Does a plaintiff’s use of a website constitute consent to a privacy policy linked in the website’s footer?  A Pennsylvania federal court answered yes in Popa v. Harriet Carter Gifts, Inc., 2025 WL 896938 (W.D. Pa. Mar. 24, 2025), granting summary judgment in favor of an online retailer (Harriet Carter Gifts) and its marketing partner (NaviStone) accused of collecting data about plaintiff’s website visit in violation of the Pennsylvania Wiretapping and Electronic Surveillance Control Act (“WESCA”).

Plaintiff Ashley Popa visited the Harriet Carter website to search for pet stairs.  According to plaintiff, Harriet Carter used NaviStone’s marketing service to track her shopping activity on the website for the purpose of delivering mail advertisements.  Plaintiff admitted that she did not review Harriet Carter’s privacy policy, which was linked in the website’s footer and disclosed that third parties, like NaviStone, may have access to information relating to consumers’ activities on the website.  Nevertheless, Popa sued Harriet Carter and NaviStone, alleging that they violated WESCA by collecting data about her shopping activity on the Harriet Carter website without consent.

In an earlier decision we reported on here, the Third Circuit had reversed the district court’s initial grant of summary judgment under the direct party exception, but it left open on remand the issue of consent.  Almost three years later, the district court has now granted summary judgment for the second time, this time holding that plaintiff “consented to NaviStone’s activities on the Harriet Carter website.”  “[M]indful of the reality of internet communication,” the district court explained that “a reasonably prudent person has a lower expectation of privacy on the internet.”  With that understanding, the district court concluded that the plaintiff was put “on inquiry notice” of the privacy policy disclosing the alleged conduct because the plaintiff, like “any other user, could have easily seen the [privacy policy] link” in the webpage’s footer when landing on the website “and understood exactly what it contained.”

In granting summary judgment, the district court rejected an argument commonly raised by plaintiffs in wiretapping suits: that the plaintiff’s data was collected “before she, or any reasonable user, had a chance to view the terms of the Privacy Statement.”  The problem with this argument, the district court explained, is that WESCA “only applies to ‘contents’ of communications,” and “[a]ccessing the Harriet Carter webpage, visiting the Privacy Statement, and then leaving the site does not lead to the interception of ‘content.’”  In other words, “[t]he mere fact that a user visits Harriet Carter’s website is not protected by WESCA any more than that of a caller who uses a phone to reach a number, and then hangs up after being warned of an interception and/or recording.”