Kenneth Hasson v. Fullstory Inc

                                         PRECEDENTIAL

       UNITED STATES COURT OF APPEALS
            FOR THE THIRD CIRCUIT
                 ____________

                      No. 23-2535
                      ___________

                 KENNETH HASSON,
Individually and on behalf of all others similarly situated,
                               Appellant

                             v.

                   FULLSTORY, INC.
                     ____________

    On Appeal from the United States District Court
       for the Western District of Pennsylvania
                (D.C. No. 2-22-cv-01246)
      District Judge: Honorable Marilyn J. Horan
                     ____________

                      No. 23-2573
                      ___________

                  JORDAN SCHNUR,
Individually and on behalf of all others similarly situated,
                               Appellant

                             v.
PAPA JOHN’S INTERNATIONAL, INC., d/b/a Papa Johns
                 ____________

      On Appeal from the United States District Court
         for the Western District of Pennsylvania
                 (D.C. No. 2-22-cv-01620)
       District Judge: Honorable J. Nicholas Ranjan
                       ____________

                 Argued on April 18, 2024

Before: HARDIMAN, PHIPPS, and SMITH, Circuit Judges.

                 (Filed: September 5, 2024)

Gary F. Lynch
Jamisen A. Etzel [Argued]
Lynch Carpenter, LLP
1133 Penn Avenue, 5th Floor
Pittsburgh, PA 15222
       Counsel for Appellants
Emily Johnson Henn
Covington and Burling LLP
3000 El Camino Real
5 Palo Alto Square, 10th Floor
Palo Alto, CA 94306

Peter S. Wolff
Pietragallo Gordon Alfano Bosick & Raspanti
301 Grant Street
One Oxford Centre,38th Floor
Pittsburgh, PA 15219



                              2
Mark W. Mosier [Argued]
Eric C. Bossett
Kendall T. Burchard
Grace Pyo
Covington & Burling LLP
One CityCenter
850 Tenth Street, NW
Washington, DC 20001
       Counsel for Appellees
                ________________________

                 OPINION OF THE COURT
                ________________________

HARDIMAN, Circuit Judge.

        These appeals come to us from the District Courts’
orders dismissing two class actions for lack of personal
jurisdiction. In the first case, Kenneth Hasson sued FullStory,
Inc., claiming that the company unlawfully wiretapped him
when it deployed a script of computer code—known as Session
Replay Code—to intercept his online communications. In the
second case, Jordan Schnur sued Papa John’s International,
Inc. for its use of FullStory’s Session Replay Code.

                               I

       We begin by describing the technology at issue.
FullStory’s Session Replay Code enables companies like Papa
Johns to collect detailed information about the way visitors



                               3
interact with its website. The website “delivers” the code “to a
user’s browser,” which “follow[s] the code’s instructions by
sending . . . data to a . . . third-party server.” Hasson App. 29.
The data encompasses “virtually every user action, including
all mouse movements, clicks, scrolls, zooms, window resizes,
keystrokes, text entry, and numerous other forms of a user’s
navigation and interaction through the website.” Id.

        The information is intercepted—without the user’s
knowledge or consent—the moment he accesses the website.
And text entries on the website are captured even if the user
fails “to click . . . ‘submit’ or ‘enter.’” Id. at 30. Users’ internet
protocol addresses and location information can also be
identified. Vendors and website operators use the data to
recreate a user’s entire browsing session on that website.
FullStory receives and analyzes the harvested data for its
clients, who use the information to improve website
functionality and user experience.

       The question presented in both cases is whether the
deployment of Session Replay Code in Pennsylvania makes
FullStory and Papa Johns amenable to jurisdiction there. The
parties agree that the claims implicate only specific, not
general, jurisdiction. See O’Connor v. Sandy Lane Hotel Co.,

 (3d Cir. 2007) (citing Helicopteros
Nacionales de Colombia, S.A. v. Hall, 

, 414–15 &
n.9 (1984)).

       Specific jurisdiction exists when the “plaintiff’s cause
of action is related to or arises out of the defendant’s contacts
with the forum.” Pinker v. Roche Holdings Ltd., 

 (3d Cir. 2002) (citation omitted). A district court sitting in
diversity can exercise personal jurisdiction over an out-of-state
defendant to the extent permitted by the law of the forum state.



                                  4
Metcalfe v. Renaissance Marine, Inc., 

 (3d
Cir. 2009); see also Fed. R. Civ. P. 4(k)(1)(A). Pennsylvania’s
long-arm statute permits personal jurisdiction “based on the
most minimum contact with th[e] Commonwealth allowed
under the Constitution of the United States.” 

(b).

        The Supreme Court has articulated two tests for specific
jurisdiction: (1) the “traditional” test—also called the
“minimum contacts” or purposeful availment test, Burger King
Corp. v. Rudzewicz, 

 (1985) (quoting Int’l
Shoe Co. v. State of Wash., Off. of Unemployment Comp. &
Placement, 

 (1945)); and (2) the “effects”
test, see Calder v. Jones, 

, 787 & n.6 (1984).

        Under the traditional test, the plaintiff must show that
the defendant has “minimum contacts” with the forum such
that it “purposefully avail[ed] itself of the privilege of
conducting activities within the forum” and “invoke[ed] the
benefits and protections of [the forum’s] laws.” Toys “R” Us,
Inc. v. Step Two, S.A., 

 (3d Cir. 2003)
(quoting Asahi Metal Indus. Co. v. Superior Court of
California, 

 (1987)). Second, the plaintiff’s
claims must “arise out of or relate to” at least some of those
contacts, O’Connor, 

 (quoting Helicopteros,

), evidencing “a strong relationship among the
defendant, the forum, and the litigation,” Hepp v. Facebook,

, 208 (3d Cir. 2021) (internal quotations omitted)
(citing Ford Motor Co. v. Montana Eighth Jud. Dist. Ct., 

 (2021)). Finally, the exercise of jurisdiction over
the defendant must “comport[] with traditional notions of fair
play and substantial justice” such that “the defendant ‘should
reasonably anticipate being haled into court’ in that forum.”
Toys, 

 (quoting World–Wide Volkswagen Corp.


                               5
v. Woodson, 

 (1980)).

        Direct in-forum activities are not the only means of
establishing personal jurisdiction over an out-of-state
defendant. For example, in Calder v. Jones, the Supreme Court
confronted tortfeasors who—despite minimal contacts in
California—intentionally caused harm there. See 

(1984). Though the defendant news editors had few “relevant
contacts” with California, 

, the Court emphasized that
the editors “impugned . . . an entertainer . . . centered in
California[,]” “dr[ew] from California sources, and the brunt
of the harm . . . was suffered in California” such that
“California [was] the focal point both of the story and of the
harm suffered,” 

 at 788–89. Thus, the Court held that
“[j]urisdiction over [the defendants] [was] . . . proper in
California based on the ‘effects’ of their . . . conduct in
California.” 

.

        Courts have applied Calder’s “effects” test to assess
personal jurisdiction over an intentional tortfeasor whose
“contacts with the forum . . . otherwise [do] not satisfy the
requirements of due process” under the traditional test. IMO
Indus., Inc. v. Kiekert AG, 

 (3d Cir. 1998). In
such cases, personal jurisdiction may be proper if the forum is
the “focus” of the defendant’s tortious conduct. 

 (quoting
Keeton v. Hustler Mag., Inc., 

 (1984)).
Unlike the traditional test, the Calder “effects” test requires a
plaintiff to plead facts establishing that: (1) the defendant
committed an intentional tort; (2) the plaintiff felt the brunt of
the harm in the forum; and (3) the defendant expressly aimed
his tortious conduct at the forum. See Remick v. Manfredy, 

 (3d Cir. 2001).

                                A



                                6
       In the first appeal, Hasson alleged that FullStory’s use
of Session Replay Code violated Pennsylvania’s Wiretapping
and Electronic Surveillance Control Act (“WESCA”), 

, et seq., and invaded his privacy in violation
of the common law. Hasson alleged that while he browsed
Mattress Firm’s website, FullStory’s Session Replay Code
“instantaneously captured his [w]ebsite [c]ommunications”
“without his consent,” including “information about his device,
browser, and geolocation,” while also “creat[ing] a unique ID
and profile for him.” Hasson App. 40. He claims the code
allowed      FullStory       to     collect    “his     personal
information . . . including name, address, email address, and
payment information.” Hasson App. 44.

        FullStory moved to dismiss Hasson’s complaint under
Rule 12(b)(2) of the Federal Rules of Civil Procedure for lack
of personal jurisdiction because, although Hasson is a resident
of Pennsylvania, FullStory is a Delaware corporation with its
principal place of business in Georgia. Hasson opposed the
motion and sought jurisdictional discovery to determine
whether FullStory had sufficient contacts with Pennsylvania to
satisfy the requirements of personal jurisdiction.

        The District Court denied Hasson’s motion for
jurisdictional discovery and granted FullStory’s motion to
dismiss. It concluded that Hasson failed to satisfy the “effects”
test for specific personal jurisdiction under Calder because he
“pled insufficient facts to demonstrate that FullStory expressly
aimed its conduct at Pennsylvania through the Mattress Firm
website.” Hasson v. FullStory, Inc., 

, at *2
(W.D. Pa. July 25, 2023). Hasson filed this timely appeal
asking us to reverse the District Court’s order or, in the
alternative, to vacate and remand with instructions to order
jurisdictional discovery.


                               7
                               B

        In the second appeal, Schnur, a Pennsylvania resident,
filed a class action against Papa Johns, a Delaware corporation
with its principal place of business in Georgia. Schnur filed
wiretapping and invasion of privacy claims like those Hasson
brought against FullStory. Unlike Hasson, who sued the
company that produced the code that attached to his browser,
Schnur sued the company operating the website that deployed
the code onto his browser.

       Papa Johns maintains “approximately 85 brick-and-
mortar locations in Pennsylvania” and “regularly markets and
advertises its goods and services within Pennsylvania.” Schnur
App. 29 (footnote omitted). Schnur alleged that, while in
Pennsylvania, he visited Papa Johns’ website on his computer
to order food. In doing so, he “communicated with Papa John’s
by entering a delivery address[,] . . . searching for a nearby
carryout location in Pennsylvania[,]” and selecting “what type
of pizza he wanted to order.” Schnur App. 43.

        Papa Johns moved to dismiss for lack of personal
jurisdiction. The District Court granted the motion, finding that
because Papa Johns’ website was “generally available to
everyone, no matter where they are located,” Schnur failed to
allege that the company expressly aimed Session Replay Code
at Pennsylvania. Schnur v. Papa John’s Int’l, Inc., 

, at *3 (W.D. Pa. Aug. 28, 2023). The District Court
also held that Schnur’s complaint failed to establish specific
personal jurisdiction under the “traditional” test because
Schnur’s wiretapping claims did not arise out of or relate to
Papa Johns’ marketing and sale of pizza in Pennsylvania.

       Hasson and Schnur filed timely appeals and we joined



                               8
the cases for argument and disposition. 1

                                II

        We turn first to Schnur’s claims against Papa Johns.
Schnur argues the District Court erred when it dismissed for
lack of jurisdiction under the Calder “effects” test without first
considering whether jurisdiction was proper under the
traditional purposeful availment test. He contends jurisdiction
is proper under the “effects” test or, alternatively, under the
traditional test—which he views as the appropriate test given
Papa Johns’ extensive business contacts in Pennsylvania.
Stated simply, Schnur argues that the Calder test cannot be
invoked to deny personal jurisdiction over a suit that otherwise
satisfies the traditional test.

       The District Court held that Schnur’s allegations could
not satisfy Calder because Papa Johns did not expressly aim
Session Replay Code at Pennsylvania and Schnur did not suffer
the brunt of his alleged harm in Pennsylvania. See Schnur,

, at *2–3. Schnur counters that the District



1
  The District Courts had subject matter jurisdiction over
Hasson’s and Schnur’s claims under 

(d)(2).
We review de novo the orders dismissing for lack of personal
jurisdiction. See O’Connor, 

. Where, as here,
the District Courts did not hold evidentiary hearings on
personal jurisdiction, we take the Plaintiffs’ factual allegations
as true. See Miller Yacht Sales, Inc. v. Smith, 

(3d Cir. 2004) (citation omitted).




                                9
Court erred because the traditional test is the proper
jurisdictional standard while Calder is “typically invoked
where,” unlike here, “the conduct . . . form[ing] the basis for
the controversy occurs entirely out-of-forum.” Schnur Br. 47
(citation omitted). Because Papa Johns has extensive business
contacts in Pennsylvania and deployed Session Replay Code
into the forum, Schnur contends that the District Court should
have applied the traditional test first. Under that test, Schnur
argues, jurisdiction is proper because Papa Johns purposefully
availed itself of the privilege of doing business in Pennsylvania
and Schnur’s wiretapping claims arise out of the company’s
contacts there.

        In sum, Schnur contends that courts need not apply the
“effects” test to all intentional tort claims and, even if the
District Court did so, personal jurisdiction still lies here
because Calder’s “effects” test is more plaintiff-friendly than
the traditional test. Papa Johns counters that courts must apply
the “effects” test to intentional tort claims, and that the District
Court correctly held that Schnur could not satisfy Calder’s
express aiming prong. We agree that Schnur’s allegations do
not satisfy the requirements for personal jurisdiction under
Calder.

       While the “effects” test and the traditional test “are cut
from the same cloth,” they have distinct requirements. Marten
v. Godwin, 

 (3d Cir. 2007). As we explained:

       [T]he effects test . . . require[s] that the tortious actions
       of the defendant have a forum-directed purpose[—a
       requirement that] is not applicable in the more
       traditional specific jurisdiction analysis. . . . Unlike
       th[e] express requirement in the effects test, the
       traditional specific jurisdiction analysis simply requires



                                10
       that the plaintiff’s claims arise out of or relate to the
       defendant’s forum contacts. We do not agree with the
       argument that this traditional requirement is the
       equivalent of the more demanding relatedness
       requirement of the effects test.

Miller Yacht Sales, Inc. v. Smith, 

 (3d Cir. 2004)
(emphasis added) (cleaned up).

       Schnur incorrectly asserts that the “effects” test imposes
a universally lower jurisdictional hurdle. As Miller Yacht
demonstrates, it requires plaintiffs to show that the defendant
“sufficiently directed his tortious conduct at the state,” id.—a
burden that differs in key respects from the traditional test.
Because specific jurisdiction is “claim specific,” Remick, 

, it is not uncommon for a court to dismiss
intentional tort claims for want of jurisdiction under the
“effects” test while finding jurisdiction proper as to other
claims under the traditional test. See, e.g., 

 at 256‒57, 260.
In sum, the “effects” test may be more lenient in some respects
and stricter in others, depending on the facts and claims at
issue.

        That said, we are skeptical of Defendants’ assertion that
our precedents require courts to apply Calder’s “effects” test
exclusively to intentional tort claims. As Plaintiffs note, the
Supreme Court applied a traditional jurisdictional analysis in
Keeton v. Hustler Magazine, Inc., which concerned libel
claims. 

, 772–81 (1984). The Keeton Court noted
that the defendant had “circulate[ed] magazines throughout the
state” and transacted “regular monthly sales of thousands of
magazines” there. 

. The Court applied a traditional
“minimum contacts” analysis and concluded that jurisdiction
was proper in New Hampshire because plaintiffs’ claims were



                               11
“based on” the magazine’s sales and subscriptions in the state.

       Indeed, while we have often applied the Calder
framework in assessing personal jurisdiction over intentional
tortfeasors, we have stressed that “Calder [did not] carve out a
special intentional torts exception to the traditional specific
jurisdiction analysis.” IMO Indus., 

. And as
Plaintiffs accurately note, the “effects” test has often been
applied where the alleged tortfeasor has de minimis contacts
with the forum, see Marten, 

, or where the
tortious conduct occurs primarily “outside the forum” but has
an “effect . . . within the forum,” IMO Indus., 

.
In any case, we agree with the District Court that Schnur’s
complaint fails under both tests.

                                A

       The District Court held that Schnur did not satisfy
Calder’s “effects” test because he did not allege that Papa
Johns expressly aimed Session Replay Code at Pennsylvania.
We agree. Schnur alleged that Papa Johns “knowingly armed
[its] website with software that initiates a broad-spectrum
wiretap” and that this conduct “led to [his] lawsuit being filed.”
Dist. Ct. Dkt. No. 31, at 10. But Schnur did not allege that Papa
Johns’ website is accessible only in Pennsylvania, that the
company deploys Session Replay Code only to users who
access the site while in Pennsylvania, or that the website tailors
its content in any meaningful way to Pennsylvanians. Rather,
Schnur admits that Papa Johns targets a “national audience”
“to drive customers to its website.” Schnur App. 39. And we,
like several sister courts, have held that a defendant does not
expressly target a forum merely by operating a website that is
accessible there—even when the plaintiff alleges harm in that



                               12
forum arising out of his engagement with that website.

        For instance, in Remick, a Pennsylvania plaintiff
asserted intentional tort claims against an out-of-state website
operator for posting a photo of the plaintiff on the site without
permission. See 

. We reasoned that the “effects
test’ [was] clearly not satisfied” because “the website was
intended to provide information on [the defendant] and . . . was
accessible worldwide.” 

 So “there [was] no basis to conclude
that the defendants expressly aimed their allegedly tortious
activity at Pennsylvania knowing that harm was likely to be
caused there.” 

 Our reasoning in Remick applies to Schnur’s
claims here.

        By contrast, courts have found express aiming where,
unlike here, the website is “targeted at a particular
jurisdiction.” Toys, 

 (cleaned up). Such
targeting can be evidenced by content bearing a particular
nexus to that forum or location-specific advertisements. See
Advanced Tactical Ordnance Sys., LLC v. Real Action
Paintball, Inc., 

 (7th Cir. 2014); Shrader v.
Biddinger, 

 (10th Cir. 2011). For example,
in Mavrix Photo, Inc. v. Brand Techs., Inc., the Ninth Circuit
held that California had specific jurisdiction over a Florida-
based celebrity photo website that had “specific[ally] focus[ed]
on the California-centered celebrity and entertainment
industries” and featured photos of Californians. 

 (9th Cir. 2011). The Ninth Circuit took a contrary view
in a copyright infringement case brought by a California
plaintiff against a foreign pornography website. See AMA
Multimedia, LLC v. Wanat, 

 (9th Cir. 2020). The
court contrasted the California-centric content in Mavrix with
the pornography website, determining that the latter “lack[ed]
a forum-specific focus” because “the market for adult content


                               13
is global.” 

 (cleaned up).

         The distinctions made by the Ninth Circuit in these
cases support the District Court’s dismissal order here. Schnur
neither alleged that Papa Johns’ website advertises a product
or service bearing any special significance to Pennsylvania, nor
that it features Pennsylvania-centric content. Indeed, pizza has
national appeal. 2 So Papa Johns did not expressly aim its
Session Replay Code at Pennsylvania by operating a website
that was accessible in the forum.

        Our conclusion is not undercut simply because, as
Schnur alleges, Papa Johns: (1) deployed Session Replay Code
into the forum and harmed Pennsylvanians there; (2) allows
website users to filter restaurant locations geographically; and
(3) operates 85 restaurants and conducts other business
activities in the Commonwealth.

       First, we assume, as Schnur claims, that the alleged
wiretapping occurred on browsers in Pennsylvania. Cf. Popa v.
Harriet Carter Gifts, Inc., 

, 131–32 (3d Cir. 2022).
And we have held “the exercise of personal jurisdiction over a
nonresident” for “an allegedly tortious act committed within
the forum . . . conforms with due process.” Carteret Sav. Bank,
FA v. Shushan, 

, 148 (3d Cir. 1992). But while


2
  Pizza “is recognized as a high consumption food . . . of public
significance in the American diet” with “13% of the U.S.
population . . . consum[ing] pizza on any given day.” Donna
G. Rhodes et al., Dietary Data Brief No. 11—Consumption of
Pizza, Nat’l Library of Med. (2014), https://perma.cc/R5F7-
MBPZ.



                               14
Schnur argues “Papa Johns purposefully entered Pennsylvania
and knowingly wiretapped its customers there,” he did not
allege that the transmission of Session Replay Code onto his
browser constituted a physical entry into the forum. Reply Br.
13. Even if he had, “intentional torts . . . committed via the
Internet or other electronic means” “present . . . . very different
questions [of] whether and how a defendant’s virtual
‘presence’ and conduct translate into ‘contacts’ with a
particular State.” Walden v. Fiore, 

, 290 n.9
(2014). So we decline to hold that Papa Johns’ use of Session
Replay Code constitutes a physical entry into Pennsylvania
sufficient to support the exercise of jurisdiction.

        We also reject the argument that Papa Johns expressly
targeted Pennsylvania simply because the data interception
allegedly occurred in the forum. “[T]he effects test prevents a
defendant from being haled into a jurisdiction solely because
the defendant intentionally caused harm that was felt in the
forum state if the defendant did not expressly aim [its] conduct
at that state.” Marten, 

 (emphasis added). And
we are not persuaded that transmitting computer code to a
browser that happens to be in Pennsylvania is an intentional
physical entry into the forum sufficient to establish express
aiming under Calder. Cf. Carefirst of Maryland, Inc. v.
Carefirst Pregnancy Ctrs., Inc., 

 (4th Cir.
2003) (Defendant “did not . . . direct electronic activity into
[the forum] with the manifest intent of engaging in business or
other interactions within that state in particular” by “set[ting]
up its generally accessible, semi-interactive Internet website.”)
(emphasis added).

      At a minimum, Schnur had to allege that Papa Johns
knew that a given user was in Pennsylvania before it sent the
code to that user’s browser. See Rosenthal v.


                                15
Bloomingdales.com, LLC, 

 (1st Cir. 2024). The
First Circuit recently held that Massachusetts did not have
personal jurisdiction over an out-of-state department store
chain for similar wiretapping claims. Though the court did not
analyze the plaintiff’s allegations under Calder, it concluded
that specific jurisdiction was not proper because, inter alia, the
plaintiff failed to prove that “Bloomingdales purposefully
deployed [Session Replay Code] to intentionally target users in
Massachusetts” or that “Bloomingdales knew that it was
targeting [the plaintiff] in Massachusetts” at the time of the
alleged wiretapping. 

 (cleaned up). We conclude that
Schnur’s allegations fail to satisfy Calder’s express aiming
prong for similar reasons. Schnur did not allege that Papa Johns
knows that a given user is in Pennsylvania before the code is
dispatched to his browser or that Papa Johns specifically sends
the code because the user is located in Pennsylvania. Rather,
Schnur alleged that Session Replay Code was sent to his
browser the instant he accessed Papa Johns’ website. He did
not allege that Papa Johns knew that he was in Pennsylvania
and subsequently deployed the code based on that knowledge.

        And while Schnur asserts that Papa Johns’ collection of
users’ geolocation data shows that the company
“inevitab[ly] . . . knows it is capturing . . . the [w]ebsite
[c]ommunications of Pennsylvania residents,” Schnur App. 42,
“ultimately learn[ing]” of the Plaintiffs’ location after the fact
does not, in this case, satisfy the “effects” test’s “intentionality
requirement,” Toys, 318 F.3d at 454–55 nn. 5, 6. Because
“Calder requires more,” a “defendant accused of an intentional
tort” is not “subject to personal jurisdiction in the plaintiff’s
home state as soon as the defendant learns what that state is.”
Mobile Anesthesiologists Chicago, LLC v. Anesthesia Assocs.
of Houston Metroplex, P.A., 

 (7th Cir. 2010).



                                16
        Furthermore, Papa Johns did not expressly aim Session
Replay Code at Pennsylvania simply by permitting web users
to search for nearby restaurants. Schnur did not allege that this
feature is “exclusively available to people in [Pennsylvania]”
or that Session Replay Code is deployed only to users who
search for Pennsylvania locations. Bryan v. United States, 

, at *10 (D.V.I. Feb. 28, 2017), aff’d, 

(3d Cir. 2019). Nor did he allege that users who filter for
Pennsylvania locations receive uniquely forum-centric
content. See Mavrix, 

. So Papa Johns’ “Find
Your Store” filter does not constitute express aiming at
Pennsylvania. Cf. Fidrych v. Marriott Int’l, Inc., 

 (4th Cir. 2020) (website’s state “drop-down menu[] d[id]
not[] . . . strengthen [defendant’s] jurisdictionally relevant
connections”); NexLearn, LLC v. Allen Interactions, Inc., 

 (Fed. Cir. 2017) (same).

        Finally, Papa Johns’ in-forum business activities,
including its operation of 85 restaurants, do not establish that
the company expressly aimed its Session Replay Code at
Pennsylvania. “[T]he Calder ‘effects test’ can only be satisfied
if the plaintiff can point to contacts which demonstrate that the
defendant expressly aimed its tortious conduct at the forum,
and thereby made the forum the focal point of the tortious
activity.” IMO Indus., 

 (emphasis added). As
Schnur admits, Session Replay Code would have wiretapped
him regardless of whether he purchased pizza via the website,
so Papa Johns’ other commercial activities do not demonstrate
express aiming under Calder. For example, in Wanat, the
Ninth Circuit held that a website operator’s “other contacts
with the [forum],” including service contracts with in-forum
users, “fail[ed] to establish express aiming” because the
plaintiff’s suit “d[id] not allege violations of the” contracts.



                               17


. Simply stated, Papa Johns’ other in-forum
commercial activities—operating restaurants and selling
pizza—do not show that it expressly aimed Session Replay
Code at Pennsylvania.

        For all these reasons, the District Court did not err when
it held that Schnur failed to plead facts sufficient to render Papa
Johns amenable to personal jurisdiction in Pennsylvania under
the Calder “effects” test. 3

                                B

        Schnur also contends that jurisdiction over Papa Johns
is proper under the traditional test as articulated in Ford Motor.
That test requires Schnur to show that Papa Johns
“purposefully avail[ed] itself of the privilege of conducting
activities” in Pennsylvania and that his claims “arise out of or
relate to the defendant’s contacts with the forum.” Ford Motor,

 (cleaned up). There is no doubt that Papa Johns
purposefully availed itself of the Pennsylvania market. As
Schnur alleged, Papa Johns “maintains approximately 85
brick-and-mortar locations in Pennsylvania and regularly
markets and advertises its goods and services within
Pennsylvania.” Schnur App. 29. It also regularly “conducts
business with [Pennsylvania] residents” to sell pizza and other
products “via [its] [web]site.” Toys, 

.

       But Schnur’s complaint founders at step two, which


3
  Because we conclude that Schnur failed to satisfy Calder’s
“express aiming” prong, we need not address whether Schnur
adequately pled that he suffered the brunt of the alleged harm
in Pennsylvania. See Marten, 

.


                                18
requires a “strong relationship among the defendant, the forum,
and the litigation.” Hepp, 14 F.4th at 208 (citing Ford Motor,

). As the District Court held, Schnur’s
complaint lacks “a specific connection between Pennsylvania,
Papa Johns, and the deployment of Session Replay Code on
[Papa Johns’] website.” Schnur, 

, at *5.

         To be sure, whether Schnur’s claims “arise out of or
relate to” Papa Johns’ activities in Pennsylvania is a close call.
Ford Motor, 

 (citation omitted). As the
Supreme Court recently clarified, while “[t]he first half of that
standard        asks     about       causation . . . the    back
half . . . contemplates that some relationships will support
jurisdiction without a causal showing.” 

. And “[t]he
degree of relatedness required in a given case is inversely
proportional to the overall intensity of the defendant’s forum
contacts.” O’Connor, 

 (cleaned up). At first
glance, this would seem to tip the jurisdictional scales in
Schnur’s favor given Papa Johns’ considerable contacts in
Pennsylvania. But when we scrutinize those contacts in the
context of Schnur’s wiretapping claims, we conclude that the
“connection is too weak.” Hepp, 14 F.4th at 208.

        Consider Ford Motor. In that case, Montana and
Minnesota residents sued Ford in their respective states,
alleging that defective Ford parts injured them. 

. Ford argued that the plaintiffs’ claims did not arise out of
or relate to Ford’s contacts in those states because Ford had not
designed, manufactured, or sold the defective vehicles in either
state. 

 The Supreme Court disagreed, noting that “Ford had
advertised, sold, and serviced those two car models in both
States for many years” and “systematically served a market in
[those states] for the very vehicles that the plaintiffs allege[d]
malfunctioned and injured them in those States.” 

.


                               19
        Those facts demonstrated the “strong relationship
among the defendant, the forum, and the litigation” required
for the state courts to exercise jurisdiction. 

 (cleaned up).
The defendant, the forum, and the plaintiffs’ claims all shared
a common link: defective Ford Explorers and Crown Victorias.
As the Court stressed, Ford had, “at all relevant times,” sold,
advertised, and serviced those models in Montana and
Minnesota, the plaintiffs were injured by those models in those
states, and the lawsuits arose out of the injuries caused by those
models. 

.

        In Schnur’s case, Papa Johns’ website is analogous to
the defective vehicles in Ford Motor, and Session Replay Code
is like the defective parts contained within those vehicles. And
although Schnur alleged Papa Johns “heavily markets its
online ordering platform in order to drive customers to its
website,” which “is a central focus point of [its] business
model,” Schnur App. 39, he did not allege any facts regarding
the company’s promotion of its website in Pennsylvania. Cf.
Johnson v. TheHuffingtonPost.com, Inc., 

(5th Cir. 2021) (no jurisdiction over New York website in
Texas because plaintiffs failed to show that the defendant
“reached beyond the site to attract Texans to it” or “solicited
Texan visits”) (emphasis added).

       Schnur notes that Papa Johns aired a commercial during
a Philadelphia Eagles’ Super Bowl game, but he did not allege
that Papa Johns’ website was promoted or featured in the
commercial. So unlike the plaintiffs in Ford Motor, Schnur’s
complaint lacks a “strong relationship” between Pennsylvania
and Papa Johns’ use of Session Replay Code. Ford Motor, 

 (cleaned up).

       Furthermore, even if Papa Johns’ website allows



                               20
visitors to order food “from nearby stores[,] . . . including in
Pennsylvania,” Schnur App. 39, we are not persuaded that the
website’s accessibility in Pennsylvania establishes the strong
connection between the forum and the litigation that Due
Process requires, especially given the unique “doctrinal
questions” that “internet transactions” raise. Ford Motor, 

 n.4. While the Ford Motor Court noted that the
defective vehicle models were “available for sale” in Montana
and Minnesota, it also emphasized Ford’s extensive marketing
of those models in the two states through “billboards, TV and
radio spots, print ads, and direct mail” and its efforts to
maintain, service, and repair those models in those states. 

. Here, while Schnur details Papa Johns’ promotion of its
products in Pennsylvania, he did not, as the Ford Motor
plaintiffs did, allege facts regarding Papa Johns’ in-forum
promotion of the device that allegedly harmed him—the
website. 4

        We do not hold, as the dissent suggests, that personal
jurisdiction lies only where the out-of-state defendant’s forum
activities closely resemble Ford Motor’s. See Dissent 4. But
because the traditional test’s “relate to” requirement
“incorporates real limits,” Schnur must offer facts regarding


4
  Our dissenting colleague suggests that our holding hinges on
the fact that Papa Johns has not advertised its website in
Pennsylvania “to the same extent” that Ford advertised its
vehicles in the forum states. Dissent 4. Not so. We simply note
an important distinction between the two cases. While Ford
Motor held that Ford’s extensive promotion of the harm-
causing vehicles in the fora strengthened the connection among
the defendant, the fora, and the litigation, Schnur does not
allege that Papa Johns promoted its website in Pennsylvania.


                              21
Papa Johns’ efforts to specifically direct or connect
Pennsylvanians to the alleged harm. Ford Motor, 

. And while the dissent correctly notes that the Supreme
Court found jurisdiction proper over Ford Motor even though
“Ford did not introduce the defective vehicles into the forum
states[] and the claims related to actions that Ford took outside
of the forum states,” Dissent 4, it overlooks the lengths the
Court went to emphasize the many ways in which Ford
promoted, serviced, and marketed the defective vehicle models
in the fora. See 

.

          Our decision in Hepp is instructive as well. In that case,
although a defendant had “targeted [its] advertising business to
Pennsylvania” and sold merchandise to Pennsylvanians via its
online store, we emphasized that “none of th[o]se contacts
form[ed] a strong connection to [plaintiff’s] misappropriation
of . . . likeness” claim. 14 F.4th at 208. We emphasized that the
plaintiff “did not allege [that] the merchandise featured her
photo,” or that the defendant “used her likeness to sell
advertising.” Id. Likewise here, we conclude that Papa Johns’
in-state restaurant sales and marketing activities, as alleged in
the complaint, are insufficiently related to Schnur’s
wiretapping claims. In sum, we hold that Schnur’s complaint
also fails under the traditional test. 5



5
 We reject Schnur’s assertion that Herbal Brands, Inc. v.
Photoplaza, Inc. compels us to reverse. See 

 (9th
Cir. 2023), cert. denied, 

 (2024). There, the Ninth
Circuit held that Calder’s express aiming prong is satisfied “if




                                22
                                III

       We turn next to the District Court’s order dismissing
Hasson’s claims against FullStory and its order denying
Hasson’s motion for jurisdictional discovery. We begin by
noting that FullStory has fewer contacts with Pennsylvania
than Papa Johns. FullStory is a Georgia software company with
no Pennsylvania offices or employees. FullStory did, however,
produce the Session Replay Code that allegedly wiretapped
Hasson in Pennsylvania and received the data collected from
his browsing session.

        Hasson argues that Pennsylvania has specific personal
jurisdiction over his wiretapping claims for several reasons. He
notes that FullStory partnered with Pennsylvania companies
whose websites are accessible there and other website


a defendant, in its regular course of business, sells a physical
product via an interactive website and causes that product to be
delivered to the forum.” 

. We have not held that
simply fulfilling an online sale and causing a product to be
delivered in a forum suffices for personal jurisdiction. See 

 (noting the Third Circuit has “reached [a] different
conclusion[] regarding whether sales to a plaintiff or its agents
can be a source of jurisdiction”). In any event, Schnur’s case is
distinguishable from Herbal Brands. There, Arizona plaintiffs
sued the defendant for selling unauthorized products in that
state via the internet. See 

 at 1088–97. The court concluded
that “Plaintiff’s claims . . . clearly ar[o]se out of and relate[d]
to Defendants’ conduct of selling . . . products to Arizona
residents.” 

. But here, Schnur’s wiretapping claims
neither involve a “physical” product nor arise out of (or relate
to) Papa Johns’ brick-and-mortar operations in Pennsylvania.


                                23
operators who do business in the Commonwealth (like
Mattress Firm). He also emphasizes that FullStory received
communications intercepted from Pennsylvanians while they
were         in    Pennsylvania     and     “commercializ[ed]”
Pennsylvanians’ “geographical . . . data” by “sending
[it] . . . to website operators in an analytically useful way.”
Hasson Reply Br. 15. Hasson also argues that, because
FullStory received users’ geolocation data, the company
knows it is collecting communications from Pennsylvanians.
He contends that all these contacts support the exercise of
personal jurisdiction over FullStory under either the Calder
test or the Ford Motor framework.

                               A

       Starting with the Calder test, we agree with the District
Court that FullStory did not expressly aim its allegedly tortious
conduct at Pennsylvania. Hasson did not allege that Mattress
Firm “intentionally targets [its] site to” Pennsylvania with
forum-centric themes or ads. Toys, 

. And even
had he done so, Hasson did not allege that FullStory knew
about—or helped produce—any such forum-centric content.
Indeed, if a retailer does not expressly target Pennsylvania
merely by operating a website that is accessible there, neither
does a software company simply by providing code for that
website. Cf. Carefirst, 

 (no specific jurisdiction
over Illinois company in Maryland “merely” because the
company “utiliz[ed] servers owned by a Maryland-based
company”). In short, FullStory did not expressly aim at
Pennsylvania simply by providing code and other services to a
Texas company whose website is accessible in the forum. See
Remick, 

.

       Nor are we persuaded that FullStory aimed its alleged



                               24
wiretapping at Pennsylvania just because it knew that Mattress
Firm—or any other company it partnered with—conducted
business in the forum or made its website accessible there. We
have rejected the argument that “the ‘expressly aiming’
requirement is satisfied when the defendant is alleged to have
engaged in wrongful conduct targeted at a plaintiff whom the
defendant knows to be a resident of the forum state.” Budget
Blinds, Inc. v. White, 

 (3d Cir. 2008) (cleaned
up). Indeed, while a defendant’s “knowledge that the plaintiff
is located in the forum is necessary to the application of
Calder,” that “alone is insufficient to satisfy the targeting
prong of the effects test.” IMO Indus., 

.

        So Hasson had to do more than allege that FullStory
“harmed him while he happened to be residing in
Pennsylvania.” Marten, 

. He had to plead that
FullStory “knew that . . . [he] would suffer the brunt of the
harm caused by the tortious conduct in the forum.” 

(emphasis added). But Hasson’s “allegations and
evidence . . . do not affirmatively prove that [FullStory] knew
that it was targeting him in” Pennsylvania when the code was
dispatched to his browser. Rosenthal, 

. Hasson
did not allege that FullStory knew that he—or any other user—
was in Pennsylvania before Session Replay Code was
dispatched to his browser. Compared to Papa Johns and
Mattress Firm, FullStory is a degree removed from the alleged
harm, as Mattress Firm’s website was responsible for
“deliver[ing] session replay-enabling code to a user’s
browser,” not FullStory. Hasson App. 29. Session Replay Code
was sent to Hasson’s browser because of Mattress Firm’s
decision to host the code on its website and Hasson’s decision
to access the website while in Pennsylvania. But “jurisdiction
over an out-of-state intentional tortfeasor must be based on



                              25
intentional conduct by the defendant that creates the necessary
contacts with the forum,” not the “unilateral activity of a
plaintiff,” Walden, 

 (emphasis added) (cleaned
up), or a “third person,” Helicopteros, 

. We
therefore conclude that the chain of events preceding Session
Replay Code’s transmission to Hasson’s browser was too
attenuated to satisfy that requirement.

       We also reject that FullStory expressly aimed Session
Replay Code at Pennsylvania simply because it knew, based
on its collection of geolocation data, that the code was
intercepting data from users there. As discussed above, a
defendant’s post hoc discovery that the tortious conduct was
received in the forum, without more, does not establish that the
company “targeted (or “expressly aimed” [its] conduct at) the
forum.” IMO Indus., 

; see Mobile
Anesthesiologists, 

.

      For these reasons, we agree with the District Court that
Hasson’s complaint fails to establish that FullStory expressly
aimed its alleged wiretapping at Pennsylvania. So we need not
address whether the complaint satisfies Calder’s other prongs.
See Marten, 

.

                               B

       The District Court applied the Calder framework
because Hasson alleged intentional torts. See Hasson, 

, at *2. But as Hasson persuasively argues, the
“effects” test typically applies where the allegedly tortious
conduct occurs outside the forum but is felt inside the forum.
Here, by contrast, FullStory’s Session Replay Code allegedly
wiretapped Hasson in Pennsylvania. Though we agree with its
application of Calder, the District Court also should have



                              26
considered whether specific personal jurisdiction was proper
under the traditional test as applied in Ford Motor. And while
FullStory’s contacts with “other Pennsylvania clients who may
be using [its] software” may be “irrelevant to establish[ing]
specific jurisdiction” under Calder’s “express aiming” rubric,
Hasson, 

, at *2, it is possible that Hasson’s
claims “relate to” such contacts under the traditional test, Ford
Motor, 

 (cleaned up).

        As we noted above, in Ford Motor the Supreme Court
emphasized that Ford had extensively advertised, sold, and
serviced Explorers and Crown Victorias in the forum states.
See 

. Although those activities had no direct link to
the specific vehicles that injured the plaintiffs, the Court held
that those contacts still “relate[d] to” the plaintiffs’ claims
because they involved the vehicle models that injured the
plaintiffs. See 

 at 361–66.

        But rather than decide whether Hasson’s complaint
alleges sufficient contacts to support jurisdiction under the
traditional test, we will vacate and remand for the District
Court to make this determination. 6 See Penguin Grp. (USA)


6
  We reject FullStory’s contention that Hasson waived or
forfeited his argument that the District Court should have
applied the traditional test if it found jurisdiction lacking under
Calder. Though Hasson noted in his opposition brief that the
Supreme Court has articulated “an ‘effects test’” “[f]or specific
jurisdiction in tort cases,” he did not argue that courts must
apply only this test. Dist. Ct. Dkt. No. 34, at 5. Rather, he




                                27
Inc. v. Am. Buddha, 

 (2d Cir. 2011). In doing
so, the District Court may consider whether FullStory’s other
forum contacts—besides those related to Mattress Firm—alter
its conclusion that litigating in the Western District of
Pennsylvania “would place an undue burden upon FullStory”
such that “[t]he interests of justice would not be served if
FullStory were required to defend itself against this lawsuit in
Pennsylvania.” Hasson, 

, at *3.

                        *      *       *

        For the foregoing reasons, we will affirm the District
Court’s order dismissing the case for lack of personal
jurisdiction in Schnur v. Papa John’s Int’l, Inc., Appeal No.
23-2573. But we will vacate the order dismissing the case for
lack of personal jurisdiction in Hasson v. FullStory, Inc.,
Appeal No. 23-2535, and remand for the District Court to
apply the traditional test in accordance with Ford Motor. 7




argued that “jurisdiction is also proper under the traditional
purposeful availment test.” 

 (typeface altered and
capitalizations removed).
7
  Because our decision addresses only personal jurisdiction, we
do not consider Defendants’ other arguments that (1) Plaintiffs
consented to the collection of their data when they visited the
respective websites; and (2) that Plaintiffs’ allegations fail to
state a claim under WESCA and the common law.



                               28
Hasson v. FullStory, Inc., No. 23-2535 &
Schnur v. Papa John’s International, Inc., No. 23-2573

PHIPPS, Circuit Judge, concurring in part and dissenting in
part.

   I write separately with an observation about the Calder test
and with an articulation of my dissenting position that
Pennsylvania has specific personal jurisdiction over Papa
Johns under the traditional test for the claims brought by
Jordan Schnur.

   1. Calder Sometimes Comes Up Short.
    I agree with the Majority Opinion that the Calder test for
intentional torts is not met here. See Calder v. Jones, 

 (1984). That test requires that the defendant aim the
intentionally tortious conduct at the forum and that the brunt of
the harm be experienced in that forum, see 

, and here,
neither Schnur nor Hasson sufficiently alleges that either Papa
Johns or FullStory aimed their conduct at Pennsylvania. But
there are limits to Calder: its test was developed in the context
of a defamation claim in which allegedly false information
from outside of the forum was transmitted into the forum. See

, 789–90. Unlike Calder, the claims in these cases
are brought under Pennsylvania’s tort of intrusion upon
seclusion and its wiretapping statute, 

,
and they concern the capture or extraction of information from
the forum. Sometimes, the capture or extraction of data from
the forum will also involve action aimed at the forum, and
intentional-tort claims in those instances may satisfy the
Calder test. See, e.g., MacDermid, Inc. v. Deiter, 

 (2d Cir. 2012) (holding that personal jurisdiction was
proper in Connecticut after the defendant used her computer in
Canada to access servers she knew to be in Connecticut to
email herself files); CollegeSource, Inc. v. AcademyOne, Inc.,

, 1078–79 (9th Cir. 2011) (subjecting the
defendant to personal jurisdiction in California for




                               1
misappropriating information from the website of a competitor
it knew to be based in California). But other methods of
capturing or extracting information from the forum, such as
phishing, cloned websites, and spyware, may not necessarily
be aimed at the forum, and if they are not, then they will not
satisfy the Calder test. Although those types of capturing or
extracting information may be equally as malicious and
injurious to persons in the forum, a tortfeasor’s indifference to
the location of the victim would prevent the exercise of
personal jurisdiction under the Calder test. So as not to reward
or incentivize such indifference by intentional tortfeasors and
to allow states the opportunity to adequately protect their
residents, courts, in developing personal-jurisdiction
jurisprudence in a “common-law fashion,” J. McIntyre Mach.,
Ltd. v. Nicastro, 

 (2011) (plurality opinion),
could recognize a conjugate to the Calder test that balances the
interstate federalism principles underlying personal
jurisdiction, see World-Wide Volkswagen Corp. v. Woodson,

, 293–94 (1980), with the due process
considerations of “traditional notions of fair play and
substantial justice,” Int’l Shoe Co. v. Washington, 

 (1945) (internal quotation omitted). Specifically, to
hold accountable out-of-forum data pirates who seek to capture
or extract data without regard to the location of its source, the
companion doctrine would allow specific personal jurisdiction
over intentional tort claims in which the brunt of the harm is
experienced in the forum if data is captured or extracted from
the forum – instead of requiring proof of aiming at the
forum. While such a rule would likely result in Pennsylvania’s
permissible exercise of personal jurisdiction over Papa Johns
and FullStory in this case, neither Schnur nor Hasson has
advocated for recognition of a companion doctrine to Calder.

   2. Schnur’s Claims Against Papa Johns Satisfy
      the Traditional Test.
    My lone disagreement with the Majority Opinion is with
respect to its holding that Schnur’s claims do not satisfy the
traditional test for specific personal jurisdiction. Even so, I

                               2
take no issue with the Majority Opinion’s conclusion on the
first prong of the traditional test, viz., that Papa Johns has
formed contacts with and “‘purposefully availed’ itself of
engaging in activity in” Pennsylvania through its website and
the 85 physical storefronts that it uses to fulfill orders from that
website. Toys “R” Us, Inc. v. Step Two, S.A., 

,
451–52 (3d Cir. 2003); see also Burger King Corp. v.
Rudzewicz, 

 (1985). But as to the second
prong of the traditional test, see Bristol-Myers Squibb Co. v.
Sup. Ct. of Cal., 

 (2017), I disagree with the
conclusion that Schnur’s claims do not relate to those contacts
that Papa Johns had with Pennsylvania.
     Rather, for those claims, there is a “strong ‘relationship
among the defendant, the forum, and the litigation.’” Ford
Motor Co. v. Mont. Eighth Jud. Dist. Ct., 

(2021) (quoting Helicopteros Nacionales de Colom., S.A. v.
Hall, 

 (1984)). As to the defendant, Papa
Johns, it offers online ordering in Pennsylvania, uses a session
replay code to record those orders, and sells pizzas ordered
online from its restaurants located in Pennsylvania. The forum,
Pennsylvania, is where Schnur used his browser to access Papa
Johns’ website, which through the session replay code,
recorded his ordering behavior. It is also where the fulfillment
of the online order would take place by one of Papa Johns’
stores. The litigation complains of and seeks redress for the
use of the session replay code to record Schnur’s online
behavior while using his browser in Pennsylvania to access
Papa Johns’ website to consider placing an order from one of
Papa Johns’ stores in Pennsylvania. See Popa v. Harriet
Carter Gifts, Inc., 

 (3d Cir. 2022) (explaining
that a wiretap occurs where the browser reroutes the
communication). As I see it, the strong relationship is clear:
the common thread between the defendant, the forum, and the
litigation is Papa Johns’ use of a session replay code on its
website to record online consumer activity from a browser in
Pennsylvania that was used to place orders from Papa Johns’
locations in Pennsylvania.


                                 3
     In reaching a different conclusion, the Majority Opinion
argues through analogy that this case differs from Ford Motor.
It likens Papa Johns’ website to the vehicles at issue in Ford
Motor and the session replay code to defective parts. From
there, it reasons that because Papa Johns has not advertised its
website in Pennsylvania to the same extent that Ford advertised
its vehicles in the forum states, there must be a lack of the
requisite strong relationship among Papa Johns, Pennsylvania,
and Schnur’s claims. Embedded in that reasoning is the
assumption that the strong relationship required by Ford Motor
can be demonstrated only by facts closely akin to those in Ford
Motor – a suit against an out-of-state manufacturer that
advertises a product in the forum and has physical locations in
the forum to service and supply the parts for the product, see
Ford Motor, 592 U.S. at 365–66. But by articulating the strong
relationship test in general terms, the Supreme Court did not
limit it to any particular factual scenario. So, even if Papa
Johns’ contacts with Pennsylvania are not factually analogous
to those that Ford had with the forum states in that case, it could
still be that the strength of Papa Johns’ other contacts with
Pennsylvania coupled with the different claims brought by
Schnur are enough to satisfy the traditional test.

    And as recounted above, the relationship here, while not
factually analogous to the one in Ford Motor, is stronger than
the relationship in that case. There, Ford did not introduce the
defective vehicles into the forum states, and the claims related
to actions that Ford took outside of the forum states – the sale,
design, and manufacture of the vehicles. See id. at 354. By
contrast, Papa Johns chose to use its website to make sales in
Pennsylvania, used the session replay code in Pennsylvania,
and Schnur’s claims are based on Papa Johns’ recording his
website behavior on his browser in Pennsylvania, see Popa,

. With a much tighter nexus among the
defendant, the forum, and the litigation, there is no need here,
as there was in Ford Motor, for additional contacts with the
forum, such as through advertising of the website or product



                                4
support of the website, to sustain the requisite strong
relationship.

    For these reasons, I believe that the traditional test for
establishing specific personal jurisdiction is met with respect
to Schnur’s claims against Papa Johns, and I respectfully
dissent in part.




                              5