A federal judge has allowed a proposed class action to proceed over claims that an online retailer and a data collection company violated Pennsylvania's Wiretap Act when they collected customers' personal information.

U.S. District Judge William Stickman of the Western District of Pennsylvania on Dec. 6 ruled that a class action plaintiff represented by Gary Lynch of Carlson Lynch in Pittsburgh may take discovery on claims that the companies had intercepted information, including names, street addresses and email addresses, in violation of the wiretap statute while browsing a retail website.

The lawsuit is captioned Popa v. Harriet Carter Gifts.

In allowing plaintiff Ashley Popa's wiretap claim to go forward against the online retail website Harriet Carter Gifts, Stickman laid the groundwork for discovery that he said should help the court delve into looming novel questions like whether code qualifies as a "device" under the state's wiretap act, and whether a user's personal information qualifies as "content" under that statute.

"Whether the interplay between defendants' servers and [defendant data collection company] NaviStone's code qualifies as a 'device' or 'apparatus' is a fact intensive inquiry that implicates novel questions," Stickman said. "The discovery process will give the parties an opportunity to develop a record that contextualizes the conduct at issue in light of this statutory language."

Popa's lawyer Lynch didn't return a call seeking comment.

Baker & Hostetler attorney Emily Thomas, who is representing Harriet Carter Gifts, did not returned a call seeking comment.

NaviStone's attorney, David Bertoni of Brann & Isaacson, said Popa's complaint misstates the facts and is based on a "basic misunderstanding of how the internet works," adding that virtually every website uses the same technology as NaviStone.

"If NaviStone is guilty of wiretapping, then so, too, is virtually every website, public and private," Bertoni said.

He also said the company never learns or shares the identify of any anonymous website visitor, or logs keystrokes.

"We look forward to the real facts being before the court," he said.

Although the decision denied the defendants' efforts to dismiss the class action lawsuit entirely, Stickman's ruling also dismissed Popa's argument that the defendants' conduct had additionally constituted an invasion of privacy.

Popa had argued that tracking her keystrokes and clicks, and intercepting her personal information despite never having hit the "submit" button to make a purchase was a "highly offensive" intrusion into her privacy. Stickman, however, said the ubiquity of these practices meant that the claims had to fail.

"Consumers may be troubled that their trip to an electronic marketplace may feature surveillance of their every behavior that is far more intrusive than a trip to the local mall, and that the data garnered from even causal browsing may be used by retailers—and others—for marketing or more sinister purposes," Stickman said. "But even well-founded concern is not enough to give rise to tort liability. Such liability requires conduct that may outrage or cause mental suffering, shame or humiliation to a person of ordinary sensibilities."

According to Stickman, Harriet Carter Gifts is incorporated in Pennsylvania, and NaviStone, which is a company that tracks users' IP addresses, is an Ohio company that stores data on its servers there. Harriet Carter Gifts, Stickman said, contracted with NaviStone to collect data from traffic on its website.

Popa contended that NaviStone intercepted information including her name, residential address and email address while she looked for pet products, and tracked her keystrokes and clicks. She sued, initially in the Lawrence County Court of Common Pleas, on behalf of a proposed class.

After removing the case to federal court, the defendants filed motions to dismiss, arguing, among other things, the conduct could not have violated the Wiretap Act because the defendants were direct parties to the communications, neither Harriet Carter Gifts' servers nor NaviStone's codes are "devices" under the law, and there was mutual consent from the parties.

Stickman, however, said litigants needed to first address threshold questions about how NaviStone's being based in Ohio complicated the case, since Pennsylvania courts have declined to extend the wiretap statute to out-of-state intercepts. Specifically, he questioned whether the conduct occurred in Pennsylvania—where Popa viewed the website—or whether it happened in Ohio, where NaviStone kept its servers.

The judge further said he did not have enough information about several issues central to the defenses' arguments, such as whether Popa had actual notice that her information would be collected, and whether the data collected could constitute "content" under the act.

"The court will be better equipped to [make a ruling] after a record is developed that places the alleged conduct of defendants into context vis-a-vis the nature of 'content' for a claim under the [Pennsylvania Wiretapping and Electronic Surveillance Control Act]," Stickman said.