Doe v. Hey Favor, Inc.

Background

Jane Doe II, described as a former user of Hey Favor, sued Meta Platforms, Inc. She alleges that Favor installed Meta’s Pixel and software development kit on its website and mobile application, allowing Meta to obtain health data and other sensitive information, including prescription information, answers to health-related questions, medication side effects, allergies, age, and weight. Her claims against Meta are intrusion upon seclusion, unjust enrichment, and violations of sections 631 and 632 of the California Invasion of Privacy Act. She seeks to represent a nationwide class of people who used the Favor platform and whose communications or data were intercepted by Meta.

The discovery disputes concerned Requests for Production 1, 11, and 27, as well as the meaning of “health or medical data.” Discovery generally covers nonprivileged information relevant to a claim or defense and proportional to the needs of the case.

RFP 11: Access, purposes, use, and controls

RFP 11 sought documents and communications about who could access data collected through Meta’s tracking technology, the purposes for access, how the data might be used, and controls intended to prevent its use. The court found the request overbroad because it was not limited to data from Favor, the Pixel and software development kit that plaintiff alleged Meta used to collect the data, or actual purposes for which the relevant data was used. The court also found that the request was not proportional insofar as it sought documents broadly “relating to” those categories.

The court adopted Meta’s proposal, as construed by the court. Meta must search for and produce documents concerning personnel or teams that had access to user data received from Favor through the Meta Pixel or software development kit; the purposes for which they had access; the purposes for which that data was used; and the controls, systems, processes, or rules Meta had in place to prevent use of that data during the relevant period. The court explained that Meta’s production need not be limited to personnel or teams who accessed data only from Favor, but it would be unreasonable to require a search concerning any data, platform, tracking technology, purpose, or use.

RFP 27: Potential uses

RFP 27 sought documents about actual and potential uses of Favor User Data and other health or medical data. The court rejected plaintiff’s argument that documents about potential uses were relevant to Meta’s twenty-first affirmative defense, which asserted that Meta was the only relevant party to the communications at issue in the California privacy-law claims. The court also was not persuaded on the present record that potential uses were relevant to plaintiff’s unjust-enrichment claim or damages theories. Accordingly, the court ruled that Meta need not produce documents concerning potential uses of Favor User Data or other health or medical data in response to RFP 27.

RFP 1: Regulatory communications

As modified by plaintiff, RFP 1 sought communications with government regulators about Meta’s collection, transmission, disclosure, or use of Favor User Data or other health or medical data. Plaintiff said the documents could show regulatory notice and Meta’s response. Meta proposed limiting production to communications with United States regulators about investigations or inquiries concerning health or medical data received from Favor through the Pixel or software development kit.

The court found plaintiff’s request too broad because it covered any health or medical data and any domestic or foreign regulator. It also found Meta’s proposal too narrow. The court stated that discovery should include communications with regulatory agencies in the United States or elsewhere concerning the same kinds of data and practices at issue in this case, rather than all health or medical data, all tracking technology, and all uses of that technology. The court expected the parties to agree on a more precise description of the data and practices defining Meta’s obligations for RFP 1.

Definition of “health or medical data”

The parties agreed that the phrase covers information relating to an individual’s past, present, or future physical or mental health condition; the provision of health care; or payment for health care. They disagreed about whether the information must include a name or other identifying information, or at least be reasonably capable of identifying an individual.

The court stated that information associated with a unique individual should not be excluded merely because the person’s name or other identifying information does not accompany it when Meta receives it. Information may fall within the agreed definition if Meta can associate it with a unique identifier, such as a cookie or Facebook ID, that can link it to an individual. If no such linkage is possible, the court questioned how the information could be information “of an individual.” The court again expected the parties to agree on appropriate parameters.

Disposition

The order resolved the discovery disputes. It adopted Meta’s construed proposal for RFP 11, ruled that Meta need not produce potential-use documents under RFP 27, and provided guidance for the parties to refine RFP 1 and the definition of health or medical data. The court directed the parties to conduct discovery expeditiously so they could meet the June 6, 2025 substantial-completion deadline.