Should they be allowed to record your mouse movements while on their site and sell information about how steady or shaky your hands appear to be to health insurance or car insurance companies?
These smash-and-grab lawyers always way, way, way overstate things in the initial complaint. It's par for the course.
I wouldn't be surprised if Papa John's wasn't even doing any of the alleged things (I have not personally verified)... because it doesn't matter for these types of suits. The plaintiff's lawyers will conveniently ask for a settlement payout less than the estimated cost of litigation, and Papa John's will write a check to make it go away. It's how these things work.