Doe v. Regents of the University of California

Background

Jane Doe alleged that the Regents of the University of California used Meta Pixel, a tracking code provided by Meta Platforms, Inc., on the University of California San Francisco website and MyChart patient portal. She alleged that the code transmitted information about users’ page visits, clicks, searches, and other inputs, along with Internet Protocol addresses, to Meta while users communicated with the website.

Doe alleged that she entered information about heart problems and high blood pressure into MyChart and used the same email address for her MyChart and Facebook accounts. She later received Facebook advertising concerning high-blood-pressure medication. She claimed that the Regents disclosed or allowed Meta to intercept her medical information and asserted claims under the California Invasion of Privacy Act, the Confidentiality of Medical Information Act, the California Constitution, California common law, contract theories, and unjust enrichment.

Court’s analysis

The court applied the standard for a motion to dismiss for failure to state a claim. At that stage, the court accepts well-pleaded factual allegations as true and asks whether they plausibly support liability.

For the California Invasion of Privacy Act claim, the court held that the Regents is a public entity and that the statute does not expressly impose liability on public entities. The court therefore granted dismissal of the first claim with prejudice and did not reach the separate argument about whether the Regents had the required intent.

For the Confidentiality of Medical Information Act, the court granted dismissal with prejudice of the fourth claim under section 56.06. It reasoned that section applies to businesses that maintain medical information as intermediaries, while UCSF is a healthcare provider already subject to other provisions. The court denied dismissal of the fifth and sixth claims under sections 56.10 and 56.101. Doe plausibly alleged that she entered medical information into MyChart, that the information was transmitted to Meta, and that Meta used it to tailor advertising. The court said she did not have to rule out every other possible source of the advertisements at the pleading stage.

The court granted dismissal of Doe’s California constitutional privacy claim because it concluded that she could not seek damages for that claim. The court denied dismissal of her common-law privacy claim, finding that medical information is highly sensitive and that she plausibly alleged an intrusion through the Meta Pixel.

The court found that Doe had not sufficiently alleged an express contract because she did not allege that she was required to read or agree to the privacy documents. It granted dismissal of the seventh claim without prejudice and allowed Doe to amend it. The court concluded that Doe plausibly alleged an implied contract based on the parties’ conduct but held that the Regents could not be liable on an implied-in-law or quasi-contract theory because it is a public entity. The court therefore granted dismissal of the eighth claim with prejudice. For the same reason, it granted dismissal of the ninth, unjust-enrichment claim, with prejudice.

Disposition

The court granted in part and denied in part the Regents’ motion to dismiss. The claims dismissed with prejudice were the first, fourth, eighth, and ninth claims. The third claim was dismissed, without a specified prejudice designation in the opinion. The motion was denied as to the second, fifth, and sixth claims. The seventh claim was dismissed without prejudice, and Doe was permitted to amend that contract claim by May 30, 2023.

Judge William Orrick entered the order. The supplied case information lists May 8, 2023 as the filing date, while the opinion’s conclusion states that the order was dated May 6, 2023.