Vedder is an international business-focused law firm serving sophisticated clients of all sizes and industries from offices across the U.S. and in the UK and Asia.

A Business Focused Law Firm With a Global Reach | Vedder

Faced with waves of consumer lawsuits targeting common website tools like browser cookies, tracking pixels, and live chat features, businesses are often frustrated by the outsized exposure posed by seemingly “no-injury” claims. (See, for example, last week’s post about CIPA claims.) The Ninth Circuit Court of Appeals recently provided some comfort by clarifying what a plaintiff must allege to show “concrete injury” as required for Article III standing. The court’s decision in Popa v. Microsoft Corp., No. 24-14, 2025 WL 2448824 (9th Cir. Aug. 26, 2025), strengthens defenses to online privacy claims—with broad application to other types of consumer claims as well—holding that standing requires more than just an alleged statutory violation.

contentpilot/introduction

The Ninth Circuit affirmed the district court’s dismissal of Ashley Popa’s putative class action against Microsoft Corporation and PSP Group LLC. Popa’s claims targeted a pet supply website operated by PSP Group that used Clarity, a session-replay product offered by Microsoft. Id at *2. The tool enables businesses to capture and analyze a website user’s mouse movements, clicks, keystrokes, and other browsing activities. Id at *1. Popa alleged that using this tool violated Pennsylvania’s Wiretapping and Electronic Surveillance Control Act and her privacy rights generally. Id at *2. After the case was transferred from the Western District of Pennsylvania to the Western District of Washington, the district court dismissed Popa’s claim for lack of standing, and she appealed. Id at *2-3.

core/paragraph

In affirming dismissal, the Ninth Circuit recapped how standing requirements have evolved through the Internet age. The court began by confirming the three required elements: (i) “concrete and particularized” injury in fact that is actual or imminent; (ii) causation; and (iii) a likelihood that the injury will be redressed by a favorable decision. Id. at *3 (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-561 (1992)).

The court then explained how the Supreme Court has made the “concrete injury” requirement “even more definite” in recent years. The court explained that in deciding whether an intangible injury is concrete, courts should consider both history and Congress’s judgment. Popa, WL 2448824, at *3 (citing Spokeo, Inc. v. Robins, 578 U.S. 330, 340 (2016), as revised (May 24, 2016)). But a statutory violation by itself is not enough because Article III standing requires a concrete injury. Spokeo, 578 U.S. at 341. Thus, plaintiffs cannot merely “allege a bare procedural violation, divorced from any concrete harm” to satisfy the injury-in-fact requirement. Id.

Finally, the Ninth Circuit crystallized key takeaways from the Supreme Court’s analysis in TransUnion LLC v. Ramirez, 594 U.S. 413, 424 (2021). In that case, the court held that a cognizable injury requires some harm that has traditionally been actionable in the U.S. legal system, and it also identified limits on congressional power to confer standing. TransUnion LLC, 594 U.S. at 417, 427.

Applying these standards, the Ninth Circuit affirmed that Popa failed to allege standing. TransUnion. Popa, WL 2448824, at *4.&nbsp; Popa claimed that her injury fell under the common-law privacy torts of intrusion upon seclusion and public disclosure, but both analogies failed because she failed to allege anything “highly offensive” to a reasonable person—she alleged nothing offensive, embarrassing, invasive or otherwise private that was collected during her website visit. Popa, WL 2448824, at *5. The court analogized session replay to a “store clerk’s observing shoppers in order to identify aisles that are particularly popular or to spot problems that disrupt potential sales.” Id.

In rejecting Popa’s claim, the Ninth Circuit continued to draw a bright line between injury-in-law and injury-in-fact. Id. Popa argued that because the Pennsylvania legislature passed a statute protecting a privacy right, any alleged violation of that statute would be enough for Article III standing. Id. The Ninth Circuit rejected that argument under TransUnion, which cautioned the courts against treating “an injury as ‘concrete’ for Article III purposes based only on Congress’s say-so.” Id. (quoting TransUnion, 594 U.S. at 426); see also Spokeo, 578 U.S. at 341 (“Article III standing requires a concrete injury even in the context of a statutory violation.”). In other words, the court distinguished statutory standing (i.e., the legislatively defined harm required to state a claim under a statute) from Article III standing (a constitutional requirement limiting federal judicial power to “cases” and “controversies”). Thus, TransUnion requires courts to examine an individual plaintiff’s alleged circumstances for some “concrete injury,” instead of assuming injury based generally on legislative intent. 594 U.S. at 427.

In a world where business innovation invites more and more privacy-based claims, the Ninth Circuit affirmed and clarified some important principles in evaluating pleading challenges. First, a plaintiff must allege more than a mere statutory violation to sufficiently show a concrete injury for Article III purposes. Second, to show “concrete” injury, a plaintiff must allege a harm “that has traditionally been actionable in our nation’s legal system.” Popa at *6. Third, there is no common law right to privacy. Instead, a claim for invasion of privacy must be based on a recognized privacy tort. No doubt these rules will continue to be refined and tested as technological advances—and theories from the plaintiff’s bar—continue to evolve.

Media & Privacy Risk Report

Los Angeles

Adil M. Khan

Chicago

Nusra Ismail

Hannah M. Yozzo

Privacy, CyberSecurity & Media

Complex Commercial Litigation

Popa v. Microsoft Corporation, et al.: Ninth Circuit Clarifies Article III Standing Requirements and Strengthens Defenses to Internet Privacy and Other Consumer Claims

Popa v. Microsoft Corporation, et al.: Ninth Circuit Clarifies Article III Standing Requirements and Strengthens Defenses to Internet Privacy and Other Consumer Claims

Related Capabilities

Related People

Stay up to date

Related Capabilities

Related People

Stay up to date

Slide Menu

Slide Search