In May 2026, the U.S. Court of Appeals for the Third Circuit issued a notable decision in Smidga v. Spirit Airlines, reinforcing the growing skepticism toward privacy claims premised on website tracking technologies. The ruling highlights the difficulty plaintiffs face in establishing Article III standing in cases involving session replay tools and similar analytics, with meaningful implications for businesses navigating the evolving digital privacy landscape.
Smidga Background
The plaintiffs brought a putative class action against Spirit Airlines, alleging that the company used session replay code to intercept and record website visitors’ interactions, including text entries, mouse clicks, and geolocation data. In response to Spirit’s motion to dismiss for lack of Article III standing, the plaintiffs relied on comparator torts to establish a “close relationship” to traditionally recognized harms.
The U.S. District Court for the Western District of Pennsylvania dismissed the complaint for lack of subject-matter jurisdiction, concluding that the plaintiffs failed to adequately allege a concrete harm. On appeal, the Third Circuit affirmed, relying in part on its recent decision in Cook v. GameStop, Inc. and reiterating that the harms alleged did not satisfy the constitutional requirement of an “injury in fact.”
Third Circuit’s Standing Analysis
At the core of the Third Circuit’s analysis was the U.S. Supreme Court’s modern standing framework, particularly the requirement that alleged intangible harms bear a “close relationship” to harms traditionally recognized as providing a basis for suit. The plaintiffs’ reliance on privacy tort analogies, including intrusion upon seclusion and public disclosure of private facts, ultimately fell short.
First, the court found the comparator torts not meaningfully analogous. Most plaintiffs did not allege that any personal information was collected at all. Even the plaintiff who entered identifying information failed to allege resulting embarrassment or humiliation — an essential element of the tort of public disclosure of private facts. The court likewise rejected the intrusion upon seclusion analogy, finding that the plaintiffs voluntarily provided information and the information was anonymized. The court further emphasized that online activity is not generally understood to be wholly private, reinforcing its conclusion that the plaintiffs’ theory was “at most an attempt to fit a square peg into a round hole.”
Second, the court highlighted the plaintiffs’ misunderstanding of TransUnion, clarifying that statutory violations alone do not confer Article III standing. Rather, courts must assess whether the complaint alleges a concrete, real-world harm, not merely the existence of a statutory cause of action. Accordingly, the plaintiffs could not establish Article III standing by pointing to alleged violations of privacy statutes without a corresponding claim of unauthorized dissemination of information or other “concrete harm.”
Third, drawing on its prior decision in Cook, the court underscored the distinction between a website’s failure to obtain user consent for data collection and an affirmative misrepresentation about data collection practices. Liability concerns are heightened where a company promises not to collect data but secretly does so anyway — a circumstance not present in Smidga.
Industry Impact
The Smidga decision reflects a broader trend within the Third Circuit toward a more stringent approach to standing in cases involving website tracking technologies. For businesses, this decision offers reassurance. Companies using session replay tools, cookies, or similar technologies may have stronger defenses at the pleading stage, particularly where data is anonymized, voluntarily provided, or not linked to a clear downstream harm.
That said, the ruling does not eliminate all risk. The outcome in Smidga was highly fact-specific and turned on the absence of allegations involving identifiable misuse, unauthorized disclosure, or deception. Companies that collect sensitive personal information or misrepresent their tracking practices may still face exposure, especially in jurisdictions more receptive to these claims.
Plaintiffs, meanwhile, are likely to refine their strategies by pleading more concrete harms. Even so, Smidga reinforces that courts will closely scrutinize whether alleged harms arising from data collection practices align with traditionally recognized injuries.
Looking Ahead
The Third Circuit’s decision underscores key principles governing standing in data privacy litigation. While such cases continue to proliferate, Smidga demonstrates that federal courts — particularly in the Third Circuit — remain difficult venues absent a well-pleaded, concrete harm.
For industry stakeholders, the ruling highlights the importance of anonymized tracking and transparent disclosures in mitigating litigation risk, particularly as standing doctrine continues to evolve to account for intangible data privacy harms. Ultimately, Smidga reflects an ongoing judicial effort to balance consumer privacy concerns and the practical realities of modern web functionality. As courts continue to define the contours of actionable internet privacy harms, businesses should expect greater clarity in this rapidly developing area.
For more information about this case and its implications for class action litigation, please contact the authors or any attorney with FBT Gibbons’ Class Actions team.