Health Law Daily Wrap Up, GENERAL HEALTH CARE NEWS—N.D. Ill.: ECPA, other claims against utilizer of website analytics will proceed, (Mar 18, 2026)

By Sherri M. Schroeder, J.D.

A similar action against MyEyeDr. will also be consolidated into a class action, as both allege the users visited the website, made an appointment, and had their health data transmitted to Google.

An Illinois district court has granted in part and denied in part the claims of a user of the website operated by Capital Vision Services, LLC d/b/a MyEyeDr. The user alleged that MyEyeDr. secretly installed a computer code on its website that transmitted the individually identifiable health information (IIHI) of users to Google for advertising purposes. The website user asserted five claims for violations of the Electronic Communications Privacy Act (ECPA), negligence, breach of implied contract, breach of confidence, and unjust enrichment. The user also asked the court to consolidate her case with that of other website users making similar claims against MyEyeDr. (the Jenkins case). While the court agreed to the consolidation and allowed the user’s claims for the ECPA violations, negligence, and unjust enrichment to proceed, the court granted MyEyeDr.’s motion to dismiss the breach of confidence and breach of implied warranty (McClain v. Capital Vision Services, No. 25 CV 7675 (N.D. Ill. Mar. 13, 2026)).

Claims. Capital Vision Services manages an “affiliated doctor-owned medical practice” under the name MyEyeDr. Through MyEyeDr.’s website, patients can book an eye exam at one of MyEyeDr.’s locations. MyEyeDr. incorporated Google Analytics into its website, allowing the Google Analytics code to identify what webpages a user visits on the site, records what they click on, and collects information about the user such as IP address, browser, language, user ID, etc. The tracker then allegedly transmits this information back to Google where it can be combined with other data for marketing purposes.

The website user in this case and other putative class members visited the MyEyeDr. website and booked eye exams. They allege that MyEyeDr., without their knowledge or consent, intercepted and disclosed sensitive details about confidential eye exams, including IIHI such as patient status and whether they use glasses or contacts, even though MyEyeDr. promised to keep such information secure.

The court first looked at the individual website user’s claims.

ECPA. The court found the website user had adequately alleged a claim under ECPA. She alleged that MyEyeDr. violated the Health Insurance Portability and Accountability Act (HIPAA) because it disclosed her health information to Google, which meant, in the eyes of the court, that the criminal or tortious purpose “exception to the exception” found in Section 2511(2)(d) of the ECPA applied. Although MyEyeDr. argued that such criminal or tortious purpose must be independent of the purpose of intercepting data, the court relied on the “weight of authority in this District and nationwide” to arrive at its conclusion.

The court then noted that multiple courts had rejected MyEyeDr.’s next argument that the exception did not apply because the website user herself alleged that the purpose of MyEyeDr.’s interception was not to commit a crime or tort but, instead, for financial gain. Finding those decisions persuasive, the court concluded that a defendant’s alleged commercial or financial purpose does not render the ECCPA’s crime-tort exception inapplicable.

Next, the court turned to MyEyeDr.’s argument that the crime-tort exception did not apply because of the user’s IP address, the fact that she scheduled an appointment, and the fact that she did not wear glasses did not constitute IIHI protected from disclosure by HIPAA. However, the court agreed with District and national precedent to conclude that appointment information may constitute IIHI under HIPAA.

MyEyeDr. then argued that the website user’s claims under the ECPA failed as a matter of law because she consented to the alleged interception when she created a Gmail account, relying on Smith v. Facebook, Inc. However, per the court, “The Complaint at issue in this case does not set forth the language of the relevant Google policies, let alone contain allegations that reach the same level of specificity in Smith.”

As to MyEyeDr.’s final argument that the website user did not allege that the “contents” of her communications concerning her health condition were intercepted or disclosed, the court noted that MyEyeDr.’s argument focused on the user’s IP address and electronic device information while failing to mention the allegation that MyEyeDr. disclosed that the website user had made an appointment with MyEyeDr. with Google. Per the court, “Courts have found similar allegations regarding appointments sufficient to survive a motion to dismiss.”

Negligence. Here, the court found “that it would be premature to conclude as a matter of law at this stage of the case that MyEyeDr. had no duty to safeguard the website user’s personal information,” as argued by MyEyeDr. Furthermore, the court found that in Illinois a claim of negligence can be based on damages such as data shared with third parties without authorization or consent; receipt of unwanted advertisements that reveal seeking treatment for specific medical conditions; fear, anxiety, and worry about the status of IIHI; diminution of the value of personal data for which there is a tangible value; and/or a loss of control over IIHI.

Unjust enrichment. Because both the ECPA and negligence claims survived, the court found the unjust enrichment claim survived.

Breach/unjust enrichment. In denying the website user’s claim for breach of implied contract, the court found that the user had failed to allege actual monetary damages, which is a requirement under Illinois law. Furthermore, Illinois does not recognize a cause of action for breach of confidence. Therefore, the court dismissed both claims.

Consolidation. The court found overlapping issues of fact and law between the case at hand and the Jenkins case. Although the complaints alleged different interactions with MyEyeDr.’s website and disclosure of differing health information, they involve the same defendant, same website, and overlapping ECPA, negligence, and unjust enrichment claims. Therefore, the court found the requirements of both Local Rule 40.4(b) and Federal Rule of Civil Procedure 42(a) to be satisfied and ordered the cases consolidated.

The case is No. 25 CV 7675.

Judge: Cummings, J.

Attorneys: Alec M. Leslie (Bursor & Fisher, P.A.) for Che'La McClain. Brian G. Cesaratto (Epstein Becker & Green, P.C.) for Capital Vision Services, LLC.

Companies: Capital Vision Services, LLC

Cases: CaseDecisions EHRNews GeneralNews HITNews IllinoisNews