Hi, CIPAWorld! Kelly Sandberg here, with a discussion on the Pennsylvania Superior Court’s assessment of the state’s Wiretapping and Electronic Surveillance Control Act (WESCA).
In Raeleen Thompson v. C. &J. Clark America, Inc., Appellant brought a putative class action against Appellee Clarks for violations of Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (WESCA), 18 Pa. C.S.A. §§ 5701-5782, and common law invasion of privacy for allegedly wiretapping the electronic communications made by visitors when visiting Clark’s website. Raeleen Thompson v. C. &J. Clark America, Inc., No. 74 WDA 2026, WL 3179684 (Pa. Super. Ct. 2026).
Clarks owns the website http://www.clarksusa.com, which allows consumers to browse and purchase the shoes Clarks designs. Appellant alleged in her complaint that when she visited the website, Clarks wiretapped the electronic communications she made to the website, including her mouse movements, clicks, keystrokes, URLs of webpages visited, and/or other electronic communications.
Appellant stated she visited the website sometime in 2022 to see what sandals were coming out for spring and summertime. While on the website, she merely browsed for sandals – she did not input her name, email, create an account, or provide her credit card information. In 2023 or 2024, Appellant visited the website again but did not provide any personal identifying information.
However, after these website visits, Appellant allegedly began receiving “pop-up” ads “targeting” her to look at other “Clark[s] items.” She claims she did not see or search for Clarks terms of use, its cookie policy, and that she did not disallow cookies that tracked her browsing activity on the Clark’s website.
Appellant’s expert determined that the tracking technology on Clarks’ website, Content Square, deploys trackers immediately when a user loads the first webpage, and then ships information directly out of the user’s browser rather than from the web address for Clarks – meaning that the information collected was going directly to Content Square instead of to Clarks.
And aren’t you curious to know what harm she alleged here?
Appellant alleged that she was harmed when Clarks tracked what she looked at on its website and then later sent her ads about sandals that she was not interested in buying. More specifically, “[s]he maintains that her time was wasted because ‘Clarks’ was always showing up as the first website in her search for sandals.”
Anyway…
The trial court had entered summary judgment in Clark’s favor, and Appellant appealed, arguing that the trial court had erred in determining that she had given prior consent to the interception of her electronic communication under WESCA.
“In general, [WESCA] prohibits the interception, disclosure or use of any wire, or electronic or oral communication.” Commonwealth v. Byrd, 235 A.3d 311, 319 (Pa. 2020). Section 5703 of WESCA provides that a person is guilty of a third-degree felony if they intentionally or endeavor to intercept, disclose, or use electronic or oral communication.
Section 5704 of WESCA provides an exception of consent by all parties to the communication. Interestingly, this mutual consent exception does not require express consent of a party to the interception. Rather, it is “based on whether an individual knew or should have known they were being recorded.” Byrd, 235 A.3d at 313.
The trial court had relied on the case of Proetto to determine how consent can be provided under WESCA:
First, “[a]ny reasonably intelligent person, savvy enough to be using the Internet, however, would be aware of the fact that messages are received in a recorded format, by their very nature, and can be downloaded or printed by the party receiving the message. By the very act of sending a communication over the Internet, the party expressly consents to the recording of the message.” Commonwealth v. Proetto, 771 A.2d at 829. (Pa. Super 2001).
Second, a person is not required to know the true identity of the recipient of the electronic communication for the mutual consent exception to apply – meaning that deceit of the receiving party is irrelevant.
Third, the “very act of sending a communication over the Internet” amounts to express consent to recording. Commonwealth v. Cruttenden, 58 A.3d 95, 98 (Pa. 2012).
Although the trial court had found the exception applied, the Superior Court could not find that it applied – for evidentiary reasons.
An Appellate court may reverse the entry of a summary judgment only where it finds that the lower court erred in concluding that the matter presented no genuine issue as to any material fact, and that it is clear that the moving party was entitled to a judgment as a matter of law – meaning that there is no issue to be decided by a fact finder.
Appellant argued that the trial court had erred in determining that she had given prior consent to Content Square’s interception of her electronic communication with the Clarks website.
Appellant argued that the trial court erred in finding she gave prior consent to Content Square’s interception of her communications on the Clarks website and that there existed an issue for the jury to determine whether a reasonably intelligent person would understand the existence and purpose of Content Square’s tracking codes on Clark’s website.
Further, she argued that if the trial court’s ruling was upheld, WESCA would provide no privacy protections on the internet whatsoever, and the trial court’s misuse of language from Proetto resulted in a dramatic carveout of all Internet communications from WESCA’s protections.
The Superior Court relied on the case of Popa, specifically the analysis in both Popa II and Popa III, applying a reasonable person standard under the circumstances to determine whether consent was provided. See Popa v. Harriet Carter Gifts, Inc., 52 F. 4th 121 (Popa II); Popa v. Harriet Carter Gifts, Inc., 772 F. Supp. 3d 592 (W.D. Pa. 2025) (Popa III).
While “the nature of the Internet does not confer blanket implied consent to interception under WESCA,” it would also “not be reasonable for users to blithely assume they are browsing some idealized version of the Internet which does not, in fact, exist.” Poppa III, 772 F. Supp. 3d at 600-08 (internal quotation marks omitted).
The Superior Court determined that under the reasonable person standard, a website’s privacy policy could convey implied consent to the interception of a communication if: (1) it disclosed the nature of the interception to a reasonable reader and (2) was reasonably conspicuous.
The Court determined that Clark’s privacy policy met both of these requirements. But you’ll see the resulting flaw momentarily.
First, Clark’s privacy policy was rife with references to the involvement of third parties and disclosed the nature of interceptions like the one at issue. So, Clark’s privacy policy met the requirement for disclosure of the nature of the interception.
Second, because only implicit knowledge was required, Clark’s privacy policy, as a browse wrap agreement, was deemed reasonably conspicuous because browse wrap agreements don’t require a user to manifest assent to the terms and conditions expressly.
Conversely, a browse wrap agreement provides that a user assents by simply using the website itself.
And… that fatal mistake? Clarks had asserted that the privacy policy was located at the center bottom of the webpage and would therefore be deemed reasonably conspicuous, but they had failed to provide any evidence of this conspicuity to the trial court.
Because the record was devoid of specific evidence on the conspicuity of Clarks’ privacy policy, the Superior Court found that the privacy policy was not reasonably conspicuous and failed to meet this two-part standard for determining whether implied consent had been provided by Appellant in order for the consent exception to apply.
Ultimately, the Superior Court vacated summary judgment and remanded the case for further consideration– and allowed for the parties to supplement the record and engage in additional discovery if necessary.
Although this case regards Pennsylvania’s Wiretapping statute, it is fascinating to view how consent to the tracking of internet communications is determined here as compared to California’s data privacy acts.