GameStop Inc. is under legal scrutiny as a proposed class action lawsuit challenges the company's use of third-party software to track and record users’ online activity, raising concerns over privacy rights and potential violations of Pennsylvania's wiretap law.

Amber Cook, the proposed lead plaintiff, is asking the U.S. Court of Appeals for the Third Circuit to revive her suit, which alleges that GameStop unlawfully deployed Microsoft’s "session replay" software without disclosing it to customers. The technology allegedly captured mouse movements, clicks, and search inputs on the GameStop website — even if the browsing behavior was deemed “boring” or mundane.

Representing Cook, attorney Jamisen A. Etzel of Lynch Carpenter LLP argued before the panel on Wednesday that GameStop’s actions amount to unauthorized surveillance. “Even if the online activity is as simple as checking stock availability, that does not strip users of their right to privacy under state law,” Etzel said. “This is the digital equivalent of wiretapping a phone call without consent.”

Cook’s lawsuit was dismissed by a lower court in 2023 on the grounds that she had not shown a "concrete harm" sufficient for legal standing. Etzel challenged that interpretation, contending that the harm lies in the act of undisclosed third-party surveillance itself, regardless of whether the collected data is sensitive or personally identifiable.

The case builds on previous legal precedent in Pennsylvania, where courts have acknowledged that third-party tracking of online interactions can potentially violate the Pennsylvania Wiretapping and Electronic Surveillance Control Act. However, recent decisions — including the dismissal of Popa v. Harriet Carter Gifts — have raised the bar for plaintiffs to prove actual harm, especially when privacy policies are present.

GameStop’s legal team, led by Jeffrey Landis of Landis Hunsberger Gingrich & Weik LLP, countered that no sensitive or identifiable information was collected or shared. “This is not an intrusion into a private space,” Landis said. “It’s more akin to observing a shopper in a physical store and noting how long they linger at each shelf.”

The panel of Third Circuit judges — Thomas M. Hardiman, David J. Porter, and D. Michael Fisher — posed questions on whether tracking digital interactions like mouse movements could ever be equated with traditional notions of communication or privacy invasion.

GameStop maintains that its intent was limited to assessing website effectiveness, not invading personal privacy. However, Cook’s counsel insists that the core issue remains consent — or the lack thereof — to third-party monitoring.

The appeal, Cook v. GameStop Inc., case number 23-2574, continues to raise significant questions about the boundaries of online surveillance, user privacy, and what constitutes harm in the digital age.