UNITED STATES COURT OF APPEALS FOR THE THIRD CIRCUIT ____________

No. 23-2535 ___________

KENNETH HASSON, Individually and on behalf of all others similarly situated, Appellant

v.

FULLSTORY, INC. ____________

On Appeal from the United States District Court for the Western District of Pennsylvania (D.C. No. 2-22-cv-01246) District Judge: Honorable Marilyn J. Horan ____________

No. 23-2573 ___________

JORDAN SCHNUR, Individually and on behalf of all others similarly situated, Appellant

v. PAPA JOHN’S INTERNATIONAL, INC., d/b/a Papa Johns ____________

On Appeal from the United States District Court for the Western District of Pennsylvania (D.C. No. 2-22-cv-01620) District Judge: Honorable J. Nicholas Ranjan ____________

Argued on April 18, 2024 Before: HARDIMAN, PHIPPS, and SMITH, Circuit Judges.

(Filed: September 5, 2024) Gary F. Lynch Jamisen A. Etzel [Argued] Lynch Carpenter, LLP 1133 Penn Avenue, 5th Floor Pittsburgh, PA 15222 Counsel for Appellants Emily Johnson Henn Covington and Burling LLP 3000 El Camino Real 5 Palo Alto Square, 10th Floor Palo Alto, CA 94306 Peter S. Wolff Pietragallo Gordon Alfano Bosick & Raspanti 301 Grant Street One Oxford Centre,38th Floor Pittsburgh, PA 15219

2 Mark W. Mosier [Argued] Eric C. Bossett Kendall T. Burchard Grace Pyo Covington & Burling LLP One CityCenter 850 Tenth Street, NW Washington, DC 20001 Counsel for Appellees ________________________

OPINION OF THE COURT ________________________ HARDIMAN, Circuit Judge.

These appeals come to us from the District Courts’ orders dismissing two class actions for lack of personal jurisdiction. In the first case, Kenneth Hasson sued FullStory, Inc., claiming that the company unlawfully wiretapped him when it deployed a script of computer code—known as Session Replay Code—to intercept his online communications. In the second case, Jordan Schnur sued Papa John’s International, Inc. for its use of FullStory’s Session Replay Code.

I

We begin by describing the technology at issue. FullStory’s Session Replay Code enables companies like Papa Johns to collect detailed information about the way visitors

3 interact with its website. The website “delivers” the code “to a user’s browser,” which “follow[s] the code’s instructions by sending . . . data to a . . . third-party server.” Hasson App. 29. The data encompasses “virtually every user action, including all mouse movements, clicks, scrolls, zooms, window resizes, keystrokes, text entry, and numerous other forms of a user’s navigation and interaction through the website.” Id.

The information is intercepted—without the user’s knowledge or consent—the moment he accesses the website. And text entries on the website are captured even if the user fails “to click . . . ‘submit’ or ‘enter.’” Id. at 30. Users’ internet protocol addresses and location information can also be identified. Vendors and website operators use the data to recreate a user’s entire browsing session on that website. FullStory receives and analyzes the harvested data for its clients, who use the information to improve website functionality and user experience.

The question presented in both cases is whether the deployment of Session Replay Code in Pennsylvania makes FullStory and Papa Johns amenable to jurisdiction there. The parties agree that the claims implicate only specific, not