Popa v. Microsoft Corporation

FOR PUBLICATION UNITED STATES COURT OF APPEALS FOR THE NINTH CIRCUIT ASHLEY POPA, individually and on No. 24-14 behalf of all others similarly situated, D.C. No. 2:23-cv-00294- Plaintiff - Appellant, JLR v. OPINION MICROSOFT CORPORATION, Defendant - Appellee. Appeal from the United States District Court for the Western District of Washington James L. Robart, District Judge, Presiding Argued and Submitted January 16, 2025 Pasadena, California Filed August 26, 2025 Before: JOHNNIE B. RAWLINSON and MILAN D. SMITH, JR., Circuit Judges, and JED S. RAKOFF, District Judge. * Opinion by Judge Jed S. Rakoff * The Honorable Jed S. Rakoff, United States District Judge for the Southern District of New York, sitting by designation. 2 POPA V. MICROSOFT CORPORATION SUMMARY ** Article III Standing The panel affirmed the district court’s order dismissing for lack of Article III standing Ashley Popa’s diversity putative class action against Microsoft Corporation concerning the use of session-replay technology. Session-replay technology allows a business to capture and reproduce customers’ interactions with its website. Popa encountered session-replay technology during a visit to http://petsupplies.com. The website’s operator employed the session-replay technology known as “Clarity,” which is owned and operated by Microsoft. The panel held that Popa failed to allege a “concrete” injury sufficient to support Article III standing. In determining whether a plaintiff’s injury is concrete, TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), requires a court to assess whether an individual plaintiff has suffered a harm that has traditionally been actionable in our nation’s legal system. Popa pointed to the common-law privacy torts of intrusion upon seclusion and public disclosure of private facts, but both analogies faltered. Popa did not explain how the tracking of her interactions with the website caused her to experience any kind of harm remotely similar to the highly offensive interferences or disclosures that were actionable at common law. ** This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader.  POPA V. MICROSOFT CORPORATION 3 COUNSEL Connor P. Hayes (argued), Jamisen A. Etzel, and Gary F. Lynch, Lynch Carpenter LLP, Pittsburgh, Pennsylvania; Kim D. Stephens, Tousley Brain Stephens PLLC, Seattle, Washington; for Plaintiff-Appellant. Eric B. Wolff (argued), Nicola Menaldo, and Anna M. Thompson, Perkins Coie LLP, Seattle, Washington; James G. Snell, Perkins Coie LLP, Palo Alto, California; for Defendant-Appellee. Aileen McGrath and Zach Z. Tan, Akin Gump Strauss Hauer & Feld LLP, San Francisco, California; Deborah R. White and Larissa M. Whittingham, Retail Litigation Center Inc., Washington, D.C.; for Amicus Curiae Retail Litigation Center. Jeremy J. Broggi, Megan L. Brown, and Joel S. Nolette, Wiley Rein LLP, Washington, D.C.; Jonathan D. Urick and Maria C. Monaghan, U.S. Chamber Litigation Center, Washington, D.C.; Cory L. Andrews and John M. Masslon II, Washington Legal Foundation, Washington, D.C.; Christopher J. Marchese and Paul D. Taske, NetChoice LLC, Washington, D.C.; Lartease M. Tiffith, Interactive Advertising Bureau; for Amici Curiae The Chamber of Commerce of the United States of America, Washington Legal Foundation, NetChoice LLC, and The Interactive Advertising Bureau. 4 POPA V. MICROSOFT CORPORATION OPINION RAKOFF, District Judge: This case centers on the use of so-called “session-replay technology.” In simple terms, session-replay technology allows a business to capture and reproduce customers’ interactions with its website. More technically, the software “embed[s] snippets of JavaScript computer code” on a website, “which then deploys on each website visitor’s internet browser for the purpose [of] intercepting and recording the website visitor’s electronic communications with the . . . website, including their mouse movements, clicks, keystrokes . . . , URLs of web pages visited, and/or other electronic communications in real-time.” The session- replay provider then “use[s] those [w]ebsite [c]ommunications to recreate website visitors’ entire visit to” the website. A business utilizing this technology can then access useful consumer data, including “detailed heatmaps of a website that provide information about which elements of a website have high user engagement, how far website users scrolled on the website, and the total clicks within a given area on the website.” In essence, session-replay technology helps a business to determine which parts of its website are effective with customers and which are not. Plaintiff Ashley Popa encountered session-replay technology during a visit to https://www.petsuppliesplus.com. Defendant PSP Group LLC (“PSP”)—the website’s operator—employed on its website the session-replay technology known as “Clarity,” which is owned and operated by co-defendant Microsoft Corp. (“Microsoft”). According to the amended complaint, “Clarity organizes the information it captures into over 30  POPA V. MICROSOFT CORPORATION 5 different categories including: the date a user visited the website, the device the user accessed the website on, the type of browser the user accessed the website on, the operating system of the device used to access the website, the country where the user accessed the website from, a user’s mouse movements, a user’s screen swipes, text inputted by the user on the website, and how far down a webpage a user scrolls.” Popa focuses her allegations on specific pieces of information allegedly collected by Clarity. She states that during visits to PSP’s website, she “brow[s]ed for pet supplies” and “communicated with PSP’s website by using her mouse to hover and click on certain products.” She explains that “if a website user views a certain product offered for sale, that information is captured by Microsoft Clarity embedded on the website.” While Popa also alleges that a user’s mailing address is captured when entered for delivery information, the screenshot produced in the complaint indicates that masking software—a function that limits what information Clarity collects—omitted the street number and zip code. 1 She claims that “PSP and [s]ession [r]eplay [p]roviders use those [w]ebsite [c]ommunications to recreate website visitors’ entire visit to https://www.petsuppliesplus.com,” in order to “create a video replay of the user’s behavior on the website and provide it to PSP for analysis.” 1 The complaint describes “three standard approaches when it comes to masking sensitive information collected from a user’s interaction with a website”: “strict (all text entered by a user is purportedly masked), balanced (sensitive text entered into certain specifically pre-coded fields, such as passwords, and credit card information, is masked), and relaxed (no text entered by a user is masked).” Microsoft submitted a webpage— which was cited as a link in the complaint—that indicates that Clarity’s default setting is “balanced.” 6 POPA V. MICROSOFT CORPORATION In September 2022, Popa filed a complaint, on behalf of a proposed class of visitors to PSP’s website, in the United States District Court for the Western District of Pennsylvania. In February 2023, Popa filed an amended complaint. The amended complaint, which is the operative pleading, brings two claims against both PSP and Microsoft. Popa’s first claim arises under Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (“WESCA”), which grants a civil cause of action to an injured party against any person who, among other prohibited conduct, acquires “the contents of any wire, electronic or oral communication through the use of any electronic, mechanical or other device.” 18 Pa. Cons. Stat. §§ 5702, 5725. Popa also brings claims for “Invasion of Privacy – Intrusion Upon Seclusion” against both Microsoft and PSP. Soon after Popa amended her complaint, the district court granted Microsoft’s motion to transfer the case to the Western District of Washington. Several months later, in June 2023, both defendants moved to dismiss: PSP moved to dismiss under Rules 12(b)(1) and 12(b)(6) of the Federal Rules of Civil Procedure, while Microsoft moved only under Rule 12(b)(6). The district court concluded that “Popa has failed to establish that she has Article III standing to pursue her claims in federal court.” For that reason, the court granted PSP’s motion to dismiss for “lack of subject jurisdiction,” dismissed the action “without prejudice and with leave to amend,” and denied Microsoft’s Rule 12(b)(6) motion to dismiss “as moot.”2 To support its ruling, the district court 2 Because Article III standing is “jurisdictional and can neither be waived by the parties nor ignored by the court,” the district court’s dismissal applied to Popa’s claims against both defendants despite Microsoft’s  POPA V. MICROSOFT CORPORATION 7 cited decisions of other courts that have generally dismissed session-replay cases “where the plaintiffs failed to allege that the defendants’ tracking of their website interactions resulted in a concrete harm.” The court observed that the information allegedly collected by defendants “reveals nothing more than the products that interested . . . Popa and thus is not the type of private information that the law has historically protected.” Rather than further amend her complaint, Popa appealed the district court’s order. The parties timely submitted their briefs, and the Retail Litigation Center, the Chamber of Commerce, the Washington Legal Foundation, Netchoice, LLC, and the Interactive Advertising Bureau submitted briefs as amici curiae in support of defendants. On December 17, 2024, after PSP submitted a notice of a bankruptcy filing, we stayed the appeal “as to PSP Group, LLC,” but confirmed that “[o]ral argument will remain as scheduled for the remaining Defendant-Appellee,” Microsoft. We held oral argument on January 16, 2025. On August 5, 2025, Popa and PSP filed a stipulation dismissing Popa’s appeal as against PSP and expressly providing that Popa’s appeal as against Microsoft remains unaffected. We thereafter dismissed PSP as appellee. We review de novo a district court’s dismissal for lack of standing under Rule 12(b)(1) of the Federal Rules of Civil Procedure. Bowen v. Energizer Holdings, Inc., 118 F.4th 1134, 1142 (9th Cir. 2024). “As the party invoking federal jurisdiction, the plaintiff[] bear[s] the burden of failure to raise the issue in its own motion to dismiss. Yakima Valley Mem’l Hosp. v. Wash. State Dep’t of Health, 654 F.3d 919, 932 n.17 (9th Cir. 2011). 8 POPA V. MICROSOFT CORPORATION demonstrating that [she] ha[s] standing.” TransUnion LLC v. Ramirez, 594 U.S. 413, 430–31 (2021). This appeal turns on a single issue: whether Popa has alleged a “concrete” injury sufficient to support Article III standing. The doctrine of standing is grounded in Article III of the Constitution, which limits the federal judicial power to “Cases” and “Controversies.” U.S. Const. art. III, § 2. “The doctrine developed . . . to ensure that federal courts do not exceed their authority as it has been traditionally understood,” by “limit[ing] the category of litigants empowered to maintain a lawsuit in federal court to seek redress for a legal wrong.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (citation omitted). Thus, “[f]or there to be a case or controversy under Article III, the plaintiff must have a ‘personal stake’ in the case—in other words, standing.” TransUnion, 594 U.S. at 423 (internal quotation marks and citation omitted). Over time, the Supreme Court has identified three elements to ensure that a plaintiff has the required “personal stake”: (1) the plaintiff must have suffered an “injury in fact” that is both “concrete and particularized” and “actual or imminent”; (2) “there must be a causal connection between the injury and the conduct complained of” (often described as whether the injury is “fairly traceable” to the challenged conduct); and (3) “it must be likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992) (internal quotation marks and citations omitted). This case concerns the first element, and particularly the requirement that a plaintiff’s injury be “concrete.” A “concrete” injury “must actually exist”; put differently, it  POPA V. MICROSOFT CORPORATION 9 must be “real, and not abstract.” Spokeo, 578 U.S. at 340 (internal quotation marks and citation omitted). The Supreme Court has, in recent years, made this requirement even more definite. For example, in Spokeo, the plaintiff sued a website under the Fair Credit Reporting Act of 1970 (“FCRA”) for generating a profile that contained inaccurate personal information. Id. at 335–36. In the opinion below, our court had concluded that the plaintiff satisfied the injury-in-fact element of standing by alleging that “[the defendant had] violated [the plaintiff’s] statutory rights, not just the statutory rights of other people.” Id. at 337 (internal quotation marks and citation omitted). The Supreme Court, however, clarified that our observations concerned whether the injury was particularized, but not whether it was concrete. Id. at 339–40. In drawing this distinction, the Court outlined the central characteristics of concreteness: “A ‘concrete’ injury must be ‘de facto’; that is, it must actually exist.” Id. at 340 (citation omitted). Further, to determine “whether an intangible harm constitutes injury in fact,” the Court stated, “both history and the judgment of Congress play important roles.” Id. (emphasis added). But the Court cautioned that “Congress’ role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Id. at 341. In other words, “Article III standing requires a concrete injury even in the context of a statutory violation.” Id. The Court ultimately remanded the case so that we could determine “whether the particular procedural violations alleged . . . entail a degree of risk sufficient to meet the concreteness requirement.” Id. at 342–43. 10 POPA V. MICROSOFT CORPORATION Around five years later, the Court again addressed concreteness in TransUnion, another appeal from our court. In that case, we had given standing to an entire class of plaintiffs, suing under the FCRA, who alleged that defendant TransUnion included a notice on their credit reports that misleadingly indicated that they were a “potential match” to a “specially designated national” (e.g., terrorists, drug traffickers, and other serious criminals) on a list maintained by the U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”). TransUnion, 594 U.S. at 419–22. However, because only a fraction of the class had their misleading credit reports disclosed to third-party businesses during the relevant time period, the Supreme Court reversed our decision below, holding that only this limited group had standing. 3 Id. at 417–18. The Court’s analysis identified history as the touchstone for concreteness. Specifically, it explained that the “Court’s opinion in Spokeo . . . indicated that courts should assess whether the alleged injury to the plaintiff has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a lawsuit in American courts.” Id. at 424 (citation omitted). “That inquiry asks whether plaintiffs have identified a close historical or common-law analogue for their asserted injury.” Id. And while the Court acknowledged that “Spokeo does not require an exact duplicate in American history and tradition,” it cautioned that “Spokeo is not an open-ended invitation for federal courts to loosen Article III based on contemporary, 3 The Supreme Court also concluded that there was “no reason or basis to disturb the lower courts’ conclusion on [the named plaintiff’s] individual standing as to” two claims related to alleged formatting defects in certain mailings sent by the defendant. TransUnion, 594 U.S. at 439–40 & n.8.  POPA V. MICROSOFT CORPORATION 11 evolving beliefs about what kinds of suits should be heard in federal courts.” Id. at 424–25. The Court in TransUnion also addressed the limits on Congress’s power to confer standing. According to the Court, Congress’s perspective may be “instructive,” and it may “elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.” Id. at 425 (internal quotation marks and citation omitted). “But even though Congress may elevate harms that exist in the real world before Congress recognized them to actionable legal status, it may not simply enact an injury into existence, using its lawmaking power to transform something that is not remotely harmful into something that is.” Id. at 426 (internal quotation marks and citation omitted). The Court thus distinguished between “(i) a plaintiff’s statutory cause of action to sue a defendant over the defendant’s violation of federal law, and (ii) a plaintiff’s suffering concrete harm because of the defendant’s violation of federal law.” Id. at 426–27. The Court summarized: “[U]nder Article III, an injury in law is not an injury in fact.” Id. at 427. The Court’s analysis of the plaintiffs’ claims in TransUnion also concentrated on the match between the injury that they allegedly experienced and the kinds of harms that were actionable at common law. In particular, the Court considered whether the plaintiffs had experienced harm similar to “the reputational harm associated with the tort of defamation.” Id. at 432. On the one hand, the Court rejected the defendant’s argument that the plaintiffs had not experienced a defamation-like harm because the statement that the plaintiffs were “potential terrorists” was only misleading and not literally false. Id. at 433 (emphasis added). Emphasizing that the analysis does not require “an 12 POPA V. MICROSOFT CORPORATION exact duplicate,” the Court explained that “the harm from a misleading statement of this kind bears a sufficiently close relationship to the harm from a false and defamatory statement.” Id. The absence of dissemination, on the other hand, was fatal to the claims of those plaintiffs whose misleading credit reports had not been shared with a third party. The Court reasoned that “there is no historical or common-law analog where the mere existence of inaccurate information, absent dissemination, amounts to concrete injury.” Id. at 434 (internal quotation marks and citation omitted). In other words, “[t]he mere presence of an inaccuracy in an internal credit file, if it is not disclosed to a third party, causes no concrete harm.” Id. Our sister circuits have diverged, at least in part, in their interpretation of Spokeo and TransUnion, developing different tests for determining whether a plaintiff’s injury is concrete. Some circuits have considered whether a plaintiff’s harm satisfies each element required to state a common-law cause of action. See, e.g., Hunstein v. Preferred Collection & Mgmt. Servs., Inc., 48 F.4th 1236, 1241, 1245–46 (11th Cir. 2022) (en banc) (finding no concrete injury because the plaintiff’s harm from an alleged statutory violation did not satisfy the element of “[p]ublicity” for a public-disclosure- of-private-facts claim). Others have adopted a less rigid approach that focuses on whether the harm experienced by a plaintiff is similar in kind to a harm protected by one of the common-law privacy torts. See, e.g., Barclift v. Keystone Credit Servs., LLC, 93 F.4th 136, 143–45 (3d Cir. 2024) (distinguishing between “an element-based approach” and a “kind of harm” test, and concluding that “when asking whether a plaintiff’s intangible injury is ‘concrete,’ we will examine the kind of harm at issue”); see also Baysal v. Midvale Indem. Co., 78 F.4th 976, 979 (7th Cir. 2023)  POPA V. MICROSOFT CORPORATION 13 (explaining that drivers’ license numbers did not constitute “the sort of potentially embarrassing or intimate details” covered by the common-law privacy torts). While the precise formulation of the test has sparked some inter-circuit division, 4 these approaches all share an important feature: they look to the specific underlying harm experienced by the plaintiff and compare it, in detail, to a specific common-law tort. At base—and all we need to acknowledge to decide this case—is that TransUnion requires a court to assess whether an individual plaintiff has suffered a harm that has traditionally been actionable in our nation’s legal system. Recognizing that TransUnion contemplates a standing inquiry particularized to a plaintiff’s circumstances and benchmarked to a specific tort, we conclude that Popa has not met her burden to demonstrate that she has standing. Popa briefly points to the common-law privacy torts of intrusion upon seclusion and public disclosure of private facts. Both analogies falter for the same reason. To show intrusion upon seclusion, a plaintiff must show “an intentional interference with his interest in solitude or seclusion, either as to his person or as to his private affairs or concerns, of a kind that would be highly offensive to a reasonable man.” Nayab v. Cap. One Bank (USA), N.A., 942 F.3d 480, 491 (9th Cir. 2019) (emphasis added) (quoting Restatement (Second) of Torts § 652B cmt. a (Am. Law Inst. 4 The Third Circuit has recognized that the “element-based approach” and “kind of harm” test can overlap in practice. See Barclift v. Keystone Credit Servs., LLC, 93 F.4th 136, 146 n.4 (3d Cir. 2024) (“We acknowledge that there is overlap between the nature of the traditional harm (humiliation stemming from the public disclosure of offensive information) and an element of the traditional tort (publicity). This is because a disclosure that remains nonpublic is unlikely to result in the type of humiliation associated with the traditional injury.”). 14 POPA V. MICROSOFT CORPORATION 1977)). Similarly, a claim for public disclosure of private facts requires that a defendant “gives publicity” to a matter that concerns “the private life of another,” that the information is “highly offensive to a reasonable person,” and that the information is not of legitimate public concern. Restatement (Second) of Torts § 652D (emphasis added). Popa does not explain how the tracking of her interactions with the PSP website caused her to experience any kind of harm that is remotely similar to the “highly offensive” interferences or disclosures that were actionable at common law. Of course, an “exact duplicate” is not required, and many courts require a match only in the kind of harm and not the degree. But Popa identifies no embarrassing, invasive, or otherwise private information collected by Clarity. Indeed, the monitoring of Popa’s interactions with PSP’s website seems most similar to a store clerk’s observing shoppers in order to identify aisles that are particularly popular or to spot problems that disrupt potential sales. This is quite different from the hypotheticals set out in the Restatement. Consider, for example, the following scenario for intrusion upon seclusion: “A . . . rents a room in a house adjoining B’s residence, and for two weeks looks into the windows of B’s upstairs bedroom through a telescope taking intimate pictures with a telescopic lens.” Restatement (Second) of Torts § 652B cmt. b, illus. 2. Or, to take an example for public disclosure of private facts: “A publishes, without B’s consent, a picture of B nursing her child.” Restatement (Second) of Torts § 652D cmt. c, illus. 10. Microsoft’s conduct in this case does not implicate a similarly sensitive sphere. At most, Popa alleges that Clarity gathered her pet-store preferences and her street name. To the extent Microsoft’s tracking software could be  POPA V. MICROSOFT CORPORATION 15 offensive in particular circumstances (e.g., involving sensitive medical or financial information), Popa does not plausibly allege the infringement of any such privacy interest. 5 To avoid this conclusion, Popa contends that because the Pennsylvania legislature enacted a statute protecting a substantive privacy right, any plaintiff alleging a violation of that statute will satisfy Article III. As an initial matter, that analysis reverts to a pre-TransUnion (even pre-Spokeo) approach that favors a legislative body’s views in the aggregate over a plaintiff’s individual circumstances. And while that position has the support of a minority of justices on the Supreme Court and some lower-court judges, see, e.g., TransUnion, 594 U.S. at 442–60 (Thomas, J., dissenting); Baysal, 78 F.4th at 980–90 (Ripple, J., dissenting), TransUnion clearly cautions courts not to “treat an injury as ‘concrete’ for Article III purposes based only on Congress’s say-so,” TransUnion, 594 U.S. at 426 (internal quotation marks and citation omitted); see also Spokeo, 578 U.S. at 341 (“Article III standing requires a concrete injury even in the context of a statutory violation.”). Moreover, Popa’s broad theory that the common law protected privacy rights—pitched at a high level of generality—does not align with the analysis adopted in 5 To be sure, the complaint identifies potential harms that might be associated with session-replay technology, such as identity theft. But the complaint includes no allegations plausibly linking these potential, generalized harms to the operation of Clarity on PSP’s website vis-à-vis Popa. Popa also mentions trespass as a potential common-law analog twice in her opening brief, without any additional explanation. But she never identifies what possessory interest Microsoft invaded. Indeed, Clarity—at least according to the complaint—appears to operate on PSP’s website rather than on an individual’s computer. 16 POPA V. MICROSOFT CORPORATION TransUnion. There, the Court considered carefully the key elements that shape the harm proscribed by the common-law tort of defamation (namely, falsity and publication), grouped plaintiffs who alleged similar facts, and assessed whether the specific plaintiffs had experienced harm of that nature. The Court determined that some plaintiffs had standing to bring a claim under the statute while others did not—an implicit rejection of a one-size-fits-all approach. In addition, rather than describe a general right to privacy, the Court in TransUnion specifically cited “reputational harms, disclosure of private information, and intrusion upon seclusion” as examples of “harms traditionally recognized as providing a basis for lawsuits in American courts.” TransUnion, 594 U.S. at 425. Similarly, the Seventh Circuit recently denied a generalized “invasion-of-privacy” theory, explaining that “at common law an invasion of the right to privacy has traditionally encompassed four distinct torts: intrusion upon seclusion, appropriation of another person’s name or likeness, publicity given to another person’s private life, and publicity that places one in a false light.” Nabozny v. Optio Sols. LLC, 84 F.4th 731, 735 (7th Cir. 2023) (emphasis added). In short, there existed no free-roaming privacy right at common law but rather four discrete torts that protected specific kinds of privacy-related harms. And, as explained supra, Popa has not identified a harm that she experienced that is remotely similar to those protected by these torts. Popa next turns to caselaw in this circuit to support her argument that a plaintiff necessarily enjoys Article III standing when suing under a statute that protects a substantive right to privacy. She relies on two pre- TransUnion cases—Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017), and In re Facebook, Inc. Internet  POPA V. MICROSOFT CORPORATION 17 Tracking Litigation, 956 F.3d 589 (9th Cir. 2020)—that she claims “affirm the straightforward principle at the heart of this appeal: the violation of a statute codifying a common- law privacy harm is sufficient to confer Article III standing.” In support of her position that TransUnion did not undermine those cases, she emphasizes that Jones v. Ford Motor Co., 85 F.4th 570 (9th Cir. 2023) (per curiam)— decided after TransUnion—relied on Eichenberger and In re Facebook. Based on this precedent, Popa insists that “a violation of the WESCA is an intangible concrete harm.” In Jones, this Court explained that “the relevant law is settled”: “A statute that codifies a common law privacy right ‘gives rise to a concrete injury sufficient to confer standing.’” Id. at 574 (quoting In re Facebook, 956 F.3d at 598). It added that “this court has consistently found that ‘[v]iolations of the right to privacy have long been actionable at common law.’” Id. (alteration in original) (quoting Eichenberger, 876 F.3d at 983). Importantly, Jones was decided after TransUnion, and these excerpts could be read, at least at first glance, to support Popa’s position that broad privacy rights, enshrined in a statute, satisfy concreteness as a matter of course. But we decline to interpret Jones as establishing the categorical rule that Popa would propose. First, the question of concreteness under TransUnion was not clearly presented in that case. Of course, we have an independent obligation to assure ourselves of our jurisdiction, but our statements touching on an issue that was not clearly presented are not entitled to the same weight as carefully reasoned analysis of the issue. Cf. Leeson v. Transamerica Disability Income Plan, 671 F.3d 969, 979 (9th Cir. 2012) (“We have . . . specifically noted that drive-by jurisdictional rulings lack precedential force.”) (citations omitted). 18 POPA V. MICROSOFT CORPORATION Second, despite its generalization about privacy statutes, Jones still implicitly evaluated, as TransUnion mandates, whether the specific plaintiffs had suffered a concrete injury. The complaint in Jones alleged that plaintiffs’ vehicles had “download[ed] all text messages and call logs from [p]laintiffs’ cellphones as soon as they [were] connected,” and that “the infotainment system permanently store[d] the private communications without [p]laintiffs’ knowledge or consent.” Jones, 85 F.4th at 574. Although we did not explicitly tie these allegations to the TransUnion framework (and relied in part on our pre-TransUnion caselaw, described infra), the attention to the specific circumstances of the plaintiffs’ injuries in the course of our analysis suggests that we considered whether the specific plaintiffs alleged a violation of their “substantive privacy right[s].” Id. Third, and finally, our decision in Phillips v. U.S. Customs & Border Protection, 74 F.4th 986 (9th Cir. 2023)—issued several months before Jones—integrates the kind of analysis contemplated by TransUnion. There, “[p]laintiffs’ central argument [was] that the government’s retention of illegally obtained information about them [was] per se an injury-in-fact.” Id. at 991. We rejected this argument, citing both Spokeo and TransUnion, and explained that “[w]here we have held that the retention of illegally obtained records resulted in a concrete injury, we have always identified something beyond retention alone that resulted in an injury of the sort recognized by the Supreme Court, such as a material risk of future tangible harm, a violation of the common law right to privacy, or a cognizable constitutional violation.” Id. at 993 (emphasis added). We then evaluated the facts of several prior decisions to support our general conclusion. Id. at 993–95. Phillips approves of an approach, implicit in Jones and  POPA V. MICROSOFT CORPORATION 19 consistent with TransUnion, that requires a plaintiff to demonstrate more than just a statutory violation when evaluating whether a plaintiff has alleged a concrete injury. Popa also relies on two pre-TransUnion cases— Eichenberger and In re Facebook—in support of her position. In Eichenberger, the plaintiff alleged that the defendant disclosed information about videos that the plaintiff had watched on its application to a third party. Eichenberger, 876 F.3d at 981–82. When evaluating whether the plaintiff alleged a concrete injury, we explained that “Spokeo concerned procedural violations of the FCRA that would not invariably injure a concrete interest.” Id. at 982. We then contrasted that statute with the “provision at issue here, [which] codifies a context-specific extension of the substantive right to privacy.” Id. at 983. This distinction justified our conclusion that “every disclosure of an individual’s ‘personally identifiable information’ and video- viewing history offends the interests that the statute protects.” Id. In reaching this conclusion, we noted that “[v]iolations of the right to privacy have long been actionable at common law,” and that the right to privacy “encompass[es] the individual’s control of information concerning his or her person.” Id. (quoting U.S. Dep’t of Just. v. Reps. Comm. for Freedom of the Press, 489 U.S. 749, 763 (1989)). Several years later, In re Facebook relied on Eichenberger’s interpretation of Spokeo. That case involved a Facebook plug-in that “track[ed] users’ browsing histories when they visit[ed] third-party websites, and then compile[d] these browsing histories into personal profiles which [were] sold to advertisers.” In re Facebook, 956 F.3d at 596. We concluded that plaintiffs “had established standing . . . because they adequately alleged privacy 20 POPA V. MICROSOFT CORPORATION harms.” Id. at 598. More specifically, we explained that “[p]laintiffs have adequately alleged that Facebook’s tracking and collection practices would cause harm or a material risk of harm to their interest in controlling their personal information.” Id. at 599. That conclusion followed from our observation that “Facebook gained a cradle-to- grave profile without users’ consent.” Id. But even though our analysis in Eichenberger and In re Facebook might have arguably offered at the time some support for the position that Popa now advances, that analysis finds no support in TransUnion. There, the Supreme Court made no distinction between “procedural” and “substantive” statutory provisions, instead holding, without any limitation, that courts should assess whether “plaintiffs have identified a close historical or common-law analogue for their asserted injury.” TransUnion, 594 U.S. at 424. And, as explained supra, the Court identified discrete privacy torts (not a general right to privacy) and evaluated plaintiffs’ claims based on their similarity to the harm protected by the defamation tort. More important, we need not revisit Eichenberger and In re Facebook in reaching our decision today. Despite the broad statements made therein, those decisions still accounted for the individual circumstances giving rise to the plaintiffs’ alleged injuries rather than simply greenlighting a per se rule for privacy statutes. See In re Facebook, 956 F.3d at 598 (“Plaintiffs alleged that Facebook continued to collect their data after they had logged off the social media platform, in order to receive and compile their personally identifiable browsing history. As alleged in the complaint, this tracking occurred ‘no matter how sensitive’ or personal users’ browsing histories were.”) (emphasis added); see also Phillips, 74 F.4th at 993. Moreover, both cases involved  POPA V. MICROSOFT CORPORATION 21 different statutes from the Pennsylvania statute, WESCA, at issue in this case. For example, in Eichenberger, the plaintiff sued under the Video Privacy Protection Act of 1988. Eichenberger, 876 F.3d at 981–84. Perhaps we might analyze that statute differently today, especially after the Supreme Court’s decision in TransUnion, but we need not reach that issue to decide whether Popa has adequately alleged standing in this case. For the reasons stated above, she has not. The district court’s ruling on the motions to dismiss is AFFIRMED.