Ramirez v. Trusper

Background

Elia Ramirez brought individual and class-action claims against Trusper, Inc., which the opinion identifies as doing business as Musely. Ramirez alleged that Musely, a telehealth services website, embedded Meta’s Facebook Pixel and TikTok’s TikTok Pixel in its website. According to the First Amended Complaint, those tools caused users’ browsers to send information about their website activity to Meta and TikTok.

Ramirez alleged that she visited Musely’s website around August 2023 to purchase a prescription skin-care treatment. She claimed that she answered questions about her skin condition to obtain a prescription and that, without her knowledge or consent, information she submitted was sent to Meta and TikTok for advertising purposes.

Musely moved to dismiss under Federal Rule of Civil Procedure 12(b)(6), which tests whether a complaint alleges enough facts to state a legally plausible claim. The court decided the motion without oral argument.

Consent and Intent

The court rejected Musely’s argument that its privacy policy established consent as a matter of law. The court explained that a disclosure must explicitly notify users of the practice at issue and have only one plausible interpretation. Even assuming Ramirez had adequate notice of the privacy policy, the court found that Musely had not shown that the policy disclosed that users’ health information would be sent to third parties such as Meta and TikTok.

The privacy policy described the collection of medical and health information and stated that, with consent, Musely would share medical information with a doctor or other medical professional through confidential channels for diagnosis and treatment. It also mentioned pixels that automatically recorded certain technical information about users’ interactions with the website. The court found that the policy did not disclose sending prescription-related or other medical information to Meta or TikTok.

The court also found that Ramirez adequately alleged intentional conduct for her claims under the federal electronic-communications privacy law, the California Invasion of Privacy Act, and the California Constitution. Ramirez alleged that Musely chose to install the pixels, that Meta’s documentation described the tracking, and that government warnings addressed possible privacy violations from similar tracking code on health-care websites. At the pleading stage, those allegations supported a reasonable inference that Musely intentionally invaded privacy rights for its own financial benefit.

California Invasion of Privacy Act, Section 631

The court denied dismissal of Ramirez’s claim under section 631 of the California Invasion of Privacy Act. Ramirez relied on the provision imposing liability on a person who aids, agrees with, employs, or conspires with another person to violate the statute.

The court rejected Musely’s arguments that Ramirez had not alleged a predicate violation by Meta or TikTok, that the party exception applied, and that the data was not intercepted while being transmitted. Ramirez alleged that the pixels secretly and contemporaneously duplicated communications between users and Musely, sent them to Meta and TikTok, and allowed those companies to receive, process, analyze, and use the information for their own advertising purposes. The court found those allegations sufficient at this stage.

The court also declined to apply the party exception, which generally prevents liability for a participant in a communication intercepting communications between the participants. The court found sufficient allegations that Meta and TikTok could and did use the information to support their own advertising services and help advertisers reach target audiences.

As to the transmission requirement, the court found sufficient allegations that the pixels duplicated and transmitted communications concurrently with users’ communications with Musely and that Meta and TikTok immediately viewed and processed the information. The court said disputes about the precise timing and method of processing were better addressed on a more developed factual record.

California Invasion of Privacy Act, Section 632

The court granted dismissal of Ramirez’s section 632 claim without leave to amend. Section 632 addresses intentionally using an electronic recording or amplifying device to eavesdrop on or record a confidential communication without the consent of all parties.

The court reasoned that Ramirez did not allege that Musely itself eavesdropped on her communications. Instead, her theory depended on derivative liability for the conduct of Meta or TikTok. The court held that, unlike section 631, section 632 does not expressly create a cause of action for derivative civil liability. The court was not persuaded that a California criminal-liability provision created such a civil claim under section 632.

California Confidentiality of Medical Information Act

The court denied dismissal of Ramirez’s claim under the California Confidentiality of Medical Information Act. That law generally restricts health-care providers from disclosing a patient’s medical information without authorization. The court found that Ramirez plausibly alleged that the information sent through the pixels included prescription dermatology treatment, medical conditions, medical concerns, treatment sought, and the fact that patients were seeking prescriptions.

The court concluded that these allegations fit the statutory definition of medical information, which includes individually identifiable information concerning a patient’s medical history, condition, or treatment.

Federal Electronic-Communications Privacy Claim

The court granted dismissal of Ramirez’s claim under the federal electronic-communications privacy law, with leave to amend. The court addressed the law’s exception for an interception undertaken for the purpose of committing a criminal or tortious act. That exception requires allegations that the intended use of the interception was to facilitate a further criminal or tortious wrong, not merely that the interception itself allegedly violated the law.

The court found that Ramirez alleged financial gain as Musely’s purpose, but did not plausibly allege another purpose directed at injuring her through an independent criminal or tortious act. The court therefore dismissed this claim but allowed Ramirez to amend it.

California Constitution Privacy Claim

The court denied dismissal of Ramirez’s California Constitution privacy claim. To plead that claim, Ramirez had to allege a legally protected privacy interest, a reasonable expectation of privacy, and an intrusion so serious and offensive that it amounted to an egregious breach of social norms.

The court found that the alleged disclosure of information about the specific skin-care prescription sought or purchased was medically related and potentially more sensitive than the information in some cases involving ordinary commercial data collection. The court could not conclude as a matter of law that no reasonable jury could find the alleged conduct highly offensive or incapable of causing serious harm.

Disposition

The court granted in part and denied in part Musely’s motion to dismiss. It granted dismissal of the federal electronic-communications privacy claim with leave to amend; granted dismissal of the California Invasion of Privacy Act section 632 claim without leave to amend; and denied dismissal of the section 631 claim, the California Confidentiality of Medical Information Act claim, and the California Constitution privacy claim.

The court also denied Musely’s request for judicial notice as moot. It directed Ramirez to file any amended complaint by September 3, 2026, and directed her to correct a reference to “memorialcare.org” that the court identified as a drafting error.