Hartley Dismissal Rewards Senders With Consent

Since December 2023, around a dozen class actions have been filed in federal district courts nationwide under the same Arizona statute, all claiming that email open tracking is illegal.¹ At least two of them, Hartley and Mills, have pending motions to dismiss. Hartley is the first to be decided, and the court's reasoning turns on a fact every sender controls: whether the recipient asked for the mail.²

The plaintiffs say a tracking pixel procures a communication service record

These cases allege that retailers violated an Arizona law written to fight pretexting.³ The theory is that open tracking pixels (called "spy pixels" in the complaints I've read) violate the provision that makes it unlawful to "[k]nowingly procure . . . [a] communication service record" of an Arizona resident "without the authorization of the customer."⁴ The statute defines "communication service record" to include "subscriber information" such as a person's "name, . . . electronic account identification and associated screen names . . . or access logs," as well as "records of the path of an electronic communication between the point of origin and the point of delivery and the nature of the communication service provided, such as . . . electronic mail . . . or other service features."⁵

The plaintiffs argue that the data a tracking pixel returns is a "communication service record," and that the sender needs the recipient's consent to generate it. In other words, receiving data directly from the email's recipient is "procuring" a record.

The court found no concrete injury because she opted in

Tomi Hartley, an Arizona resident, sued Urban Outfitters in Pennsylvania, where the company is headquartered. She claimed her privacy rights were violated when Urban Outfitters learned when, or whether, she opened its commercial email.⁶ Urban Outfitters moved to dismiss on two grounds. The first was that she lacked standing because her alleged injury was not "concrete."⁷ The second was that, even taking everything she said as true, she had not stated a claim the court could grant relief on.

The court agreed with the first argument and never reached the second. The case was dismissed, with 21 days for the plaintiff to file an amended complaint that fixed the problem.

In my opinion, this is the key paragraph:

As a matter of law, the Court concludes that digital records reflecting merely the dates and times at which Plaintiff opened promotional emails she signed up to receive, and the length of time she spent reading them, are not sufficiently personal to support a concrete injury. Like a users' keystrokes and mouse clicks upon voluntarily visiting a retailers' website, these details are entitled to less privacy protection by virtue of Plaintiff's decision to opt into receiving and reading the emails.⁸

The judge found it significant that Urban Outfitters had her consent before it emailed her. That consent changed how much protection the information deserved. The point gets sharper in the court's treatment of the Telephone Consumer Protection Act, which the plaintiff used to argue that a legislature can create a cause of action for a harm the common law did not recognize:

The Third Circuit's decision in Susinno v. Work Out World Inc. is instructive. In Susinno, the court considered . . . a claim under the Telephone Consumer Protection Act ("TCPA") based on a single, unsolicited call from a fitness company resulting in a prerecorded, one-minute promotional offer left on a consumer's voicemail. The court acknowledged that a single call would likely not be "highly offensive to a reasonable person," and therefore not actionable at common law. Nevertheless, the court concluded that a concrete injury had been alleged because Congress, by enacting the TCPA, elevated a harm "'previously inadequate in law,' [that] was of the same character of previously existing 'legally cognizable injuries.'" Critically, however, the robocall in Susinno was unsolicited. The relationship in that case—between an unwelcome advertiser and a consumer who wanted to be left alone—is materially distinguishable from Plaintiff's relationship with Defendant here, as she not only opted in to receiving emails from Defendant by joining its subscriber list, but continued to consume its promotional materials by regularly opening them.⁹

Senders who get permission before adding someone to a list are better protected from this kind of claim than senders who don't. I believe judges in the other cases will find this reasoning persuasive, and I expect to see more of these dismissals in the coming months.

ESPs that enforce consent are protecting their customers and themselves

Most reputable ESPs contractually require customers to get consent before sending. That requirement is what gave the retailer its protection here. Retailers are also not the only defendants in these suits. ESPs have been named too.¹⁰

An ESP that doesn't enforce its consent requirements is doing its customers a disservice. Being able to show that it actually enforces them may also protect the ESP from claims under the Arizona law better than pointing to a contract clause telling customers to "abide by all applicable laws and regulations."

Cold email loses the protection that saved Urban Outfitters

Cold email is, by definition, sent without the recipient's consent. If Ms. Hartley had sued a company that added her to its list without asking, the court's comparison to Susinno would have come out the other way. The relationship would have been the unwelcome advertiser and the consumer who wanted to be left alone, and the concreteness standard would likely have been met.

Sending commercial email without consent has always carried deliverability risk. Hartley suggests that cold email combined with open tracking may carry liability under this Arizona statute as well, and the only thing standing between a sender and that exposure is whether the recipient said yes.

This post does not constitute legal advice. Readers should consult competent legal counsel before taking action based on the analysis presented here.