Pennsylvania's Wiretap Act and Session Replay: The Statute, Popa, and What the Third Circuit Did Next

An All-Party Consent Statute

Pennsylvania's wiretap law is chapter 57 of Title 18, added by the Act of October 4, 1978, P.L. 831, No. 164. It is a criminal statute first. Section 5703 makes it a felony of the third degree to intentionally intercept, or procure another person to intercept, any wire, electronic or oral communication, or to intentionally disclose or use the contents knowing or having reason to know they came from an interception.

The definitions in section 5702 are what bring website traffic within it. An electronic communication is "any transfer of signs, signals, writing, images, sounds, data or intelligence of any nature" transmitted in whole or part by wire, radio, electromagnetic, photoelectronic or photo-optical system, with exceptions for wire and oral communications, tone-only pagers and tracking devices. To intercept is to make an "aural or other acquisition of the contents" of a communication "through the use of any electronic, mechanical or other device." Contents means "any information concerning the substance, purport, or meaning of that communication."

The consent exception that matters for commercial websites is section 5704(4): it is not unlawful for "a person, to intercept a wire, electronic or oral communication, where all parties to the communication have given prior consent to such interception." The one-party consent route in section 5704(2)(ii) belongs to investigative and law enforcement officers acting with prosecutorial approval, not to private businesses. The federal Wiretap Act, as the Third Circuit quoted it in Popa, allows a private person who is a party to the communication, or who has one party's consent, to intercept it (18 U.S.C. § 2511(2)(d)). Pennsylvania's text contains no general equivalent.

The chapter continues to be amended. The section 5702 history note lists amendments from 1981 through November 24, 2025, and describes the 2025 amendment, Act 53, as changing the definition of "oral communication" and the 2020 amendment as changing the definition of "crime of violence."

The Civil Action in 18 Pa.C.S. § 5725

Section 5725(a) gives a civil cause of action to "any person whose wire, electronic or oral communication is intercepted, disclosed or used in violation of this chapter." The defendant class is wide: "any person who intercepts, discloses or uses or procures any other person to intercept, disclose or use, such communication." The procurement clause is how a website operator that installs a vendor's code becomes a defendant alongside the vendor that receives the data.

The remedies are fixed by statute:

• Actual damages, "but not less than liquidated damages computed at the rate of $100 a day for each day of violation, or $1,000, whichever is higher"
• Punitive damages
• A reasonable attorney's fee and other litigation costs reasonably incurred

Subsection (b) waives sovereign immunity for the Commonwealth and its officers and employees for purposes of the section. Subsection (c) supplies one defense: that the actor "acted in good faith reliance on a court order or the provisions of this chapter." The chapter's definition of aggrieved person, a party to an intercepted communication or a person against whom the interception was directed, describes who is on the receiving end of an interception.

The liquidated damages floor is what makes the statute attractive in class litigation. A plaintiff does not have to prove a dollar of loss to claim $1,000. Federal courts, however, still require an Article III injury before reaching the statute, and that is where the most recent session replay cases have ended.

Popa v. Harriet Carter and the Location of the Interception

Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (3d Cir. 2022), involved a retailer's website running JavaScript from NaviStone, a marketing vendor. The amended opinion describes the mechanics: the retailer's page told the browser to request NaviStone's code from a server in Virginia, and that code then had the browser send NaviStone messages as the user searched, filled in forms and added items to a cart. The district court had granted summary judgment on two grounds, one of which was that any interception happened in Virginia, outside the reach of Pennsylvania law.

The location question mattered because the Pennsylvania Superior Court, in Larrison v. Larrison, had declined to apply the Act to a telephone recording made wholly outside the Commonwealth. The Third Circuit started from the statute's word "acquisition," which the Act does not define, and gave it its ordinary meaning: coming into possession or control. An interception therefore occurs "where there is an act taken to gain possession of communications using a device."

Drawing on federal wiretap cases holding that a phone is tapped where it is located, and on the Sixth Circuit's decision in Luis v. Zang that monitoring software intercepts where it captures and reroutes messages, the panel held that NaviStone intercepted the communications "at the point where it routed those communications to its own servers," which was "at Popa's browser, not where the signals were received at NaviStone's servers." It did not decide where Popa's browser was when that happened. The record did not establish it, so the court remanded with the holding that "the place of interception is the point at which the signals were routed to NaviStone's servers."

Three limits on that holding are in the opinion itself. The defendants did not argue that JavaScript is not a "device," so the court assumed it was. A footnote leaves open whether the "listening post" theory, under which an interception can also occur where the contents are received, extends to WESCA or electronic communications. And the court declined to apply the constitutional-doubt canon to the defendants' Commerce Clause argument, while noting the constitutional issues about state regulation of internet communications were "interesting." The opinion also explains the policy it saw in the defendants' reading: if interception occurred only at the server, a company could capture data from people in other states "as long as they parked their servers in a state with weak privacy protections."

The Direct-Party Exception After the 2012 Amendment

The defendants' main argument was that NaviStone could not intercept a communication the browser sent directly to it. Pennsylvania courts had said as much in criminal cases. In Commonwealth v. Proetto (Pa. Super. 2001) and Commonwealth v. Cruttenden (Pa. 2012), officers who received messages while posing as someone else were held not to have intercepted them, because they were the intended recipients.

The General Assembly then amended the definition of intercept by the Act of October 25, 2012, P.L. 1634, No. 202. The added sentence excludes a communication made to an investigative or law enforcement officer who poses as the intended recipient, but only where a designated prosecutor has reviewed the facts and given prior approval. The panel read that as codifying the Proetto rule for law enforcement alone and, applying the canon that expressing one exception excludes others, as declining to adopt a general direct-party exception. It pointed to section 5704(4): if a party could intercept without the other party's consent, "the all-party consent requirement would disappear."

The opinion was first filed on August 16, 2022 and amended on October 18, 2022, with the original and amended versions both posted on the court's site. The August version stated flatly that "there is no direct-party exception to liability under the WESCA (save for law enforcement under specific conditions)." The October 18, 2022 version replaces that sentence. It adds a response to Commonwealth v. Diego (Pa. Super. 2015), a post-amendment text message case the defendants said had revived the exception, limits Diego to its facts, notes that the Superior Court later treated Diego as a consent case, and concludes that the Pennsylvania Supreme Court "would rule that there is no sweeping direct-party exception to civil liability under the WESCA." The result is the same; the stated basis is a prediction of state law rather than a flat statement of it.

The court also marked the difference from its own federal cases. In In re Google Inc. Cookie Placement and In re Nickelodeon, defendants that received GET requests directly from users' browsers were parties under the federal Act's express party exception. WESCA's lack of that exception is why the same technical facts produced a different answer.

What Later Courts Have Done With Popa

The next precedential session replay decisions in the Third Circuit did not reach the merits of WESCA. In Hasson v. FullStory, Inc., decided September 5, 2024 together with Schnur v. Papa John's International, Pennsylvania residents sued a session replay vendor and a restaurant chain whose code captured "virtually every user action" on their websites. The court held that neither complaint satisfied the Calder effects test. As to Papa John's, it noted that Schnur did not allege the company knew a user was in Pennsylvania before the code was sent, which happened the instant anyone reached the site. It affirmed the dismissal of Schnur for lack of personal jurisdiction, and vacated and remanded Hasson for the district court to apply the traditional minimum contacts test. Judge Phipps concurred in part and dissented in part, citing Popa's holding that the wiretap occurs where the browser reroutes the communication.

Cook v. GameStop, Inc., decided August 7, 2025, involved Microsoft's Clarity session replay code on GameStop's website. Cook alleged the code captured her mouse movements, clicks, search terms and an add-to-cart action, but she entered no name, contact or payment information. The Third Circuit held she lacked Article III standing because her harm was not closely related to public disclosure of private facts or intrusion upon seclusion: the data was not sensitive, it went to a vendor rather than the public, and browsing a retail site was not a private affair. The court modified the dismissal to be without prejudice.

Two passages in Cook bear directly on Popa. A footnote observes that Popa proceeded to the merits without analyzing standing and that an unexplained jurisdictional ruling "has no precedential effect." Another states that Cook's lack of standing "does not mean that no plaintiff can proceed in federal court to seek redress of web-browsing tracking under WESCA."

Nineteen days later, the Ninth Circuit reached the same result in Popa v. Microsoft Corp., a WESCA and intrusion claim by the same plaintiff as the Third Circuit case, filed in the Western District of Pennsylvania and transferred to the Western District of Washington. The alleged capture was her pet supply browsing and a street name, with the street number and zip code masked. The panel held she had not alleged a concrete injury, rejected the argument that any WESCA violation is itself a concrete harm as inconsistent with TransUnion, and noted that tracking "could be offensive in particular circumstances (e.g., involving sensitive medical or financial information)."

Where Consent Enters

Consent is both the statutory exception and, in practice, the factual contest. Popa remanded on it. The defendants argued that Harriet Carter's privacy policy gave implied consent; the panel, relying on the Pennsylvania Supreme Court's decision in Commonwealth v. Byrd (2020), noted that prior consent under section 5704(4) does not require actual knowledge and can rest on what a person knew or should have known. It left to the district court whether the policy existed when Popa visited and whether it disclosed transmission to a third party.

The standing cases draw on similar facts for a different purpose. Cook distinguished the Third Circuit's earlier browsing cases, Nickelodeon and Google II, on the ground that those defendants had promised not to collect or track, while GameStop had disclosed its collection, "albeit in an allegedly inconspicuous location." A privacy disclosure therefore appears in the case law twice: as possible evidence of consent on the merits under section 5704(4), and as a fact bearing on whether a federal court has jurisdiction at all.

What the cases have not produced is a Pennsylvania appellate decision applying WESCA to website tracking. Popa is a prediction of how the Pennsylvania Supreme Court would read the statute, and the two 2025 appellate decisions were decided on federal standing grounds without addressing WESCA's merits.

Frequently Asked Questions