Court decision · 18 October 2022
Popa v Harriet Carter Gifts, Inc.
52 F.4th 121 (3d Cir. 2022) · United States Court of Appeals for the Third Circuit
What it means for your code
A session-replay or analytics script that streams input to a vendor is wiretapping unless the user agreed to it before the script loads. Gate these behind consent and name the vendor.
What happened
A retailer embedded a marketing vendor's script that captured shoppers' interactions with the site and sent them to the vendor's servers in real time.
What was decided
The vendor was a third-party interceptor, not a party to the communication; the direct-party exception did not apply, and interception occurred where the signal was routed, not only where the user sat.
The legal test applied
- A third-party vendor capturing a visitor's interactions is an interceptor, not a party to the communication
- The direct-party exception does not shield a vendor receiving a simultaneous copy
- Interception occurs where the signal is routed as well as where the user is
What would have changed the outcome
- Consent obtained before the script loads defeats the claim
- A first-party script with no onward transmission is not interception
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.