St. Aubin v. Carbon Health Technologies, Inc.

Background

Carbon Health operates a healthcare website where patients can schedule appointments and manage treatment or diagnoses. The complaint alleged that Carbon Health placed Facebook Pixel and Google Analytics Pixel on the website. According to the complaint, those tools sent information to Facebook and Google, including website addresses describing the type of care sought, appointment reasons, appointment locations, internet-protocol addresses, device identifiers, and Facebook identifiers. The complaint further alleged that Facebook and Google processed the information for targeted advertising. St. Aubin alleged that, after she scheduled COVID-19 vaccination appointments, she received digital advertisements related to COVID-19 vaccination.

St. Aubin asserted claims under the California Information Privacy Act, the California Confidentiality of Medical Information Act, and the California Constitution’s privacy provision. Carbon Health moved to dismiss the complaint under Federal Rule of Civil Procedure 12(b)(6), which tests whether a complaint states a legally plausible claim. Carbon Health also requested judicial notice, meaning that the court accept certain documents as established without ordinary proof, of Facebook’s terms of service and Google’s privacy policy.

Judicial Notice

The court denied Carbon Health’s request for judicial notice. It held that the documents were records of a nongovernmental entity and were subject to reasonable dispute. The court therefore did not consider those documents in deciding whether the complaint adequately stated claims.

California Information Privacy Act

The complaint relied on four clauses of California Penal Code section 631(a). The first clause concerns unauthorized connections with telegraph or telephone wires, lines, cables, or instruments. The court held that this clause does not apply to internet transmissions and granted the motion to dismiss St. Aubin’s claim under that clause.

The second clause concerns intentionally reading or attempting to learn the contents of a communication without consent while the communication is in transit. The court held that the complaint plausibly alleged that descriptive URLs contained the contents of communications because they could reveal symptoms, the reason for an appointment, or the type of care sought. The court also held that the complaint plausibly alleged that Facebook Pixel caused a contemporaneous, secret transmission to Facebook’s servers. It therefore denied the motion as to the second-clause allegations involving Facebook Pixel.

The court reached a different conclusion about Google Pixel. The complaint alleged that Google intercepted information but did not explain how or when that interception occurred. The court held that these allegations were conclusory and granted the motion to dismiss the second-clause claim as it related to Google Pixel.

The third clause depends on a violation of the first or second clause. Because the court dismissed the first-clause claim and dismissed the second-clause claim in part, it held that only the second-clause claim involving Facebook Pixel could proceed under the third clause. The fourth clause imposes liability on a person who aids, agrees with, employs, or conspires with another person to commit conduct prohibited by the first three clauses. The court found that the allegations that Carbon Health installed Facebook Pixel, enabled Facebook’s interception of patient information, and used the information for advertising were sufficient at the pleading stage. The court denied the motion as to the Facebook Pixel allegations under the fourth clause.

The conclusion states that Carbon Health’s motion was granted as to clauses two, three, and four of section 631(a) concerning Google Pixel and denied as to the allegations concerning Facebook Pixel. The court also rejected Carbon Health’s argument that users consented to the tracking. Because the court had declined to take judicial notice of the documents supporting that argument, it rejected the argument at this stage. The court further stated that, even if it considered the documents, it would probably not find consent because consent must specifically notify a reasonable user of the conduct at issue.

California Confidentiality of Medical Information Act

The court denied the motion to dismiss St. Aubin’s claim under the California Confidentiality of Medical Information Act. The court held that the alleged URLs could reveal the reason for a medical appointment, a patient’s condition, or a course of treatment, and therefore plausibly involved “medical information” under the statute. It also held that the allegations that Facebook and Google processed the information, used it for targeted advertising, and that St. Aubin received vaccination-related advertisements were sufficient at this stage to plausibly allege that an unauthorized third party viewed or accessed the information.

California Constitutional Privacy Claim

The court denied the motion to dismiss the California constitutional privacy claim. It held that the complaint plausibly alleged a protected privacy interest in medical information, a reasonable expectation that communications with a healthcare provider would remain confidential, and a sufficiently serious or highly offensive invasion. The court found relevant the allegations that Carbon Health’s privacy policy promised not to use protected health information for advertising without consent and that Carbon Health nevertheless allowed third parties to track and intercept confidential communications and use the information for marketing.

Disposition

The court granted in part and denied in part Carbon Health’s motion to dismiss. Specifically, it granted the motion as to the first clause of California Penal Code section 631(a), granted the motion as to clauses two, three, and four concerning Google Pixel, and denied the motion as to the clauses two, three, and four allegations concerning Facebook Pixel. It denied the motion under the California Confidentiality of Medical Information Act and the California Constitution. The excerpt’s final lines concerning amendment are incomplete, but they state that if no timely amended complaint is filed, the case will proceed only on claims that were not dismissed.