In re BPS Direct: keep card numbers out of session replay

If a session replay script can see your checkout form, it can record a full card number as the shopper types it. In BPS Direct, that single fact separated the two plaintiffs who can sue in federal court from the six who cannot.

US Court of Appeals, Third Circuit · Federal Wiretap Act and state privacy claims · Opinion of the court, 11 May 2026

The problem

Bass Pro Shops and Cabela’s (together "BPS") ran session replay code on basspro.com and cabelas.com. The plaintiffs alleged it captured "all mouse movements, clicks, scrolls, zooms, window resizes, keystrokes, [and] text entries" and let BPS and its providers build "video replay[s]" of each visit (Opinion at 2). Two plaintiffs bought things and typed their name, address and payment details. Six only browsed (at 4).

Case record

Court: US Court of Appeals, Third Circuit
Case number: No. 23-3235; district MDL No. 2:23-md-03074 (E.D. Pa., Judge Mark A. Kearney), consolidating suits first filed in several districts
Parties: Eight named shoppers v. BPS Direct, LLC and Cabela's LLC
Counsel: Shoppers: Lockridge Grindal Nauen (Kate M. Baxter-Kauf argued); Arthur Bryant Law; Lynch Carpenter; The Finley Firm; Hausfeld. BPS: Shook, Hardy & Bacon (Michael E. Rayfield argued) ([at 14–15](https://www2.ca3.uscourts.gov/opinarch/233235p.pdf))
Laws: Federal Wiretap Act, Computer Fraud and Abuse Act, CIPA, California statutory larceny and UCL, the Maryland, Massachusetts, Missouri and Pennsylvania wiretap acts, the Missouri Merchandising Practices Act, and privacy and property torts ([E.D. Pa. memorandum, 5 December 2023](<https://www.govinfo.gov/content/pkg/USCOURTS-paed-2_23-md-03074/pdf/USCOURTS-paed-2_23-md-03074-0.pdf>))
Stage: Standing dismissal reversed for two plaintiffs, affirmed as modified for six; remanded
Precedent: Opinion of the court, recorded as published on [CourtListener](https://www.courtlistener.com/opinion/10857025/bps-direct-llc-v/); cited as 175 F.4th 423 in a later Third Circuit opinion
Amount: None. No merits ruling, damages or settlement
Source review: 17 October 2026

The problem
Case record
What was alleged
Technical issue
Timeline
Outcome
What it cost
Why it matters
How Inth catches this
Checks for your own systems
Sources and limits

What was alleged

What was alleged
Claim	What the law requires	Facts alleged	Result
Federal Wiretap Act, 18 U.S.C. § 2510 et seq.	Intentional interception of the contents of a communication	Session replay code captured keystrokes and text entries "with hyper-frequency, in intervals just milliseconds apart", even before a shopper pressed submit ([at 2](https://www2.ca3.uscourts.gov/opinarch/233235p.pdf))	Standing found for Cornell and Montecalvo only; merits not reached
Computer Fraud and Abuse Act, 18 U.S.C. § 1030	Unauthorised access to a protected computer, with qualifying loss	The same capture	Standing as above; merits not reached
CIPA and the Maryland, Massachusetts, Missouri and Pennsylvania wiretap acts, plus privacy and property torts ([E.D. Pa. memorandum](<https://www.govinfo.gov/content/pkg/USCOURTS-paed-2_23-md-03074/pdf/USCOURTS-paed-2_23-md-03074-0.pdf>))	Intercepting or recording communications without the consent each state requires (the rules differ by state)	The same capture, plus provider "fingerprints" that could de-anonymise users across sites ([at 3](https://www2.ca3.uscourts.gov/opinarch/233235p.pdf))	Standing as above; merits not reached

Technical issue

Tools or vendors: session replay code from "various third-party Session Replay Code providers", "such as Microsoft, Quantum Metric, and Mouseflow" (at 2). The opinion does not say which provider ran on which page.
Where: product pages and the checkout flow on basspro.com and cabelas.com.
What data: for browsers, clicks, scrolls, search terms and keystrokes. For the two buyers, name, address and "payment and billing information", which the court read as a complete card number with expiry date and security code (at 8).
Vendor servers: providers stored the data on their own servers and could aggregate it under browser "fingerprints" across every site using their code (at 3).
When: whenever a user visited; BPS gave no opportunity to opt out (at 3).
How it came to light: the consolidated complaint. No network capture was tested at this stage.

Inth’s technical interpretation: replay scripts attach input listeners to every field in the page’s DOM and upload what they see in small batches. If the card number field is an ordinary <input> on your own page, the script can read it unless that field is masked, and masking is a per-tool, per-project setting that a release can change. A payment field rendered inside the payment processor’s cross-origin iframe is different: the replay script on your page cannot read inside it, so the card number never enters the replay stream at all. That is a stronger control than masking, because it does not depend on a dashboard setting staying correct.

Illustrative pattern, not the defendant’s code. A replay tool on every route and a card field in the page’s own DOM:

// Loaded unconditionally from the layout; nothing excludes /checkout.
const replay = document.createElement('script');
replay.src = 'https://cdn.replay-vendor.example/record.js';
document.head.appendChild(replay);

// checkout.html
// <input name="cardnumber" autocomplete="cc-number" />
// <input name="cvc" autocomplete="cc-csc" />

Illustrative pattern, not the defendant’s code. Replay behind consent, and the card number in the processor’s iframe:

import type { Script } from 'c15t';

export const replayVendor: Script = {
  id: 'replay-vendor',
  src: 'https://cdn.replay-vendor.example/record.js',
  category: 'measurement', // waits for measurement consent
};

// Checkout: Stripe Elements renders the card field in Stripe's iframe,
// so no script on this page can read the digits.
const stripe = Stripe('pk_live_...');
const card = stripe.elements().create('card');
card.mount('#card-element');

Timeline

Timeline
Date	Event
2022–2023 (years from the case numbers)	Eight suits filed in several federal districts, transferred to the Eastern District of Pennsylvania and consolidated ([at 3](https://www2.ca3.uscourts.gov/opinarch/233235p.pdf))
5 December 2023	District court dismisses for lack of standing: six with prejudice, two without, 705 F. Supp. 3d 333 ([E.D. Pa. memorandum](<https://www.govinfo.gov/content/pkg/USCOURTS-paed-2_23-md-03074/pdf/USCOURTS-paed-2_23-md-03074-0.pdf>); [3d Cir. opinion at 4–5](https://www2.ca3.uscourts.gov/opinarch/233235p.pdf))
After dismissal	Cornell and Montecalvo stand on their complaint instead of amending; all eight appeal
10 September 2025	Argued
11 May 2026	Reversed in part, affirmed as modified in part, remanded ([opinion](https://www2.ca3.uscourts.gov/opinarch/233235p.pdf))

Outcome

The court applied TransUnion and its own decision in Cook v. GameStop. For the six browsers, nothing changed: their "browsing for quotidian items was no more private than the physical browsing countless shoppers do daily in BPS’s brick-and-mortar stores" (at 11). The fingerprinting allegation "states only a theoretical path to injury, not an actual one" (at 12).

For the two buyers, the court split the analysis. Card data is "highly sensitive" (at 8), but sharing it with a replay provider that sends it back to BPS stays "functionally internal", so there was no harm like public disclosure (at 9). Intrusion upon seclusion was different: "one expects her complete credit card or debit card number to be free from prying eyes" (at 12). Letting providers surreptitiously record those numbers was harm "closely analogous" to that tort, so Cornell and Montecalvo have standing (at 12–13).

The six browsers' dismissal was changed to without prejudice. The case returns to the district court. Standing is not liability: the court did not decide whether any statute was violated.

What it cost

What it cost
Item	Record
Damages or settlement	None so far
Fee award	None
Defence costs	Not stated in the cited record

Why it matters

It applies the "sensitive data" exception. Popa v. Microsoft said replay could be different for "sensitive medical or financial information". BPS Direct applies that exception to card numbers. It cited the D.C. Circuit’s Pileggi decision, which found an intrusion-like injury where video-viewing data went to Meta, as reaching the same conclusion (at 12–13).
It is already being extended. In Santoro v. Tower Health (28 August 2026), the Third Circuit used BPS Direct to hold that patients whose health information went to Meta through the Meta Pixel alleged a concrete injury. The patients still lost: the court affirmed dismissal because they had not properly sought leave to amend (3d Cir. opinion at 1, 6–9).
The standing line now has a shape. TransUnion sets the test. In re Facebook Internet Tracking (9th Cir. 2020) found standing for logged-out profiling. Jones v. Bloomingdales.com (8th Cir. 2024), Cook (3d Cir. 2025, precedential) and Popa (9th Cir. 2025, published) rejected it for ordinary browsing. BPS Direct restores it where card numbers were captured.
See Session replay and chat recording and Sensitive context in event data.

How Inth catches this

Code audit: flags a pull request that adds a session replay SDK, or that renders card, CVC or account fields as plain inputs on a route where a replay tool runs, and traces those fields to the replay vendor’s destination.
Website audit: records which replay vendor domains load on checkout pages, with page, time, region and consent state, and checks them against the vendor record and policy.
Consent banner: session replay waits behind measurement consent where the policy is opt-in. Inth’s default California policy is opt-out, so replay runs there until the visitor opts out unless you configure California opt-in.
Evidence: finding history shows when a replay tool reached checkout and who approved it; consent records show each visitor’s choice and the policy that applied.

None of this proves a replay vendor did not store a number that reached it; for that you need the vendor’s own logs and deletion records.

Checks for your own systems

In the repository

List every route where a replay SDK initialises; checkout, account and payment routes should be excluded or fully masked.
Confirm card number, expiry and CVC fields are rendered by the payment processor’s hosted fields or iframe, not as your own <input> elements.
Search for unmask overrides and for any custom event that copies form values into analytics.

In the browser and network

On checkout, inspect the card field in DevTools: if it is not inside a cross-origin iframe, a page script can read it.
Type a test card number and filter the Network panel for each replay domain; open the vendor’s replay of that session and check what appears.
In a fresh profile, click Reject before browsing and confirm no replay script loads on any page, including checkout.

With the people responsible

Ask the payments owner whether PCI scoping assumed no third-party scripts on checkout, and whether that is still true.
Check each replay vendor’s contract for its own use of data and for deletion on request.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit BPS Direct’s or Cabela’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.