R.C. v. Sussex Publishers, LLC

Background

R.C. and D.G. brought a proposed class action against Sussex Publishers, LLC. They alleged that Sussex’s Psychology Today website and related services collected information entered while users searched for mental-health providers, including symptoms, treatment sought, therapist preferences, location, and insurance information. They alleged that Google Analytics copied this information, along with Internet Protocol addresses, and sent it to Google without their knowledge or consent.

The operative second amended complaint asserted claims under the California Medical Information Act (CMIA), the California Consumer Privacy Act (CCPA), California Penal Code section 631, California Penal Code section 632, and the privacy provision of the California Constitution. Sussex moved to dismiss under Federal Rule of Civil Procedure 12(b)(1) for lack of standing and alternatively under Rule 12(b)(6) for failure to state a claim.

Standing and jurisdiction

The court denied the Rule 12(b)(1) motion. Sussex argued that the information shared with Google was not individually identifiable and therefore did not cause a concrete injury. The parties submitted competing expert declarations about whether public Internet Protocol addresses can identify a household, workplace, or individual system.

The court concluded that whether the Internet Protocol addresses, combined with the filtering information, could identify the plaintiffs was intertwined with elements of their claims. Applying the summary-judgment standard to the disputed jurisdictional facts, the court held that it could not determine as a matter of law that disclosure of the plaintiffs’ Internet Protocol addresses, insurance information, therapy information, and mental-health conditions was not a concrete and particularized injury.

CMIA claim

The court denied dismissal of the First Cause of Action under the CMIA. It held that the plaintiffs plausibly alleged that Sussex was a “provider of health care” because its website and application allegedly collected mental-health information and facilitated connections and appointments with therapists.

The court also held that the plaintiffs plausibly alleged the collected information was “medical information.” Their allegations included individually identifying information and information about mental-health conditions, symptoms, treatment sought, therapist connections, insurance, and therapist preferences. The court further held that the allegations plausibly showed Sussex possessed the information and that the information sent to Google was derived from Sussex.

The court found that the plaintiffs plausibly alleged an unauthorized disclosure because Sussex allegedly embedded Google Analytics code that shared users’ communications with Google in real time. The court also held that the allegations supported an inference that Google viewed or accessed the information for its own analytics and marketing purposes, which was sufficient at the pleading stage for the alleged unauthorized-viewing theory.

CCPA claim

The plaintiffs conceded dismissal of the CCPA claim. The court therefore dismissed the Second Cause of Action without leave to amend. The order’s conclusion states that Sussex’s motion to dismiss that claim was granted without leave to amend.

California Penal Code section 631 claim

The court granted dismissal of the Third Cause of Action under California Penal Code section 631 with leave to amend. The plaintiffs alleged that Sussex aided and abetted Google’s unlawful interception of communications.

The court explained that the claim required an adequately pleaded underlying violation. The plaintiffs did not plausibly allege that Google read or learned the contents of the communications while they were in transit. Their allegations instead indicated that Google processed the information after receiving it. Because the plaintiffs did not adequately allege the required predicate violation, the court granted dismissal with leave to amend.

California Penal Code section 632 claim

The court denied dismissal of the Fourth Cause of Action under California Penal Code section 632. It rejected Sussex’s argument that the statute could not apply to Internet communications, reasoning that the statute covers communications made through an “other device” and expressly excludes only radio communications.

The court also held that the plaintiffs plausibly alleged that the communications were confidential. Although Internet communications often carry a presumption against a reasonable expectation of privacy, the plaintiffs alleged that the information concerned mental-health treatment, symptoms, locations, insurers, and therapist preferences. The court concluded that these circumstances could support a reasonable expectation that the communications would not be shared with an undisclosed third party. It further held that the allegations plausibly supported aiding-and-abetting liability.

California Constitution privacy claim

The order’s body states that Sussex’s motion to dismiss the California Constitution claim was denied. The court held that the plaintiffs plausibly alleged a legally protected privacy interest, a reasonable expectation of privacy, and an intrusion serious enough to be highly offensive. The alleged sharing involved information communicated while the plaintiffs sought mental-health treatment and included personally identifying information.

Disposition

The court ruled as follows:

- The Rule 12(b)(1) motion to dismiss for lack of subject-matter jurisdiction was denied. - The motion to dismiss the CMIA claim was denied. - The motion to dismiss the CCPA claim was granted without leave to amend, and the claim was dismissed without leave to amend. - The motion to dismiss the section 631 claim was granted with leave to amend. - The motion to dismiss the section 632 claim was denied. - The motion to dismiss the California Constitution privacy claim was denied.

Any amended complaint was due by April 24, 2025. The order stated that it disposed of Docket Number 42.