In Rosenthal v. Bloomingdales.com, LLC, No. 23-1683 (1st Cir. May 9, 2024), a First Circuit panel holds that the inclusion of a session replay provider (SRP) on a commercial website hosted out of state, which allegedly permitted surveillance of customers, did not create grounds for specific personal jurisdiction against the store in the state where the customer was located.
Plaintiff filed a putative class action against retail giant Bloomingdales under a Massachusetts state law claim for wiretapping, based on its alleged surveillance of his web activity while he visited the store’s website.
“Bloomingdales, the complaint alleged, had commissioned third-party vendors (sometimes called ‘session replay providers’ or ‘SRPs’), such as the Georgia-based company FullStory, to embed snippets of JavaScript computer code on its website. Unbeknownst to the plaintiff, this SRC was deployed onto his internet browser while he visited Bloomingdales’ website in order to intercept, record, and map his electronic communications with the website. Bloomingdales and the SRPs then used these communications to recreate the plaintiff’s visits to the website and to assemble for analysis a video replay of his behavior on the website.”
The district court granted a Fed. R. Civ. P. 12(b)(2) motion to dismiss for lack of specific personal jurisdiction. (The plaintiff did not argue general jurisdiction based in Bloomingdales’ brick-and-mortar locations in the state.) “In addition to concluding that the ‘defendant’s conduct which forms the basis of plaintiff’s claims occurred outside of Massachusetts,’ the district court determined that Bloomingdales had not ‘initiate[d] contact with the forum state.’”
The First Circuit affirms, holding that “plaintiff’s attempted assertion of jurisdiction over Bloomingdales does not satisfy the constitutional minimum demanded by the Due Process Clause.”
Purposeful availment “rests on two cornerstones: ‘voluntariness’ and ‘foreseeability.’” The former concerns whether the defendant’s actions proximately caused contacts with the forum; the latter concerns whether the defendant “should reasonably anticipate being haled into court there.”
The panel finds neither factor present here. “[T]he complaint in this case merely alleges that Bloomingdales commissioned SRPs to deploy SRC in a manner that would be recognized by the internet browsers of users located anywhere in the world (including Massachusetts) . . . . [T]hese alleged contacts fail to demonstrate that Bloomingdales maintained sufficient linkages with Massachusetts to support a claim of specific jurisdiction.”
“Even assuming that [the SRC] does in fact inform Bloomingdales about the location of a given user, there is not a shred of evidence in the present record that the plaintiff himself entered his location into the website when he accessed it. This silence is unsurprising: after all, the plaintiff also fails to allege that he visited any of Bloomingdales’ stores in the state, which would explain why he never searched for nearby stores. More importantly, this insufficiency bolsters our conclusion that the plaintiff has not proffered the requisite evidence to establish that Bloomingdales knew that it was targeting him when he was in Massachusetts, thus fulfilling the voluntariness and foreseeability requirements.”
Judge Thompson, concurring dubitante, suggests that the time is nigh to rethink personal jurisdiction in the age of the internet. “I get the need to draw lines so operators of websites and digital platforms (I’m no techie, but you see where I’m going) aren’t unfairly exposed to personal jurisdiction everywhere. But I worry that the Bloomingdaleses [sic] of the world will be able to launch online platforms accessible in all fifty states yet still be held not to have sufficient contacts in any of them to trigger personal jurisdiction (remember I’m talking about specific personal jurisdiction).”
Paul Mollica's Federal Courts Blog 