Harriet Carter Gifts and its marketing partner NaviStone Inc. won complete dismissal of a wiretap lawsuit in August 2022 after a federal appeals court ruled that website visitors had implicitly consented to data collection by accepting the company’s privacy policy. The case, Popa v. Harriet Carter Gifts Inc. (No.
21-2203, Third Circuit), centered on whether Harriet Carter violated Pennsylvania’s wiretap statute by tracking a customer’s browsing behavior—including searches for pet stairs, items added to cart, and checkout initiation—without explicit opt-in consent. The Third Circuit Court of Appeals sided with the retailer, finding that Ashley Popa had given valid consent simply by using the website, where the privacy policy was displayed in the footer. This ruling has significant implications for how online retailers can collect and share browsing data with third-party marketing services. The decision clarifies that companies do not need separate consent forms for data collection; a properly displayed privacy policy in a website footer—even in white text on a blue background—is sufficient legal disclosure under federal law. Understanding this case is essential for anyone considering whether they have grounds for a web tracking privacy claim and for evaluating the current state of consumer privacy protections online.
Table of Contents
- What Was the Harriet Carter Gifts Lawsuit Really About?
- How Did the Court Rule That Harriet Carter Had Consent?
- What Are the Standards for Privacy Policy Disclosure?
- What Does This Ruling Mean for Consumers and Online Privacy?
- What Are the Limitations of the Harriet Carter Ruling?
- Are There Similar Web Tracking Cases and What Did They Decide?
- What Are the Broader Implications for Web Privacy Going Forward?
- Frequently Asked Questions
What Was the Harriet Carter Gifts Lawsuit Really About?
Ashley Popa filed a lawsuit against Harriet Carter Gifts Inc. and NaviStone Inc., alleging that the companies unlawfully intercepted her browsing data when she visited Harriet Carter’s website in 2018. Specifically, Popa claimed that the retailer and its marketing partner engaged in real-time tracking of her online activity—capturing her search for pet stairs, her addition of items to her shopping cart, and her progression through the checkout process.
The lawsuit asserted that this monitoring violated Pennsylvania’s wiretap statute, which prohibits the interception of electronic communications without consent. The case raises the broader question of whether browsing behavior constitutes “electronic communications” protected by wiretap laws, and whether website visitors must provide explicit, affirmative consent before companies can track their activity. Many consumers assume that tracking requires an opt-in checkbox or explicit agreement, similar to email notifications or text messages. However, the Third Circuit’s decision fundamentally challenged this assumption by recognizing that consent can be implicit—derived from a user’s acceptance of visible privacy terms.
How Did the Court Rule That Harriet Carter Had Consent?
The federal court found that Harriet Carter Gifts had disclosed its data collection practices to users through a privacy policy that was publicly accessible on every page of the website. The policy was displayed in the website footer in white font on a blue background, a design consistent with industry standards in 2018. By simply visiting the website and continuing to browse, shop, and proceed through checkout, the plaintiff had implicitly consented to the terms outlined in that privacy policy. This “implicit consent” theory—rather than requiring explicit, separate consent—became the foundation for dismissing the wiretap claim.
However, the implication of this ruling is significant: it establishes that companies meeting basic transparency standards may not need additional consent mechanisms for standard web tracking practices. The court essentially ruled that placing privacy disclosures in visible footer text satisfies the legal requirement to inform users about data collection. This does not mean privacy policies can be hidden or buried in deliberately obscure language, but it does mean that standard website footer placements are generally considered adequate notice. Many privacy advocates argue this sets a relatively low bar for what constitutes meaningful consent, particularly for users who may not read or fully understand privacy policies.
What Are the Standards for Privacy Policy Disclosure?
The Harriet Carter ruling relied heavily on the visibility and accessibility of the company’s privacy policy. The white-on-blue footer link was deemed sufficient disclosure under federal law because it was present on every page of the website and did not require a user to take unusual steps to find it. This is important context: the court was not ruling on whether a privacy policy buried on a separate page, hidden behind multiple clicks, or presented in unreadable text would be sufficient.
The standard appears to be reasonable accessibility and visibility. For a privacy policy to meet legal standards as evidence of implicit consent, it should be: (1) readily accessible from all pages of the website, (2) displayed in readable format and reasonably visible font size, and (3) written in clear language that explains what data is collected and how it is used. The Harriet Carter case involved a straightforward footer link, but other formats—such as a notice at the top of the page or a banner upon first visit—would likely satisfy this standard as well. The key distinction is that the policy must be discoverable without excessive friction, and the company cannot rely on users somehow magically knowing about data collection practices through silent inference alone.
What Does This Ruling Mean for Consumers and Online Privacy?
From a consumer perspective, the Harriet Carter decision represents a significant limitation on privacy rights. If a user must affirmatively opt out of tracking or provide explicit consent to have their activity monitored, the legal burden shifts entirely to them. Instead, the court has endorsed a framework in which companies can track user behavior by default, with privacy protections limited to those spelled out in footer disclosures. For consumers shopping at retailers, using e-commerce platforms, or browsing the web, this means that your browsing history, search queries, cart contents, and checkout behavior are likely being collected and shared with third-party marketing services—as long as some form of privacy policy exists on the website.
The ruling also illustrates the asymmetry between company and consumer: retailers and marketing platforms can collect detailed behavioral data to improve targeting and sales, while consumers face the practical challenge of reading and understanding dense privacy policies. Many privacy policies run thousands of words and are written in legal language designed to be technically accurate but not necessarily easy to comprehend. In the Harriet Carter case, the fact that Popa visited the website at all was deemed sufficient consent, even though she may not have read, understood, or genuinely agreed with the data collection practices described in the policy. This creates a scenario in which “consent” is largely a legal fiction—the website visitor was technically notified but may not have meaningfully understood or accepted the terms.
What Are the Limitations of the Harriet Carter Ruling?
While the Third Circuit’s decision was clear in this case, it does not settle all web tracking questions. The ruling specifically addressed the Pennsylvania wiretap statute and whether browsing data collection constitutes “interception” under that law. Other states have different privacy laws, and some may afford stronger protections. For example, California’s Consumer Privacy Act (CCPA) and similar state laws require different types of consent and disclosure for data collection. A company could win dismissal under federal wiretap statutes while still facing liability under state privacy laws.
Additionally, the ruling does not address emerging privacy concerns such as the use of tracking pixels, cross-site cookies, or fingerprinting technologies that may go beyond the standard web tracking practices described in traditional privacy policies. Another significant limitation: the court’s ruling assumes that the privacy policy accurately describes what data is collected. If a company’s actual data collection practices exceed what is disclosed in the policy, the implicit consent theory may not protect the company. In the Harriet Carter case, NaviStone’s tracking was consistent with what a privacy policy would be expected to disclose, making the consent framework straightforward. However, if a company is collecting more granular behavioral data, combining it with third-party information, or using it in unexpected ways not mentioned in the policy, that expanded tracking might not be covered by the limited consent found in a standard footer disclosure.
Are There Similar Web Tracking Cases and What Did They Decide?
The Harriet Carter case is one of several recent lawsuits challenging web tracking practices under various statutes. Some cases have taken different approaches to the consent question, leading to different outcomes. For example, some courts have been skeptical of the “implicit consent” framework when the data collection practices are particularly intrusive or when the privacy policy uses deliberately vague language. Conversely, other courts have followed the Harriet Carter reasoning and upheld web tracking when basic privacy disclosures exist.
The fragmentation of legal standards across courts and states creates an unpredictable environment for both consumers and companies. A tracking practice that is deemed lawful under federal wiretap statutes in one jurisdiction might face legal challenges in another. This underscores a broader tension in internet privacy: absent comprehensive federal privacy legislation, the legal landscape remains patchwork, with different standards in different circuits and states. Consumers harmed by tracking practices may have recourse in one state but not another, and companies operating nationally must navigate varying legal frameworks.
What Are the Broader Implications for Web Privacy Going Forward?
The Harriet Carter ruling suggests that courts may increasingly accept implicit consent based on visible privacy disclosures as a sufficient legal standard for web tracking, at least under federal wiretap statutes. This could reduce the legal exposure of companies engaged in standard behavioral marketing practices. However, it does not resolve the broader debate about whether this legal framework adequately protects consumer privacy in an era of sophisticated data collection and analysis.
Privacy advocates and policymakers continue to push for stricter standards, including mandatory opt-in consent for tracking (rather than opt-out), clearer and more concise privacy disclosures, and stronger data minimization requirements. The European Union’s approach under the General Data Protection Regulation (GDPR) already mandates explicit opt-in consent for many tracking practices. If similar standards are adopted in the United States—potentially through federal legislation or more aggressive state privacy laws—the current Harriet Carter framework could become outdated. In the near term, however, companies can likely continue standard web tracking practices with basic privacy policy disclosures.
Frequently Asked Questions
Does the Harriet Carter ruling mean companies can track me without asking permission?
Under federal wiretap statutes as interpreted in the Harriet Carter case, yes—provided the company displays a privacy policy disclosing the tracking. However, state privacy laws may impose different requirements, and you should check your state’s specific consumer privacy protections.
If I didn’t read the privacy policy, can I still claim I didn’t consent to tracking?
The court’s logic suggests that visibility and accessibility of the privacy policy is sufficient for consent, regardless of whether you actually read it. This is one of the most contested aspects of the ruling among privacy advocates.
Can I opt out of tracking on websites that have privacy policies?
Many websites provide opt-out mechanisms in their privacy policies, though opting out may affect website functionality or personalization. Harriet Carter’s specific opt-out options were not central to the court’s decision.
Does this ruling apply to all websites and all types of tracking?
The ruling is specific to federal wiretap statutes and the Third Circuit. Other courts may interpret the law differently, and other statutes (like state privacy laws) may impose stricter requirements. The ruling does not protect tracking that goes beyond what is disclosed in a privacy policy.
What should I do if I believe I’ve been tracked without consent?
Document the website, the tracking that occurred, and any privacy policy you were shown. Consult an attorney about whether your state’s privacy laws provide recourse, as federal wiretap protections were limited by the Harriet Carter decision.
Are there new privacy laws that might change this ruling’s impact?
Yes. Many states are adopting privacy laws similar to California’s CCPA, which require different consent standards. Federal privacy legislation is also under discussion, though none has passed as of 2026.
You Might Also Like
- Vail and Alterra Named in Antitrust Lawsuit Over Pass Pricing
- Providence Health and Services Data Breach Prompts Lawsuit Investigation
- Lawsuit Claims Meta Smart Glasses Monitoring Users Despite Promises
Open Settlements You Can Claim Now
Browse current class action settlements accepting claims — several require no proof of purchase: