H. v. Meta Platforms, Inc.

Background

The plaintiffs alleged that Meta encouraged websites and applications to install Meta’s tracking pixel. They alleged that, without users’ knowledge, the pixel transmitted sensitive healthcare information to Meta. The information allegedly came from Cerebral, an online mental-health provider, when the plaintiffs created accounts and sought services. The plaintiffs alleged that the information included their names, contact information, ZIP codes, the fact that they had created accounts to seek treatment, and answers to mental-health intake questions.

The plaintiffs alleged claims for invasion of privacy, violations of California’s Unfair Competition Law (UCL) and Consumers Legal Remedies Act (CLRA), conversion, violations of the Federal Wiretap Act and California Invasion of Privacy Act (CIPA), and unjust enrichment. Meta challenged the privacy, UCL, CLRA, and conversion claims. Meta did not challenge the Wiretap Act, CIPA, or unjust-enrichment claims in this motion, while preserving its arguments about those claims. Meta also asked the court to take judicial notice of its online Business Tools Terms and Commercial Terms. The court denied that request because the documents’ online availability did not justify considering their contents and meaning at this stage.

Legal standard

The court applied Federal Rule of Civil Procedure 12(b)(6), which requires dismissal when a complaint does not state a legally sufficient claim. At this stage, the court accepts well-pleaded factual allegations as true and asks whether they plausibly support relief. The court does not accept conclusory allegations or unreasonable inferences as true.

Privacy claims

The court denied Meta’s motion to dismiss the privacy claims. Meta argued that the plaintiffs had not identified sufficiently specific or sensitive information. The court disagreed because the plaintiffs identified categories of information required to create Cerebral accounts and described mental-health questionnaire responses. The court explained that information that might ordinarily seem less private, such as a name or ZIP code, could plausibly become sensitive when connected to seeking mental-health treatment.

UCL and CLRA claims

The court denied Meta’s motion to dismiss the UCL and CLRA claims. It held that the plaintiffs did not need to satisfy the heightened fraud-pleading rule for their UCL theories based on unlawful or unfair conduct. For the fraud-based UCL theory, the court found the alleged omission plausible because the plaintiffs claimed that, had Meta disclosed its collection and use of non-users’ healthcare information, they would have learned of it through media coverage and acted differently.

The court also found that the plaintiffs plausibly alleged harm. They claimed that they paid more for Cerebral’s services than they otherwise would have if they had known about Meta’s interception and that their payments helped fund Cerebral’s purchase of targeted advertising from Meta. The court treated this as a benefit-of-the-bargain theory different from a rejected theory based only on the lost value of personally identifiable information.

The court further declined to dismiss the CLRA claim on the ground that the plaintiffs were not consumers of Meta’s product. The plaintiffs alleged that they were consumers who transacted with Cerebral, and the court concluded that whether the CLRA’s transaction requirement extends to Meta’s alleged conduct was better considered on an evidentiary record.

Finally, the court found that the plaintiffs plausibly alleged unfair conduct under the UCL’s tethering test. They connected Meta’s alleged interception to California’s public policy protecting consumer privacy and federal policy protecting health information. The court therefore did not separately address the UCL balancing test.

Conversion claim

The court denied Meta’s motion to dismiss the conversion claim. Conversion is the wrongful taking or handling of property belonging to another. The court explained that California law requires an interest capable of precise definition, exclusive possession or control, and a legitimate claim to exclusivity.

The plaintiffs plausibly alleged those elements for their sensitive healthcare information. Although they retained access to the information and may have shared it with healthcare providers, the court reasoned that they could still plausibly have the exclusive right to decide with whom the information would be shared and how it would be used. The court rejected Meta’s argument that receiving copies could not support conversion as a matter of law, explaining that the context matters, including the nature of the information, the parties’ relationship, how Meta obtained it, and how Meta used it.

The court also found the alleged wrongful conduct sufficient at the pleading stage. The plaintiffs alleged that Meta promoted use of its pixel by healthcare companies and that Meta’s system received the information despite a filtering system. Whether Meta’s intent, filtering measures, and other technical issues supported liability would require further factual development.

The court found the alleged damages sufficient as well. The plaintiffs alleged that the healthcare data had a determinable value and relied on California’s statutory measure of damages for converted personal property. The court stated that arguments about whether the plaintiffs could ultimately prove ownership, exclusive control, or damages could be considered at summary judgment or trial.

Disposition

The court denied Meta’s request for judicial notice. It denied Meta’s motion to dismiss the privacy, UCL, CLRA, and conversion claims, and concluded: “Meta’s motion to dismiss is DENIED in full.” The opinion addresses pleading sufficiency only; it does not determine the plaintiffs’ ultimate entitlement to restitution, damages, or other relief.