Doe I v. Google LLC

Background

Twelve anonymous plaintiffs alleged that Google unlawfully tracked, collected, and monetized their private health information through Google source code embedded on health care providers’ websites. The products discussed included Google Analytics, Google Ads, and Google Display Ads. The plaintiffs alleged that the code redirected information about their interactions with providers’ websites to Google and that Google used the information in its advertising systems. They brought twelve claims under federal and California law, including claims under the federal Wiretap Act, the California Invasion of Privacy Act, California privacy law, the California Unfair Competition Law, several tort theories, the California Comprehensive Computer Data Access and Fraud Act, contract theories, and unjust enrichment.

The plaintiffs relied heavily on an investigation of health care provider web properties and on Google’s general product descriptions. They alleged that Google source code appeared on 91 percent of approximately 5,000 investigated health care provider web properties. The court found that these allegations did not show which pages contained the code, what information was actually transmitted, or how often the alleged conduct occurred. The court also found that the complaint relied on hypothetical examples of how Google products could be configured rather than facts showing how the plaintiffs’ providers actually used them. The health care providers were not named as defendants.

Court’s reasoning

The court held that the complaint did not plausibly allege that Google received the plaintiffs’ private health information. Google’s instructions told health care providers not to use its source code on pages that could transmit protected health information, and the incorporated materials indicated that the information transmitted depends on the particular page where the code is placed. The plaintiffs’ repeated use of phrases such as information that “may include” particular details made it unclear which allegations were factual and which were speculation.

The court also held that the plaintiffs did not adequately allege intent. For claims requiring intentional conduct, the court explained that intent means acting purposefully and deliberately, not merely knowing that an event might occur because a provider made a mistake. The complaint acknowledged Google’s warnings against sending personally identifiable or health information through its code. The court therefore found that the allegations did not support an inference that Google intended to obtain or use the information for advertising. The court rejected the plaintiffs’ assertion that Google’s warnings were merely a deceptive cover because the complaint offered no supporting facts.

Individual claims

The court dismissed the Federal Wiretap Act claim because the plaintiffs did not adequately allege intentional interception. It also found that the complaint appeared to allege consent by the health care providers that installed Google’s code, and that the plaintiffs’ allegations of deception to avoid that consent defense were too vague even under the ordinary pleading standard.

The California Invasion of Privacy Act claims failed because the plaintiffs did not adequately allege that Google intentionally read or learned the contents of their communications. The California constitutional and common-law privacy claims failed because the complaint did not provide enough information to evaluate the alleged intrusion or whether it was highly offensive, and did not adequately allege intent.

The Unfair Competition Law claim failed because the plaintiffs did not adequately allege the required economic injury. The court was also unpersuaded that the complaint established that personal information is property under California law for this purpose. The trespass-to-chattels and California computer-data claims failed because the alleged effects on computer storage, performance, and communications were conclusory and unsupported. The conversion claim rested on the inadequately supported premise that the plaintiffs’ health information was property.

The express-contract claim failed because the plaintiffs did not adequately allege that Google breached promises in its Terms of Service or Privacy Policy. The implied-contract claim failed because an implied contract cannot cover the same subject as an express contract. The implied covenant of good faith and fair dealing claim failed because the plaintiffs did not adequately allege that Google’s interpretation of the relevant contract terms was objectively unreasonable. The unjust-enrichment claim failed because the plaintiffs had not stated a claim based on unlawful conduct.

Disposition

The court granted Google’s motion to dismiss and dismissed the complaint in its entirety, with leave to amend. Although the court expressed skepticism that the plaintiffs could successfully amend, it gave them one final opportunity. An amended complaint was due within 21 days. If none was filed by that deadline, the dismissal would be with prejudice. If an amended complaint was filed, Google’s response would be due 21 days later.