The Court of Appeals for the Ninth Circuit has affirmed the dismissal of a class-action lawsuit that accused Papa John’s of violating wiretapping and eavesdropping laws in California by tracking and recording the activities of users who visit its website.
The background: The plaintiff filed suit against the defendant, alleging that the pizza chain’s use of “Session Replay Code” on its website violated the California Invasion of Privacy Act (CIPA) and constituted an unlawful intrusion upon seclusion under California common law. According to the complaint, the technology allowed the defendant to observe and record user activity on its site — allegedly without consumer knowledge or consent — amounting to digital eavesdropping and a privacy violation.
- The plaintiff further asserted that this monitoring was highly offensive and that it intruded upon the private browsing experiences of California residents, forming the basis for a class-action claim.
The ruling: The Ninth Circuit upheld the lower court’s decision to dismiss the complaint, siding with the defendant on all counts:
- The court noted that a party to a conversation cannot be held liable under CIPA for eavesdropping on its own communication. Quoting from Rogers v. Ulrich, the panel emphasized, “A party to a conversation cannot eavesdrop on their own conversation.” The plaintiff did not allege that a third party was involved or aided in eavesdropping, rendering the claim legally insufficient.
- The Ninth Circuit also found that the plaintiff failed to demonstrate a “highly offensive” privacy invasion required by California law. The court cited Hernandez v. Hillsides, Inc. to affirm that the alleged conduct, even if true, did not rise to the necessary threshold for such a claim.
- Although the defendant contested the court’s jurisdiction, the panel concluded that operating a nationally accessible, interactive website that targets California consumers was sufficient to establish purposeful direction. Citing Briskin v. Shopify, the court held that “Papa John’s is subject to personal jurisdiction in California” based on its website’s reach and the nature of the alleged data collection.
