Cybersecurity Policy Report, N.D. Cal.: Court faults consumers for failing to allege Google intended misuse of web source code, (Jul 29, 2024)

By Justin Marcus Smith, J.D.

The court diverged from Judge Orrick’s conclusion about intent in a similar matter involving Meta Platform, Inc.

A putative class action complaint against Google, in connection with source code used in Google advertising systems, suffered from multiple pleading deficiencies, found a federal district court in San Francisco. Most notably, the complaint acknowledged that Google admonished health care providers not to use the disputed Google source code in a way that would cause personal health information to be sent to Google. Second, the complaint was too vague to infer that the health care providers, contrary to Google’s admonition, caused Google to receive the consumers’ personal health information. Third, even if the complaint could be read that way, it did not adequately allege Google intent. The court dismissed the complaint in its entirety (Doe I v. Google LLC, No. 3:23-cv-02431 (N.D. Cal. July 22, 2024)).

Background. Twelve consumers proceeding anonymously brought a putative class action against Google for violation of web users’ privacy rights. They alleged that their health care providers’ deployment of Google source code intercepted and transmitted their personal health information to Google for use in three Google advertising systems: Google Analytics; Google Ads; and Google Display Ads. According to the complaint, the Google source code in question is present on 91 percent of the roughly 5,000 health care provider web properties they investigated. The consumers proposed a class of Google account holders and non-Google account holders.

The court consolidated this action with another, and the consumers filed a new consolidated class action complaint. The consumers then moved for a preliminary injunction, but the court denied that motion because the plaintiffs failed to show Google was using the consumers private health information unlawfully. The consumers then filed, in the court’s words, “yet another version of the complaint[,]” and Google once again moved for dismissal.

Investigation. The court appeared to take issue that the consumers did not provide any details about an investigation they said they conducted into the alleged interception of their data. Specifically, the court said they did not explain how they determined interception was taking place. To the court, they just seemed to be assuming the worst. Documents incorporated by reference appeared to contradict the consumers’ assumption that putative Google tracking would occur throughout a patient interaction with a specified health provider’s portal.

Google admonition. The court found that documents incorporated by reference appeared to show that Google offers guidance about how health care providers using the Google source code can avoid violating Health Insurance Portability and Accountability Act (HIPAA) in connection with handling personal health data. The guidance showed the source code “can exist on one page of a website but not another.” Accordingly, the court said the consumers could not allege that any “web property” contains the source code and thereby implicate every web page of that web property. The court said the consumers’ failure to use precise language about the type of information allegedly transmitted only made that over-inclusion worse. The court said the allegation that 91% of health providers “web properties” contain the Google source code was facially powerful but ultimately mostly meaningless “to the point of seeming intentionally slippery” on closer examination.

Google descriptions. The court found the complaint relied too heavily on generic Google product descriptions that did not show how health care providers were using them. The complaint showed the potential for misuse without specifically alleging that. Accordingly, the consumers were not only assuming placement of Google source code on particular web pages, they were also assuming data collection activity on those web pages.

Google intent. The consumers did not adequately allege that Google intentionally obtained patients’ private health information. The court said the complaint was “all over the map” about Google intent, if any. They set the legal bar too low at mere awareness of likely data transmission. At that level, Google would have intent no matter how much it told health care providers not to use the code in violation of HIPAA. Google must know mistakes happen, but the court said this was “not the right way to think about intent.”

The court acknowledged the possibility this ruling might be contrary to Doe v. Meta Platforms, Inc., 690 F. Supp. 3d 1064, 1076 (N.D. Cal. 2023). In that matter, Meta, like Google, argued the plaintiffs failed to allege intent because health care providers installed the disputed code and warned developers not to send it sensitive information. Judge Orrick rejected Meta’s arguments. He thought the fact issues needed development, but the plaintiffs’ allegations were adequate for pleading purposes. Whatever the exact source of the disagreement, it might turn on a closer comparison of the two complaints, the court said it disagreed with Judge Orrick. The instant court also suggested that insisting that Google’s admonitions to health care providers were “part of a plot to steal private health information” might invoke heightened pleading under Fed. R. Civ. P. 9(b).

Wiretap Act. The court said the consumers failed to allege a violation of the Wiretap Act because, again, they did not adequately plead Google intent. The allegations here also ran into a one-party consent problem to the extent the health care providers consented to installation of the Google source code on their web properties. The consumers’ contention that such consent was malformed again raised the R. 9(b) pleading problem, but the court noted it would fail even under R. 8.

CIPA. The consumers’ California Invasion of Privacy Act (CIPA) claim also had the intent problem. Google analogized it had only given the health care providers something like a tape recorder, so it could not itself be engaging in impermissible conduct. The consumers said Google’s involvement was not passive. They said Google was reading, learning, and using the contents of their communications, but the court reasoned this could only happen where the Google source code was present. And, as already noted, the court found the complaint over-inclusive about where the code was deployed on web properties. That confounded issues of actual interception and intent.

Common law. The court found the consumers’ separate claims for invasion of privacy under the common law and the California Constitution also suffered from the over-inclusiveness and intent problems.

Unfair competition. The court said it “agree[d] with Judge Breyer” that the loss of private information, valuable in the abstract, does not necessarily entail injury in the form of lost money or property. Accordingly, the consumers did not have statutory standing to bring their California Unfair Competition Law claim. The court added that the consumers failed to allege why they would not still be able to sell their own data.

Chattel trespass. The court found the consumers’ trespass to chattels claim also ran afoul of intent. The court said the allegations here were “entirely conclusory” and failed to state a claim. The court added it was not obvious how cookies would “result in any cognizable reduction in storage, disk space, or performance.” The court also disagreed that the Google source code made the consumers’ devices “useless” for private communication with health care providers. The court stated, “the decision not to use one’s computer to communicate with a specific entity is not the same as actually being deprived of the ability to use one’s computer.”

Conversion. Unlike the trespass to chattels claim, the consumers’ conversion claim depended on the premise that their health information was property under California law. The court said this was a tenuous legal conclusion it did not need to accept as true at the pleading stage.

CDAFA. The court rejected the consumers’ California Comprehensive Computer Data Access and Fraud Act (CDAFA) claim for essentially the same reasons it rejected the trespass to chattels claim. Again, the court did not buy the plaintiffs’ allegations of lost storage, disk space, performance and inability to communicate with health care providers. The allegations of time and resources spent investigating Google conduct were also “conclusory.”

Express breach. The court provided detailed explanations to justify why the plaintiffs failed to allege that Google broke any of its Terms of Service (ToS) or Privacy Policy, as express contracts. The court found the ToS mandate that users of Google’s services respect the rights of others did not bind Google. It found the consumers failed to allege that data transmitted to Google, if any, contained private health information, like treatments and doctors. It said Google only promised not to show personalized ads based on health, whereas the plaintiffs failed to allege they received such ads. Last, nothing suggested that Google promised to stop third-party fraud or abuse.

Implied breach. The court dismissed the consumers’ implied breach of contract claim because that claim could not co-exist with the claim for express contract. The consumers’ counsel also appeared on the cusp of withdrawing this claim.

Good faith. The consumers failed to allege that Google’s interpretations of “health information” or “personally identifiable information” were objectively unreasonable. The court dismissed the claim for breach of the implied covenant of good faith and fair dealing accordingly.

Unjust enrichment. The court determined the consumers failed to state unjust enrichment to the same extent they failed to state a claim against Google for unlawful conduct.

Amendment. In conclusion, the court faulted the consumers for drafting an overly long complaint perceived to be a substitute for substance. Despite expressed dissatisfaction, the court permitted one more amendment of the complaint.

The case is No. 3:23-cv-02431.

Judge: Chhabria, V.

Attorneys: Nicole Ramirez Jones (Kiesel Law LLP) and An V. Truong (Simmons Hanly Conroy) for John Doe I and John Doe II. Benedict Y. Hur (Willkie Farr & Gallagher LLP) for Google LLC.

Companies: Google LLC

Cases: CaseDecisions FederalLegislation CyberPrivacyFeed EHRNews GCNNews GeneralNews HIPAANews DataPrivacy CaliforniaNews DataSecurity