can credibly argue that dismissal is appropriate before merits-based discovery begins, particularly when plaintiffs cannot allege the collection of embarrassing, invasive, or otherwise private information.
Varnum is experienced in handling online privacy and web-tracking litigation. If you receive a demand letter or lawsuit, contact your Varnum attorney, Varnum’s Data Privacy Practice Team, or Varnum’s Litigation Practice Team.
