Pennsylvania Court Revives Clarks Session Replay Lawsuit: Why Privacy Policy Visibility Matters Under WESCA

A Pennsylvania footwear retailer won summary judgment in a website-tracking lawsuit, only to have that victory overturned because it could not establish how prominently its privacy policy appeared to visitors.

On October 23, 2026, the Pennsylvania Superior Court ruled in Thompson v. C. & J. Clark America, Inc. that unresolved questions about the visibility of Clarks’ privacy disclosures prevented the retailer from establishing visitor consent as a matter of law.

The case involved Contentsquare, a third-party analytics provider accused of recording website visitors’ mouse movements, clicks, scrolling activity, and other interactions.

The ruling creates a practical problem for businesses that rely on privacy policies to defend website tracking: having a privacy policy is not the same as being able to prove that visitors received adequate notice of the tracking it describes.

The court did not prohibit session replay or rule that Clarks was liable. It did, however, recognize that the alleged tracking could constitute an interception under Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (WESCA). The case now returns to the trial court for further proceedings.

How a Search for Sandals Became a Wiretapping Lawsuit

Raeleen Thompson alleged that Clarks used third-party technology to monitor visitors to clarksusa.com without their prior consent.

Thompson testified that she first visited the retailer’s website around 2022, using a Samsung Galaxy phone to browse summer sandals. She returned during a later visit, searched for sandals, filtered products by size, and viewed merchandise.

She did not create an account, provide a credit card number, enter her name or email address, or use the website’s chat feature.

After visiting the website, Thompson said she began seeing Clarks advertisements on Facebook and related search suggestions.

She subsequently became involved in a proposed class action alleging that Clarks’ tracking technology violated WESCA.

One unusual detail appears in the court’s factual summary: Thompson testified that she became a class representative after encountering a Facebook advertisement from the law firm handling the lawsuit.

That detail does not determine whether the tracking was lawful. It does, however, illustrate how website-tracking litigation can arise from ordinary retail browsing activity rather than a conventional data breach or unauthorized account access.

What Contentsquare Allegedly Collected

The case focused on Contentsquare, a digital experience analytics provider used by Clarks.

The record included a January 2021 agreement under which Contentsquare provided website optimization services and committed to a monthly tracking service level of 99.9%.

The agreement described processing several categories of visitor information, including IP addresses, cookie identifiers, page visits, browser and operating-system details, and behavioral interactions.

The behavioral data included mouse or touch movements, scrolling, clicks, screen taps, zoom activity, and engagement time.

According to the plaintiff’s expert, the tracking code activated when a visitor loaded the website, and data could be transmitted from the browser to Contentsquare’s servers.

This was not a case about whether Clarks had installed a conventional advertising cookie. The dispute concerned the acquisition of electronic communications and behavioral information by a third-party service provider.

That distinction matters because session-replay tools can observe interactions that ordinary page-view analytics do not capture.

Some platforms can collect form interactions, search activity, navigation sequences, and other detailed behavior. The precise information collected depends on the product and its configuration, including any masking or exclusion settings.

Captain Compliance previously examined these issues in its article Emerging Data Privacy Litigation Using Theories to Target Companies Using Customer Data, which discusses session replay, tracking pixels, and the use of older interception statutes against modern website technologies.

Pennsylvania’s Wiretap Law Allows Civil Claims for Website Tracking

Pennsylvania’s Wiretapping and Electronic Surveillance Control Act, codified at 18 Pa.C.S. §§ 5701–5782, generally prohibits specified intentional interceptions of electronic communications unless an exception applies.

Section 5703 addresses unlawful interception, disclosure, and use of protected communications.

Section 5704(4) provides an exception where all parties have given prior consent.

Unlike federal wiretap law, which generally recognizes a one-party consent exception, Pennsylvania’s provision requires consent from all parties for this exception.

WESCA also permits civil lawsuits under Section 5725.

A successful claimant may recover actual damages, subject to statutory liquidated-damages minimums, as well as punitive damages where warranted, reasonable attorney fees, and litigation costs.

The statute provides for liquidated damages of $100 per day of violation or $1,000, whichever is higher, as an alternative to actual damages.

These remedies are not automatic. A plaintiff must establish an actionable violation and entitlement to the requested relief.

Nevertheless, the availability of statutory damages and attorney fees can make website-tracking claims financially consequential even when the underlying activity involves routine retail browsing.

The Trial Court Initially Ruled for Clarks

The Washington County Court of Common Pleas granted summary judgment to Clarks in December 2025.

The trial court concluded that Thompson consented to the tracking because ordinary internet users understand that websites monitor activity and collect information.

In the trial court’s view, Thompson did not need to understand the specific technical process or know that Contentsquare was collecting information on Clarks’ behalf.

The act of using the website was treated as sufficient to establish consent.

The Pennsylvania Superior Court rejected that reasoning.

The appellate court distinguished between general awareness that websites collect information and legally meaningful notice that a third-party provider may acquire the contents of electronic communications.

Merely browsing the internet does not necessarily mean a visitor has consented to every form of third-party monitoring.

That distinction became central to the appeal.

The Superior Court Recognized a Potential Interception

The Superior Court examined the technical operation of Contentsquare and compared it with the Third Circuit’s earlier analysis in Popa v. Harriet Carter Gifts, Inc.

In Popa, the plaintiff alleged that a marketing technology company called NaviStone collected website activity through browser requests transmitted directly to the vendor’s servers.

The Third Circuit concluded that the fact that a browser transmitted information directly to the vendor did not automatically prevent the conduct from constituting an interception under WESCA.

The Pennsylvania Superior Court found the Contentsquare tracking allegations materially similar.

It concluded that the alleged tracking could constitute an interception under WESCA, consistent with the reasoning in Popa.

That is an important aspect of the ruling. The court did not merely say that Clarks needed a better privacy policy. It accepted, for purposes of its analysis, that the third-party tracking activity could fall within Pennsylvania’s interception statute.

The decisive remaining issue was consent.

The most commercially important part of Thompson concerns the difference between a privacy policy that exists and one that provides legally sufficient notice.

Clarks argued that its privacy policy disclosed the use of third-party technologies and was accessible through a hyperlink in the website footer.

The company relied heavily on Popa v. Harriet Carter Gifts, where a federal district court had found that a reasonably conspicuous privacy policy could establish implied consent under WESCA.

The Pennsylvania Superior Court agreed with that general legal principle.

In fact, the court expressly recognized that a reasonably conspicuous browsewrap privacy policy may be sufficient to establish implied consent when it adequately explains the data collection at issue.

The court did not require affirmative opt-in consent in every circumstance. It recognized that implied consent remains available under Pennsylvania law.

But Clarks had a problem: the evidence in the record did not adequately establish how its privacy policy appeared on the website during Thompson’s visits.

The company argued that the policy link was conspicuous and positioned in the footer, but its description of that placement was disputed and insufficiently supported by the record.

The court therefore could not determine that Clarks had established consent as a matter of law.

The Superior Court vacated summary judgment and remanded the case.

This was an evidentiary failure at summary judgment, not a final determination that the privacy policy was inadequate or that Thompson never consented.

Why the Popa Decisions Matter

The Thompson opinion devoted considerable attention to the procedural history of Popa v. Harriet Carter Gifts, a closely related Pennsylvania website-tracking case.

That history is more complicated than a simple plaintiff victory or defense victory.

In Popa II, 52 F.4th 121 (3d Cir. 2022), the Third Circuit rejected the argument that a third-party vendor necessarily avoids interception liability simply because a browser communicates directly with its servers.

The court remanded the case for further consideration of whether the plaintiff had consented through the website’s privacy policy.

On remand, the federal district court ruled for the defendants in Popa III, 772 F. Supp. 3d 592 (W.D. Pa. 2025).

The district court found that the website’s privacy statement adequately disclosed third-party data collection and was reasonably conspicuous.

The policy was linked in a contrasting color against the website’s footer, and the evidence included a screenshot demonstrating its placement.

The district court concluded that this supported constructive notice and implied consent.

But the litigation did not end there.

In March 2026, the Third Circuit vacated that judgment in Popa IV on Article III jurisdictional grounds, relying on its intervening decision in Cook v. GameStop, Inc., 148 F.4th 153 (3d Cir. 2025).

The court concluded that the plaintiff had not established the concrete injury required for federal jurisdiction and directed that the case be returned to state court.

That jurisdictional ruling did not resolve the underlying WESCA consent question.

The Pennsylvania Superior Court in Thompson acknowledged the vacatur and nevertheless found the district court’s earlier analysis of conspicuous notice persuasive.

This creates a useful distinction for companies defending website-tracking claims.

A privacy policy may support an implied-consent defense. But the company must be able to establish what the visitor could reasonably see and what the policy disclosed at the relevant time.

The Evidence Problem: Can a Company Prove What Its Website Looked Like Years Ago?

The Thompson case illustrates a recurring problem in website privacy litigation.

Websites change constantly.

Privacy policies are revised, cookie banners are redesigned, tag management configurations are updated, and marketing technologies are added or removed.

A company defending a claim concerning website activity in 2022 may have a perfectly functioning consent management system in 2026.

That current implementation does not necessarily establish what the plaintiff encountered four years earlier.

In Thompson, the evidence of historical privacy policy placement was insufficient to support summary judgment.

For businesses, the practical implication is that historical records may be as important as the privacy controls themselves.

A defensible compliance program should preserve the versions of the disclosures presented to visitors, the relevant consent configuration, and the technical controls that governed third-party scripts.

For example, a company should be able to reconstruct whether a visitor encountered a cookie banner, whether the privacy policy was accessible, which tracking technologies were active, and what consent state applied.

Where available, consent receipts, tag manager version histories, historical screenshots, and network testing records can help establish those facts.

Why Session Replay Creates Different Risks From Ordinary Analytics

Session replay is often marketed as a customer experience optimization tool.

Companies use it to identify broken checkout flows, confusing navigation, abandoned forms, and other usability problems.

Depending on the implementation, session-replay technology can record or reconstruct how a visitor interacts with a website.

That may include mouse movements, scrolling, clicks, text input, form interactions, and navigation between pages.

These capabilities can be valuable for website optimization, but they also create privacy questions that do not arise in exactly the same way with aggregate traffic reporting.

Consider the difference between an analytics event recording that a visitor viewed a product page and a session-replay tool capturing the sequence of interactions leading to that page.

The latter may reveal more about the visitor’s behavior, especially when combined with identifiers, account information, search terms, or sensitive form fields.

The legal analysis depends on what the technology actually collects and transmits.

Not every session-replay deployment captures keystrokes or sensitive form values. Many products offer masking, exclusion, and privacy controls.

Those settings must be verified rather than assumed.

Tools such as Contentsquare, Hotjar, FullStory, Microsoft Clarity, Mouseflow, Smartlook, and Lucky Orange should be assessed according to their actual configurations and data flows.

Businesses should also examine whether session replay operates on checkout pages, healthcare-related pages, account portals, and forms that may contain sensitive personal information.

The Thompson ruling does not declare those technologies unlawful. It reinforces that third-party behavioral monitoring can raise interception questions under Pennsylvania law.

Pennsylvania Joins the Broader Website Wiretapping Litigation Debate

California has received much of the attention surrounding website tracking lawsuits.

Plaintiffs have used the California Invasion of Privacy Act, particularly Penal Code § 631(a), to challenge advertising pixels, session replay, chat technologies, and third-party analytics.

But Pennsylvania’s WESCA provides a separate legal framework with its own statutory definitions, consent rules, and remedies.

The Thompson decision shows that website tracking claims are not confined to California.

A retailer headquartered outside Pennsylvania may still need to evaluate its exposure when Pennsylvania residents interact with its website, depending on the relevant facts and applicable law.

The ruling also raises a broader question for national businesses: can one consent management implementation adequately address different state interception laws and consumer privacy requirements?

An opt-out model may be appropriate for certain processing activities under some state consumer privacy laws. It should not be assumed to satisfy every all-party consent requirement governing electronic communications.

The applicable rules may depend on the type of information, the technology, the parties to the communication, and the timing and adequacy of consent.

Captain Compliance has previously examined the growth of these claims in CIPA Website Tracking Lawsuits: What a Pen Register Claim Is, Who’s Being Sued, and How to Defend Your Website.

Although the California and Pennsylvania statutes differ, the underlying technical disputes frequently overlap.

Both can involve questions about when scripts execute, what information third parties receive, and whether the visitor provided legally sufficient consent.

What Businesses Should Change After Thompson v. Clarks

The decision does not require every website to adopt the same consent interface. It does, however, provide a clear reason to evaluate whether the company’s disclosures and technical controls can withstand scrutiny years after a visitor’s alleged interaction.

Make Privacy Disclosures Conspicuous

A privacy policy buried in an obscure location creates unnecessary evidentiary risk.

Businesses should evaluate the placement, contrast, labeling, and accessibility of their privacy notices.

A prominent cookie consent banner can provide an additional opportunity to inform visitors about tracking technologies and available privacy choices.

However, the banner’s existence is not proof that every script is lawfully operating. The language must accurately describe the practices, and the relevant consent rules must be satisfied.

Control Session-Replay Scripts Before They Execute

Companies should identify whether session-replay scripts begin collecting information immediately upon page load.

Where prior consent is required, the underlying scripts should be prevented from executing until the appropriate consent signal is received.

Google Tag Manager and similar tag management systems can help enforce these rules when configured to respond to consent management platform signals.

Script-level blocking is especially important because preventing a cookie from being stored does not necessarily prevent a third-party network request.

The correct implementation must address the actual data transmission.

A business should retain evidence of the banner and privacy notice presented to visitors.

That evidence may include the banner version, consent categories, jurisdictional rules, timestamps, preference selections, and relevant technical configurations.

The objective is to establish not merely that the company had a privacy program, but what that program actually did at the time of the alleged interaction.

Review Vendor Contracts and Data Flows

The Thompson record included a Contentsquare agreement describing the categories of data the vendor processed and the service levels it provided.

Vendor contracts can therefore become important evidence in website-tracking litigation.

Businesses should examine the types of information their vendors collect, whether those vendors act solely as service providers, whether data is used for independent purposes, and whether sensitive information is excluded.

A contract describing the vendor’s services is not a substitute for testing the actual implementation.

Preserve Historical Website Evidence

When a website changes its CMP, privacy notice, or tracking configuration, the business should preserve relevant version records.

Those records may become important if a claimant alleges that a script operated without consent months or years earlier.

A current screenshot cannot reliably establish historical website behavior.

That problem was central to the result in Thompson.

How Captain Compliance Helps Businesses Address WESCA and Website Tracking Risk

The Thompson decision illustrates why privacy compliance requires more than a published policy.

Businesses need to provide meaningful notice, enforce applicable consent requirements, and maintain records showing how those controls operated.

Captain Compliance provides consent management, cookie scanning, dynamic cookie policies, privacy notices, and consumer privacy rights tools designed to help businesses manage these requirements.

Its consent management platform can be configured to present jurisdiction-specific privacy choices and communicate consent states to website technologies.

Technical implementations can include cookie blocking and script-level controls to help prevent non-essential tracking technologies from executing before the applicable consent requirements are satisfied.

Captain Compliance’s scanning and monitoring capabilities can also help identify tracking technologies that have been added or changed after the original deployment.

For businesses facing litigation or demand letters, technical documentation can be particularly valuable. Consent records, historical configurations, scan findings, and network testing may help counsel evaluate whether a claimant’s allegations match the website’s actual operation.

These tools do not automatically establish implied consent under WESCA or eliminate the need for a legally adequate privacy notice. Their effectiveness depends on the deployment, configuration, and applicable law.

What Happens Next in Thompson v. C. & J. Clark America?

The Pennsylvania Superior Court vacated the December 2025 summary judgment entered in Clarks’ favor and returned the case to the trial court.

The appellate court did not determine that Thompson was entitled to damages or that Clarks’ privacy policy was legally insufficient.

Instead, it found that the evidence did not establish the absence of a genuine factual dispute concerning consent.

The ruling leaves open whether Clarks can ultimately prove that visitors received adequate notice of Contentsquare’s collection practices and whether the asserted WESCA claim will succeed.

For plaintiffs, the decision provides authority recognizing that third-party session-replay activity can constitute an interception under Pennsylvania law and that generalized assumptions about internet use do not automatically establish consent.

For defendants, the court also recognized that reasonably conspicuous privacy policies may support implied consent. The difficulty for Clarks was proving the historical presentation of its policy.

A business may have a legitimate consent defense but still lose summary judgment if it cannot produce the evidence needed to establish it.

Organizations using session replay, advertising pixels, and other third-party tracking technologies should review both their consent architecture and the records they retain to substantiate it.