The Supreme Court recently declined to review the Ninth Circuit’s decision in Zappos.com, Inc. v. Stevens, a class action suit resulting from a 2012 data breach of the online retailer. As a result, there remains a split in the courts as to whether a breach of data confers Article III standing on potential plaintiffs, even if no actual injury occurred.

The Ninth Circuit, District of Columbia, Third, Sixth, Seventh, and Eleventh Circuits have all found that plaintiffs who allege fear of future identity theft or fraudulent charges in the wake of a data breach have, in fact, satisfied the injury-in-fact requirement for standing under Article III. Conversely, the First, Second, Fourth, and Eighth circuits have adopted a different reasoning: namely, that fear of future harm is too speculative to meet Article III’s standing requirements as previously interpreted by the Supreme Court (e.g., Clapper v. Amnesty International USA, 568 U.S. 398, 409 (2013)) (standing under Article III requires that any alleged “future harm” be “certainly impending” and that “allegations of possible future injury are not sufficient”).