BPS Direct LLC v.

── BPS Direct LLC v. ── Court: Court of Appeals for the Third Circuit Date: May 11, 2026 Category: General U.S. COURT OF APPEALS FOR THE THIRD CIRCUIT No. 23-3235 IN RE: BPS DIRECT, LLC; CABELA’S, LLC WIRETAPPING LITIGATION BRIAN CALVERT; HEATHER CORNELL; TIMOTHY DURHAM; MARILYN HERNANDEZ; GREG MOORE, JR.; ET AL., Appellants _____________________________ Appeal from the U.S. District Court, E.D. Pa. Judge Mark A. Kearney, Nos. 2:23-md-03074, 2:22-cv-04709, 2:23-cv-02282, 2:23-cv-02287, 2:23-cv-02293, 2:23-cv-02294, 2:23-cv- 02295, 2:23-cv-02306, 2:23-cv-02338 & 2:23-cv-04008 Before: HARDIMAN, KRAUSE, and FREEMAN, Circuit Judges Argued Sep. 10, 2025; Decided May 11, 2026 _____________________________ OPINION OF THE COURT FREEMAN, Circuit Judge. Outdoor products retailers Bass Pro Shops and Cabela’s (collectively, “BPS”) use a JavaScript computer code known as “Session Replay Code” on their websites. The Session Replay Code captures and stores users’ interactions on the websites, including mouse movements, text entries, and clicks. In a putative class action, eight named plaintiffs claimed that BPS’s use of Session Replay Code without their consent violated various state and federal privacy laws. The District Court dismissed the complaint for lack of Article III standing. The plaintiffs allege intangible injuries, so to demonstrate standing they must assert injuries that have a “close relationship” to a harm traditionally recognized at common law. TransUnion LLC v. Ramirez, 594 U.S. 413, 417 (2021) (quoting Spokeo, Inc. v. Robins, 578 U.S. 330, 340–41 (2016)). Because two plaintiffs have done so, we will REVERSE the dismissal order as to them and REMAND for further proceedings. The District Court properly dismissed the claims of the remaining six plaintiffs. But dismissals for lack of standing should be without prejudice, so we will MODIFY the order to make it a dismissal without prejudice as to those plaintiffs, and we will AFFIRM that part of the order as modified. I1 BPS procures Session Replay Code developed by various third-party Session Replay Code providers (“Providers”), such as Microsoft, Quantum Metric, and Mouseflow. BPS embeds that code on its retail websites: www.basspro.com and www.cabelas.com. The code activates anytime a user visits one of these websites, allowing it to surreptitiously intercept nearly every action a user takes on the site, including “all mouse movements, clicks, scrolls, zooms, window resizes, keystrokes, [and] text entries.” App. 88. The Session Replay Code intercepts this data with hyper-frequency, in intervals just milliseconds apart. Thus, it captures inputs that a user types into text fields even if the user does not click “submit” or “enter” on the website. BPS and the Providers can then use the data captured by the Session Replay Code to create “video replay[s]” of website users’ visits to BPS’s websites. App. 69. Those video replays give BPS insights into the performance of its websites and its advertising campaigns. 1 We accept the facts alleged in the complaint as true and construe them in the light most favorable to the plaintiffs. Barclift v. Keystone Credit Servs., LLC, 93 F.4th 136, 141 (3d Cir. 2024). Although we also discussed Session Replay Code in our opinion in Cook v. GameStop, Inc., 148 F.4th 153 (3d Cir. 2025), our description of the technology here is based on the allegations in this case’s complaint. 2  The third-party Providers also store data collected from users of BPS’s websites on their own servers. These data include personally identifying information. The Providers can (and often do) aggregate and store users’ data under identifiers called “fingerprints.” “Fingerprints” are unique to a particular user’s combination of computer and browser settings and other detectable information.