Amber Cook, individually and on behalf of all others similarly situated v. GAMESTOP, INC. On Appeal from the United States District Court for the Western…

PRECEDENTIAL
UNITED STATES COURT OF APPEALS
FOR THE THIRD CIRCUIT
______
No. 23-2574
______
AMBER COOK, individually and on behalf of all others
similarly situated,
Appellant
v.
GAMESTOP, INC.
______
On Appeal from the United States District Court
for the Western District of Pennsylvania
(D.C. Civil No. 2:22-cv-01292)
District Judge: Honorable J. Nicholas Ranjan
______
Argued April 9, 2025
Before: HARDIMAN, PORTER, and FISHER, Circuit
Judges.
(Filed: August 7, 2025)

-- 1 of 17 --

2
Jamisen A. Etzel ARGUED
Gary F. Lynch
Lynch Carpenter
1133 Penn Avenue
5th Floor
Pittsburgh, PA 15222
Counsel for Appellant
Jeffrey G. Landis ARGUED
ZwillGen
1900 M Street NW
Suite 250
Washington, DC 20036
Sheri B. Pan
ZwillGen Law
369 Pine Street
Suite 506
San Francisco, CA 94104
William J. Wyrick
Cafardi Ferguson Wyrick & Weis
2605 Nicholson Road
Building II, Suite 2201
Sewickley, PA 15143
Counsel for Appellee
______
OPINION OF THE COURT
______

-- 2 of 17 --

3
FISHER, Circuit Judge.
Session replay code is a script1 of computer code that
enables a company to track how internet users browse and
interact with its website. It captures a user’s mouse
movements, clicks, keystrokes, and more. A session replay
code provider then aggregates the data into a video for the
company reenacting the user’s visit. This can then be used to
improve website functionality and user experience.
Amber Cook visited GameStop’s retail website, and her
interactions were captured by Clarity, a session replay code
provided by Microsoft. She moved her mouse, clicked links,
typed in a search bar, and added a product to her “cart.” But
she did not input any sensitive or personal information. Cook
sued GameStop for intrusion upon seclusion and violations of
the Pennsylvania Wiretapping and Electronic Surveillance
Control Act (WESCA). The District Court held that Cook did
not allege a concrete injury sufficient for Article III standing
and dismissed her suit with prejudice. Cook appeals. We agree
with the District Court that dismissal is proper, but we will
modify the District Court’s order so that the dismissal will be
without prejudice.
I.
We start by describing the technology as alleged.
GameStop installed a type of session replay code from
Microsoft called Clarity on its website. When a user visits
GameStop’s website, Clarity delivers code to the user’s
browser instructing the browser to send “‘event’ data to a
designated third-party server.” App. 37 ¶ 24. This allows
Clarity to “capture[] a user’s interactions with [the] website,
logging every website user’s mouse movements and clicks,
1 A script is a set of instructions or commands written
in a programming language that tells a computer what to do.

-- 3 of 17 --

4
scrolling window resizing, user inputs, and more.” App. 42
¶ 46. The information captured “can then be used to play back
a user’s journey through a website, showing how they
interacted with site navigation, calls to action, search features,
and other on-page elements.” App. 42–43 ¶ 47. The code also
assigns “a specific user ID to each website visitor so their
website use and interactions can be monitored over time.” App.
42 ¶ 46.
While in Pennsylvania, Cook visited GameStop’s
website. She navigated the website by hovering over and
clicking on various products, and by typing terms into the
search bar. Though Cook never purchased anything during her
visit, she added a product to her shopping cart by using her
mouse to click “add to cart.” App. 45 ¶ 58. The instant Cook
visited the website, the session replay code technology began
recording her interactions. There is a privacy policy describing
the information collected by session replay code, but it is
“buried at the very bottom of the website.” App. 49 ¶ 72.
Cook sued GameStop, alleging that it violated WESCA
and committed intrusion upon seclusion by using session
replay code on its website. Cook brought her claims as a
putative class action on behalf of herself and “[a]ll natural
persons in Pennsylvania whose Website Communications were
captured through the use of Session Replay Code embedded in
www.gamestop.com.” App. 49 ¶ 73. GameStop moved to
dismiss the first amended complaint under Federal Rules of
Civil Procedure 12(b)(1) and 12(b)(6). It argued that she lacked
Article III standing because she failed to allege an injury and,
alternatively, that she failed to state a claim.
The District Court agreed and granted GameStop’s
motion under Rule 12(b)(1). The District Court held that Cook
lacked Article III standing to bring her claims because she did
not allege a concrete harm. It rejected Cook’s argument that

-- 4 of 17 --

5
the mere recording of her website activity by GameStop was
sufficient to confer standing, citing TransUnion LLC v.
Ramirez, 594 U.S. 413 (2021), which clarified that a plaintiff
must allege harms analogous to those traditionally recognized
at common law. It concluded that Cook’s harms were not
analogous to the traditional intangible harms of disclosure of
private information and intrusion upon seclusion because
nothing “could connect her browsing activity to her.” App. 8.
Concluding that amendment would be inequitable and futile, it
dismissed with prejudice. In the alternative, it held that she
failed to “plead the necessary facts to support her claims for
violation of [WESCA] or intrusion upon seclusion.” App. 2.
Cook appeals.
II.2
“We exercise de novo review of a dismissal for a lack
of standing, ‘accepting the facts alleged in the complaint as true
and construing the complaint in the light most favorable to the
non-moving party.’” Barclift v. Keystone Credit Servs., LLC,
93 F.4th 136, 141 (3d Cir. 2024) (quoting Potter v. Cozen &
O’Connor, 46 F.4th 148, 153 (3d Cir. 2022)). “[W]e review the
District Court’s dismissal of the complaint with prejudice for
an abuse of discretion.” United States ex rel. Zizic v.
Q2Administrators, LLC, 728 F.3d 228, 234 (3d Cir. 2013). The
District Court has abused its discretion if it based that dismissal
“on an erroneous view of the law.” Cooter & Gell v. Hartmarx
Corp., 496 U.S. 384, 405 (1990).
III.
2 The District Court had jurisdiction under 28 U.S.C.
§ 1332(d)(2) (diversity in class action lawsuits). We exercise
appellate jurisdiction under 28 U.S.C. § 1291 (final decisions
of district courts).

-- 5 of 17 --

6
Under Article III of the United States Constitution, the
power of the federal judiciary “extends only to ‘Cases’ and
‘Controversies.’” Spokeo, Inc. v. Robins, 578 U.S. 330, 337
(2016) (quoting U.S. Const. art. III, § 2). Article III standing
doctrine ensures that we do not exceed our power by
“limit[ing] the category of litigants empowered to maintain a
lawsuit in federal court.” Id. at 338. To establish standing under
Article III, a “plaintiff must have (1) suffered an injury in fact,
(2) that is fairly traceable to the challenged conduct of the
defendant, and (3) that is likely to be redressed by a favorable
judicial decision.” Id. “The plaintiff, as the party invoking
federal jurisdiction, bears the burden of establishing these
elements.” Id.
This appeal concerns only the first element of the
standing analysis. Cook argues that GameStop’s violation of
WESCA satisfies the injury-in-fact requirement. WESCA,
which supplements its federal counterpart, the Electronic
Communications Privacy Act, 18 U.S.C. § 2510, et seq.; Popa
v. Harriet Carter Gifts, Inc., 52 F.4th 121, 125–26 (3d Cir.
2022), prohibits the interception of electronic communications
without prior consent, see 18 Pa. Cons. Stat.

-- 6 of 17 --

7
§§ 5704(4), 5725(a).3 She says she suffered an injury in fact
due to GameStop’s violation of WESCA because her “privacy
was invaded when her communications with . . . GameStop’s
website were intercepted” by the session replay code.
Appellant’s Br. 11.
A.
“To establish injury in fact, a plaintiff must show that
he or she suffered ‘an invasion of a legally protected interest’
that is ‘concrete and particularized’ and ‘actual or imminent,
not conjectural or hypothetical.’” Spokeo, 578 U.S. at 339
(quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)).
An alleged statutory violation is not necessarily an injury in
fact; “a concrete injury” is still required. TransUnion, 594 U.S.
at 426 (quoting Spokeo, 578 U.S. at 341). That is because the
legislature “may not simply enact an injury into existence,
using its lawmaking power to transform something that is not
remotely harmful into something that is.” Id. (quoting Hagy v.
Demers & Adams, 882 F.3d 616, 622 (6th Cir. 2018)). We must
still “independently decide” if the plaintiff has suffered a
concrete injury. Id. “An injury in law is not an injury in fact.
Only those plaintiffs who have been concretely harmed by a
3 In Popa v. Harriet Carter Gifts, an online shopper
sued a retail website alleging that a third-party browser
intercepted her data while she shopped online, violating
WESCA. 52 F.4th at 124. The shopper, like Cook, “clicked
links, used the search function, and . . . added an item to her
cart.” Id. The issue on appeal was whether the third party was
liable under WESCA. Id. at 126. Although we proceeded to
the merits, the issue of Article III standing was never
analyzed. And “a summary and unexplained jurisdictional
ruling . . . has no precedential effect.” Goldman v. Citigroup
Glob. Markets Inc., 834 F.3d 242, 251 (3d Cir. 2016).

-- 7 of 17 --

8
defendant’s statutory violation may sue that private defendant
over that violation in federal court.” Id. at 427 (citation
modified).
“Traditional tangible harms, such as physical harms and
monetary harms,” are considered “[t]he most obvious”
concrete injuries. Id. at 425 (citation modified). But certain
intangible harms are also concrete. “Chief among them are
injuries with a close relationship to harms traditionally
recognized as providing a basis for lawsuits in American
courts.” Id. Disclosure of private information and intrusion
upon seclusion are examples. Id. That is not to say all
intangible harms must replicate forms of traditional relief.
“Congress may ‘elevate to the status of legally cognizable
injuries concrete, de facto injuries that were previously
inadequate in law.’” Id. (quoting Spokeo, 578 U.S. at 341).
To determine whether a plaintiff has suffered a concrete
injury, we ask “whether the asserted harm has a ‘close
relationship’ to a harm traditionally recognized as providing a
basis for a lawsuit in American courts—such as physical harm,
monetary harm, or various intangible harms including . . .
reputational harm.” Barclift, 93 F.4th at 145 (quoting
TransUnion, 594 U.S. at 417). So “while [a plaintiff] does not
need to exactly duplicate a traditionally recognized harm, [he
or she] must still analogize to a harm of the same character of
previously existing legally cognizable injuries.” Id. at 146
(citation modified).
Bearing this framework in mind, we must consider how
“close” the relationship of Cook’s asserted harm must be to a
traditional harm comparator. Id. at 142. While some circuits
have required a strict “element-based approach, wherein a
plaintiff’s alleged harm must not lack any element of the
comparator tort that was essential to liability at common law,”
our approach is not so rigid. Id. at 144. We “compare the kind

-- 8 of 17 --

9
of harm a plaintiff alleges with the kind of harm caused by the
comparator tort.” Id. at 144–45.
B.
Cook alleged that GameStop’s WESCA violation
caused the intangible harm of invasion of privacy. She says the
alleged harm is closely related to harm caused by the privacy
torts of disclosure of private information and intrusion upon
seclusion. The District Court rejected Cook’s argument that
“the mere fact that GameStop recorded any information about
[her] visit to GameStop’s website is injury enough to give her
standing to sue.” App. 5. We analyze each of Cook’s
comparator torts in turn.
1.
Disclosure of private information is also known as
“unreasonable publicity given to another’s private life.”
Barclift, 93 F.4th at 145. “A defendant is liable under this tort
when he [or she] ‘gives publicity to a matter concerning the
private life of another . . . if the matter publicized is of a kind
that (a) would be highly offensive to a reasonable person, and
(b) is not of legitimate concern to the public.’” Id. (quoting
Restatement (Second) of Torts § 652D (1977)). The harm is
“the humiliation that accompanies the disclosure of sensitive
or scandalizing private information to public scrutiny.” Id. at
145–46 (quoting Nabozny v. Optio Sols. LLC, 84 F.4th 731,
736 (7th Cir. 2023)). “If there are no grounds to believe that
the information will result in humiliation, then there is no
comparable harm . . . .” Id. at 147. Additionally, “harm from
disclosures that remain functionally internal are not closely
related to those stemming from public ones.” Id. at 146.
We recently examined this tort as a comparator in
Barclift. There, a plaintiff alleged a collection agency violated
the Fair Debt Collection Practices Act when, without her

-- 9 of 17 --

10
consent, it shared her personal information with a third-party
mailing vendor, which then mailed her a collection notice
regarding her outstanding debt for medical services. Id. at 139–
40. We held “the type of injury [the plaintiff] alleged ‘is not
remotely analogous to the harm caused by the tortious public
dissemination of sensitive facts about another’s private life.’”
Id. at 148 (quoting Nabozny, 84 F.4th at 737–38). We
explained that when “communication of personal information
only occurs between a debt collector and an intermediary
tasked with contacting the consumer, the consumer has not
suffered the kind of privacy harm traditionally associated with
public disclosure.” Id. at 146.
Similarly, the harm Cook alleged is not analogous to
“the humiliation that accompanies the disclosure of sensitive
or scandalizing private information to public scrutiny.” Id. at
145–46 (citation modified). First, the information captured by
the session replay code was not sensitive or personal. Cook
alleged that the code intercepted data regarding her “mouse
movements, clicks, keystrokes (such as text being entered into
an information field or text box), URLs of web pages visited,
and/or other electronic communications in real-time.” App. 30
¶ 1. Cook said that during a visit to GameStop’s website, she
“browsed for different products for sale[,]. . . communicated
with GameStop’s website by using her mouse to hover and
click on certain products and typing search words into the
search bar,” and “selected a product to add to her shopping cart
by clicking ‘add to cart.’” App. 45 ¶ 58. Cook did not—and
could not plausibly—allege that a disclosure of this
information resulted in embarrassment or humiliation.
Furthermore, she did not share her name, contact information,
address, or billing information while on GameStop’s website.
Cook alleged that GameStop “obtain[ed] certain information
about her device [and] browser” and “create[d] a unique ID and

-- 10 of 17 --

11
profile for her.” App. 45 ¶ 60. But she did not allege that
GameStop identified her through this information. She alleged
only that “[w]hen a user eventually identifies themselves”—
something Cook never did—“the provider can then . . . back-
reference all of that user’s other web browsing.” App. 39 ¶ 35.
Second, even assuming the information was the type
that could cause Cook humiliation under “public scrutiny,”
Barclift, 93 F.4th at 146 (citation modified), the information
was never publicized or even publicly disclosed. Cook’s
allegations concern disclosure of information to Microsoft, a
third-party vendor to GameStop, not the broader public.
Cook’s alleged harm is therefore not analogous to the harm
associated with the tort of disclosure of private information.
2.
Intrusion upon seclusion is an intentional intrusion,
“physical[] or otherwise, upon the solitude or seclusion of
another or his private affairs or concerns . . . if the intrusion
would be highly offensive to a reasonable person.” Kline v.
Sec. Guards, Inc., 386 F.3d 246, 260 (3d Cir. 2004) (quoting
Harris by Harris v. Easton Pub. Co., 483 A.2d 1377, 1383 (Pa.
Super. Ct. 1984)). “The tort may occur by (1) physical
intrusion into a place where the plaintiff has secluded himself
or herself; (2) use of the defendant’s senses to oversee or
overhear the plaintiff’s private affairs; or (3) some other form
of investigation or examination into plaintiff’s private
concerns.” Borse v. Piece Goods Shop, Inc., 963 F.2d 611, 621
(3d Cir. 1992).
Unlike the disclosure of private information, the harm
caused by intrusion upon seclusion does not turn on the
exposure of personal or sensitive information. That is because
the tort “consists solely of an intentional interference with [the
plaintiff’s] interest in solitude or seclusion, either as to his
person or as to his private affairs or concerns.” Restatement

-- 11 of 17 --

12
(Second) of Torts § 652B cmt. a (1977). “The intrusion itself
makes the defendant subject to liability, even though there is
no publication or other use of any kind of the . . . information”
acquired. Id. cmt. b. In Susinno v. Work Out World, Inc., we
recognized that an unsolicited telemarketing call—even one
that does not involve private or sensitive information—disturbs
the recipient’s solitude. 862 F.3d 346, 352 (3d Cir. 2017). We
held, therefore, that a statute prohibiting such unsolicited calls
“protect[s] the same interests implicated in the traditional
common law cause of action” of intrusion upon seclusion. Id.
Cook conclusorily alleged that session replay code’s
capability is the “electronic equivalent of ‘looking over the
shoulder’ of each visitor to the GameStop website for the entire
duration of their website interaction.” App. 31 ¶ 2. And she
says her “electronic communications with GameStop” were
presumed private. Appellant’s Br. 39–40. But “[m]ost of us
understand that what we do on the Internet is not completely
private.” In re Nickelodeon Consumer Priv. Litig., 827 F.3d
262, 266 (3d Cir. 2016). And, for the same reasons discussed
above for the tort of disclosure of private facts, none of the
information Cook entered on GameStop’s website was
personal or sensitive. So, unlike the recipient of an unsolicited
telemarketing call, Cook cannot plausibly allege that there was
an intrusion of her solitude or seclusion as to her person or
private affairs. Therefore, Cook’s alleged harm is not
analogous to the harm associated with intrusion upon
seclusion, and she lacks Article III standing to pursue her
common law claim as well.
C.
Cook argues that “WESCA codifies a presumption of
privacy in all electronic communications.” Appellant’s Br. 45.
She claims, “as a matter of state policy,” that “the interception
of electronic communications does not include a precondition

-- 12 of 17 --

13
that the claimant have a ‘reasonable expectation of privacy.’”
Appellant’s Br. 45 (quoting App. 7). She asserts that “the
statute’s expansion of protection to a wider range of
information than would be protected by the common law is
precisely the type of ‘elevation’ of an intangible harm into a
concrete injury that Spokeo and TransUnion permit.”
Appellant’s Br. 46.
This misconstrues the meaning of “elevation” in
TransUnion. A legislature may “elevate harms that exist in the
real world” to make them legally actionable. TransUnion, 594
U.S. at 426 (quoting Hagy, 882 F.3d at 622) (citation
modified). But it “may not simply enact an injury into
existence, using its lawmaking power to transform something
that is not remotely harmful into something that is.” Id.
(quoting Hagy, 882 F.3d at 622). Cook’s theory contradicts this
fundamental holding of TransUnion. The harm caused by
intrusion upon seclusion necessarily accompanies an intrusion
into a person’s solitude or private affairs. Absent that type of
intrusion, the harm Cook alleged is not similar.
Critically, TransUnion tells us to consider the plaintiff’s
concrete harm alleged, not the harm the statutory cause of
action typically protects against. See id. at 426–27 (“[A]n
important difference exists between (i) a plaintiff’s statutory
cause of action to sue a defendant over the defendant’s
violation of federal law, and (ii) a plaintiff’s suffering concrete
harm because of the defendant’s violation of federal law.”).
Cook’s theory starts with GameStop’s alleged violation of
WESCA itself. She assumes that “her alleged harm from
GameStop’s WESCA violation satisfies the Spokeo test
because, by protecting communications from unauthorized
eavesdropping, the WESCA statute protects against the same
kind of harm—an invasion of privacy—that has long been
recognized at common law, not just by wiretapping statutes.”

-- 13 of 17 --

14
Appellant’s Br. 37. Cook incorrectly implies that wherever
there is a statutory violation of WESCA for tracking web
browsing information, there also is an invasion of privacy and
thus a concrete harm.4
Cook also argues that assessing “whether [she]
established a ‘reasonable expectation of privacy’ in her
communications with GameStop before deciding the question
of standing . . . conflates standing with [the] merits.”
Appellant’s Br. 41. She maintains that whether product
preferences qualify as personal or sensitive information is a
merits issue. But we always independently determine if
allegations “affirmatively and plausibly suggest . . . standing to
sue.” Knudsen v. MetLife Grp., Inc., 117 F.4th 570, 576–77 (3d
Cir. 2024) (quoting Finkelman v. Nat’l Football League, 810
F.3d 187, 194 (3d Cir. 2016)). And we have decided similar
issues at the pleading stage. Nickelodeon, 827 F.3d at 295
n.205 (explaining that in an intrusion upon seclusion claim, we
“may decide the ‘highly offensive’ issue as a matter of law at
the pleading stage when appropriate”). Because Cook does not
plausibly allege that she was secluded, in solitude, or that her
website activity involved her private affairs, she does not
allege a kind of harm sufficient for standing. This conclusion
is not a premature merits determination, but an assessment of
the plausibility of her alleged injury as it pertains to standing.
4 Of course, that Cook lacks standing does not mean
that no plaintiff can proceed in federal court to seek redress of
web-browsing tracking under WESCA. See Hunstein v.
Preferred Collection & Mgmt. Servs., Inc., 48 F.4th 1236,
1248 (11th Cir. 2022) (“Our standing inquiry centers on
whether a given plaintiff has pleaded injury . . . . The fact that
one plaintiff . . . has not pleaded injury under this statute does
not show that no one else can or will.”).

-- 14 of 17 --

15
D.
Cook also relies on two of our cases—Nickelodeon and
Google II—which held plaintiffs suffered a concrete harm
from the tracking of their internet browsing activity. For the
reasons that follow, these cases are not controlling.
In Nickelodeon, we considered whether a concrete
injury occurred when a website operator stated it would not
collect the personal information of children visiting Nick.com,
but did so anyway. Nickelodeon, 827 F.3d at 269. Cook
highlights that we said the harm was “clearly particularized, as
each plaintiff complains about the disclosure of information
relating to his or her online behavior.” Id. at 274. We held the
“unlawful disclosure of legally protected information” was a
“clear de facto injury.” Id.
Cook’s allegations are materially different. Principally,
Nick.com promised not to collect information. Nick.com’s
registration form included a message for parents of children
who wanted to register for an account: “HEY GROWN-UPS:
We don’t collect ANY personal information about your kids.
Which means we couldn’t share it even if we wanted to!” Id.
at 269. By contrast, Cook alleged only that “GameStop [did]
not ask website visitors . . . for prior consent before” collecting
web browsing activity. App. 48 ¶ 70.
In Google II, we considered whether a concrete injury
occurred when Google “bypass[ed] Safari and Internet
Explorer privacy settings and track[ed] internet-user
information” by creating a web browser cookie. In re: Google
Inc. Cookie Placement Consumer Priv. Litig., 934 F.3d 316,
321 (3d Cir. 2019) (Google II). We held that the alleged injury
was sufficiently concrete. “History and tradition reinforce that
a concrete injury for Article III standing purposes occurs when
Google, or any other third party, tracks a person’s internet
browser activity without authorization. Privacy torts have

-- 15 of 17 --

16
become ‘well-ensconced in the fabric of American law.’” Id.
at 325 (quoting In re Horizon Healthcare Servs. Inc. Data
Breach Litig., 846 F.3d 625, 638 (3d Cir. 2017)).
Cook says these cases are controlling because “they
involved nonconsensual tracking of individuals’ internet
browsing.” Appellant’s Br. 30. But the allegations in Google II
and Nickelodeon were “indistinguishable” from one another—
and distinguishable from this case—because the “plaintiffs
alleged that a third party . . . tracked their personal internet
browsing information in violation of the third party’s own
promises not to do so.” Google II, 934 F.3d at 325. As stated
above, GameStop made no promise to refrain from collecting
information, and, in fact, disclosed what information it would
collect, albeit in an allegedly inconspicuous location on its
website.
* * *
In sum, Cook did not suffer a concrete injury. Her
alleged harm is not the kind of harm caused by the privacy torts
of disclosure of private information and intrusion upon
seclusion. Because Cook has not suffered a concrete injury, she
did not adequately allege an injury in fact. We therefore
conclude that Cook lacks Article III standing.5
IV.
The District Court correctly dismissed Cook’s amended
complaint for lack of jurisdiction, but it legally erred in
dismissing it with prejudice and consequently abused its
5 Because Cook lacks Article III standing, we are
precluded from addressing the merits of her WESCA and
intrusion upon seclusion claims. Associated Builders &
Contractors W. Pa. v. Cmty. Coll. of Allegheny Cnty., 81
F.4th 279, 291 n.8 (3d Cir. 2023).

-- 16 of 17 --

17
discretion. Cook does not raise this issue in her brief, but
because it implicates our subject matter jurisdiction, it cannot
be waived or forfeited, and we must consider it independently.
See Vuyanich v. Smithton Borough, 5 F.4th 379, 385 (3d Cir.
2021).
The District Court noted that Cook failed to submit a
second amended complaint to cure the jurisdictional defect
and, in fact, conceded that the defect could not be cured. It
therefore concluded that “amendment would be inequitable
and futile and [granted] GameStop’s motion to dismiss with
prejudice.” App. 12. “Because the absence of standing leaves
the court without subject matter jurisdiction to reach a decision
on the merits, dismissals ‘with prejudice’ for lack of standing
are generally improper.” Barclift, 93 F.4th at 148 (quoting
Cottrell v. Alcon Lab’ys, 874 F.3d 154, 164 n.7 (3d Cir. 2017)).
Even when a district court determines that granting leave to
amend would be futile, id. at 140, the “general rule applies”
and a dismissal for lack of Article III standing must be “without
prejudice,” id. at 148. So we will modify the District Court’s
order to dismiss the amended complaint without prejudice and
affirm that order as modified.
V.
For the foregoing reasons, we will affirm the District
Court’s order to dismiss the complaint without prejudice and
affirm the order as modified.

-- 17 of 17 --