TransUnion tightened the injury requirement for statutory claims, holding that a statutory violation alone does not confer standing without concrete harm, which has become a productive defense in privacy, consumer, and data breach litigation. Because standing is jurisdictional federally, it can be raised late and even on appeal. The corresponding risk is that dismissal for lack of standing is without prejudice and may permit refiling in state court.