M.D. v. Google LLC

Background

This putative data-privacy class action concerns information allegedly collected from the BlueChew website. BlueChew provided a platform through which users connected with health-care providers to obtain diagnosis and treatment for erectile dysfunction. Plaintiffs M.D., O.F., and J.P. alleged that Google and Meta intercepted information sent through the website using tools including Google Analytics and the Facebook Tracking Pixel.

The alleged information included names, birthdays, email addresses, pseudonymous identifiers, website activity, and information about prescription erectile dysfunction medications. Plaintiffs alleged that the defendants used the information for targeted advertising. The operative complaint asserted claims under California Penal Code sections 631 and 632, California constitutional privacy law, the Pennsylvania Wiretapping Act, and the Maryland Wiretapping and Electronic Surveillance Act. The plaintiffs sought to represent putative California, Pennsylvania, and Maryland classes.

Judicial Notice

The court granted Google’s and Meta’s requests for judicial notice of the existence of various website terms, privacy policies, and related materials. The court also considered those materials under the incorporation-by-reference doctrine, which can allow a court deciding a motion to dismiss to treat certain documents referred to in the complaint as part of the complaint.

Motions to Dismiss

The defendants moved to dismiss under Federal Rule of Civil Procedure 12(b)(6), which tests whether a complaint alleges enough facts to state a legally recognized and plausible claim. The court explained that all of the plaintiffs’ claims depended on showing that the alleged interception occurred without their consent.

The court rejected the defendants’ argument that the earlier BlueChew privacy policies conclusively established consent. Although those policies referred to analytics tools, cookies, tracking technologies, and some information sharing, the court found that they did not explicitly notify users that their private health information would be shared with Google or Meta for online advertising. The court also noted that the earlier policies stated that BlueChew did not share personal information with third parties for their own direct-marketing purposes. The court therefore found that those policies did not establish consent at the motion-to-dismiss stage.

The court reached a different conclusion about BlueChew’s August 2024 Privacy Policy. That policy disclosed use of the Meta Pixel and Google Analytics, stated that health information could be shared with third parties for advertising and data analysis, and omitted the earlier limitation concerning direct marketing. Plaintiffs’ counsel conceded at the hearing that the August 2024 policy established users’ consent to the data-collection practices.

The court nevertheless dismissed all claims because the complaint did not adequately allege that the challenged data-sharing practices were already occurring before the August 2024 policy gave consent. The court stated that, as alleged, the claims had not been made plausible because they lacked factual support showing that the practices predated consent.

Leave to Amend and Disposition

The court granted the defendants’ motions to dismiss the complaint. It did not determine that amendment would necessarily be futile and therefore granted plaintiffs leave to file an amended complaint addressing possible privacy violations occurring before adoption of the August 2024 Privacy Policy.

Plaintiffs could file an amended complaint no later than October 24, 2025. The order also stated that no parties or claims could be added without court permission or a stipulation by the defendants.