Amy Wright, individually and on behalf of others similarly situated v. TrueCare Property Holdings, LLC

Opinion

AMY WRIGHT, individually and on Case No.: 3:25-cv-00786-JES-BLM behalf of others similarly situated, ORDER GRANTING IN PART AND Plaintiff, DENYING IN PART DEFENDANT’S v. MOTION TO DISMISS

TRUECARE PROPERTY HOLDINGS, LLC, [ECF No. 26] Defendant. Before the Court is Defendant TrueCare Property Holdings, Inc.’s, (“Defendant’s”) motion to dismiss Plaintiff Amy Wright’s (“Plaintiff’s”) First Amended Complaint. Mot. (“Mot.”). For the reasons set forth below, the motion is GRANTED with leave to amend as to Counts I, II, III, and V of Plaintiff’s complaint, and DENIED as to Count IV of Plaintiff’s complaint. I. BACKGROUND Defendant operates truecare.org, a website that provides healthcare services and information to people in San Diego and Riverside Counties. ECF No. 24 (“FAC”) ¶ 3. This action arises from TrueCare’s use of the Meta Pixel on its website, a piece of software created by Meta Platforms, Inc., that TrueCare embedded in its website. Id. ¶ 6. Plaintiff alleges that the Meta Pixel intercepts users’ page visit information and associates it with their Facebook identification number to generate data for personalized ads. Id. ¶ 26. Plaintiff alleges that, because of the way TrueCare’s website is structured, the Meta Pixel can associate someone’s searches about their healthcare with their profile and potentially derive sensitive healthcare information from the intercepted data. Id. ¶ 30. Plaintiff alleges that TrueCare and Meta Platforms, Inc., both have access to data gathered by the Meta Pixel. Id. ¶ 26, 29. Plaintiff alleges that TrueCare knew of this data interception and sharing when it installed the Meta Pixel on its website based upon the Meta Pixel’s terms of service. Id. ¶ 50-56. Plaintiff states that TrueCare does not inform users of or ask their consent for this use of their healthcare information. Id. ¶ 32. Plaintiff alleges injuries arising from six visits to Defendant’s website. Id. ¶ 72. Plaintiff downloaded a report of her tracked activity on the website, which show six events titled as “search,” “contact,” or “page_view.” Id. ¶ 73. Plaintiff alleges that the pages she visited constitute personal information that no third party, such as Meta, should access. Id. ¶ 76. A motion to dismiss for failure to state a claim should be granted when the allegations do not “state a claim to relief that is plausible on its face.” Aschroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. at 678 (citing Twombly, 550 U.S. at 556). “The plausibility standard ... asks for more than a sheer possibility that a defendant has acted unlawfully.” Mashiri v. Epsten Grinnell & Howell, 845 F.3d 984, 988 (9th Cir. 2017) (internal quotation marks omitted). When evaluating the sufficiency of a complaint's factual allegations, the court must accept as true all well-pleaded material facts alleged in the complaint and construe them in the light most favorable to the non-moving party. Wilson v. Hewlett-Packard Co., 668 F.3d 1136, 1140 (9th Cir. 2012); see Daniels-Hall v. Nat'l Educ. Ass'n, 629 F.3d 992, 998 (9th Cir. 2010). Allegations in a complaint “may not simply recite the elements of a cause of action, but must contain sufficient allegations of underlying facts to give fair notice and to enable the opposing party to defend itself effectively.” Starr v. Baca, 652 F.3d 1202, 1216 (9th Cir. 2011). While the court must draw all reasonable inferences from the factual allegations in favor of the plaintiff, Newcal Indus. v. Ikon Off. Sol., 513 F.3d 1038, 1043 n.2 (9th Cir. 2008), the court need not credit legal conclusions that are couched as factual allegations, Iqbal, 556 U.S. at 678-79. A. Protected Health Information Several of Plaintiff’s claims are based on a theory that Defendant’s use of the Meta Pixel led to the improper disclosure of her protected health information (“PHI”) under the Confidentiality of Medical Information Act (“CMIA”) and the Health Insurance Portability and Accountability Act (“HIPAA”). FAC ¶¶ 2-5. Defendant argues that the FAC should be dismissed in its entirety because Plaintiff fails to allege PHI. Mot. at 12. For the reasons set forth below, the Court agrees that Plaintiff has not alleged PHI. “HIPAA defines ‘protected health information’ as ‘individually identifiable’ information that is ‘created or received by a health care provider’ (or similar entities) that ‘[r]elates to the past, present, or future physical or mental health or condition of an individual’ or the ‘provision of health care to an individual.” In re Meta Pixel Healthcare Litigation, 647 F.Supp.3d 778, 792 (N.D. Cal. 2022) (quoting 45 C.F.R. § 160.103). Courts in this district have found two main categories of PHI tracked by the Meta Pixel on healthcare websites to be actionable: (1) information associating the user with private patient portals, because the use of such portals shows patient status which is itself PHI (id.); and (2) information associating the user with public webpages which reveals something private about the user’s health, conditions, or care (see, e.g., Doe v. Tenet Healthcare Corp., 789 F.Supp.3d 814, 837 (E.D. Cal. 2025) (finding that a plaintiff’s searches related to pregnancy, childbirth, and her specific doctor constituted PHI); R.C. v. Walgreen Co., 733 F.Supp.3d 876, 886 (C.D. Cal. 2024) (finding that user-associated searches for “sensitive healthcare products [] related to specific conditions” constituted PHI); Castillo v. Costco Wholesale Corp., 2024 WL 4785136 (W.D. Wash 2024) at *4 (finding that user- associated searches for specific prescriptions constituted PHI)). The use of public webpages on a healthcare website alone is not PHI if the data tracked does not plausibly reveal something about the “past, present, or future physical or mental health or condition of an individual” or their care. Nienaber v. Overlake Hospital Medical Center, 733 F.Supp.3d 1072, 1082 (W.D. Wash. 2024). Thus, to allege PHI based on the use of a public webpage, a plaintiff must allege not only that they accessed a public webpage but also that their “interactions plausibly relate to the provision of healthcare, or [that] the information connects a particular user to a particular healthcare provider.” Id. at 1081-82. Conclusory or hypothetical explanations of how the Meta Pixel could track sensitive information on a healthcare website, without factual allegations plausibly showing that Plaintiff’s own actionable PHI was tracked, are insufficient to survive a motion to dismiss where PHI is required. Cousin v. Sharp Healthcare, 681 F.Supp.3d 1117, 1123 (S.D. Cal. 2023). Here, Plaintiff states that she visited Defendant’s website on or about February 14, 2023, September 8, 2023, September 12, 2023, October 18, 2023, November 1, 2023, and January 9, 2024. FAC ¶ 72. She alleges that on October 18, 2023, November 1, 2023, and January 9, 2024, the Meta Pixel tracked her search terms entered on the website. Id. Plaintiff attached a screenshot of her downloaded browsing data tracked by Meta on Defendant’s website, which shows 6 tracked events categorized as searches, contacts, or page views (id. ¶ 73) but do not reveal on their face any information about the searches, contacts, or pages themselves. Plaintiff states that she values her privacy when web browsing, especially regarding her health, and that the pages she visited constituted personal information of a private and confidential nature. Id. ¶ 74. The mere fact that Plaintiff used Defendant’s website does not constitute PHI because it does not necessarily reveal any information related to her healthcare, conditions, or patient status. See Nienaber, 733 F.Supp.3d at 1082. Plaintiff’s statement that the pages she visited constitute personal information and are private and confidential in nature are conclusory and insufficient to survive a motion to dismiss where PHI is required. See Cousin, 681 F.Supp.3d 1117 at 1123. Thus, Plaintiff has failed to adequately allege PHI, and her claims which require PHI are subject to dismissal. B. Counts I and II: ECPA and CIPA Defendant argues that the first and seconds counts of Plaintiff’s FAC should be dismissed because (1) they fail to identify the contents of her intercepted communications and (2) the party-exception rule applies. Mot. at 18-21. The Court agrees. Plaintiff’s first cause of action for violation of the Electronic Communications Privacy Act (“ECPA”) requires that Defendant used a device to intentionally intercept the contents of her electronic communications. 18 U.S.C. § 2511(1). Her second cause of action for violation of the California Invasion of Privacy Act (“CIPA”) requires an allegation that Defendant in some way assisted a third party in reading or learning the contents of a message she transmitted, mirroring the “contents of communication” standard of ECPA. Cal. Penal Code § 631(a). Both statutes require a plaintiff to plausibly allege that the defendant intercepted the contents of communication, not just record or identifying information like webpage addresses and Facebook IDs. In re Zynga Privacy Litigation, 750 F.3d 1098, 1107 (9th Cir. 2014) (holding that allegations that defendants intercepted plaintiff’s Facebook ID information and the webpages of addresses they accessed insufficient to allege “contents of any communication” under ECPA); Heiting v. Taro Pharmaceuticals USA, Inc., 709 F.Supp.3d 1007, 1018 (C.D. Cal. 2023) (relying on the Ninth Circuit’s reasoning in In re Zynga to find that CIPA requires a showing of the contents of protected communication, not just record communication or identifiable information). For both claims, under the party-exception rule, an intended party to a communication is exempt from liability unless the plaintiff shows that they conducted the interception with criminal and/or tortious intent. Walgreen Co., 733 F.Supp.3d at 901; In re Facebook, Inc., Internet Tracking Litig., 956 F.3d 589, 607 (9th Cir. 2020) (“Courts perform the same analysis for both the Wiretap Act and CIPA regarding the party exemption.”). Thus, to show that an intended recipient is subject to ECPA or CIPA liability for intercepting a communication, “a plaintiff must plead sufficient facts to support an inference that the offender intercepted the communication for the purpose of a tortious or criminal act that is independent of the intentional act of recording or interception itself.” B.K. v. Eisenhower Medical Center, 721 F.Supp.3d 1056, 1065 (C.D. Cal. 2024). In mass data-privacy actions, the independent tortious or criminal act requirement may be met by a plaintiff plausibly alleging the violation of a state law, such as a state privacy law. Walgreen Co., 733 F.Supp.3d at 901. Here, Plaintiff alleges that her interactions with Defendant’s website and online communications with Defendant constitute electronic communications under the meaning of the statute. FAC ¶ 96. However, as explained above, Plaintiff’s only non-conclusory allegations regarding her interactions with the website state that she visited the website six times, that three of those visits were tracked by the Meta Pixel, and that on those visits the Meta Pixel tracked six events categorized as searches, contacts, or page views Id. ¶ 72-74. Plaintiff’s allegation that she accessed Defendant’s website is mere record information, and her allegation that her Facebook ID was associated with her visits is mere identifying information. See In re Zynga Privacy Litigation, 750 F.3d at 1107. Neither type of allegation is sufficient to plausibly allege that Defendant impermissibly intercepted the “contents of communication” as required to state a claim under ECPA or CIPA. See id. Thus, Defendant’s motion to dismiss Counts I and II is GRANTED on the basis that Plaintiff failed to plausibly allege facts showing that Defendant intercepted the contents of a communication. Regarding the party-exception rule, Plaintiff states that the communications at issue were intercepted for purposes of violating laws “including, but not limited to,” fourteen different state and federal statutes. FAC ¶ 100. However, as explained below, Plaintiff has not stated a claim for any of the listed statutes other than Cal. Penal Code Section 638.51, Use of a Pen Register or Trap and Trace Device, which contains elements that contradict the elements of a CIPA or ECPA violation. See Cal. Penal Code § 638.51 (prohibiting the use of a “device or process” capable of recording “dialing, routing, addressing, or signaling information […] but not the contents of a communication” from a “wire or electronic communication” without a court order). Based on Plaintiff’s representations regarding her ability to amend the complaint at the hearing on this motion, the Court finds it appropriate to defer ruling on the party-exception rule at this time. C. Count III: Invasion of Privacy Under California’s Constitution Defendant argues that Plaintiff’s third claim for invasion of privacy under the California Constitution (Cal. Const. art. 1 § 1) should be dismissed for lack of allegations of highly offensive conduct. Mot. at 23-24. The Court agrees. To state a claim for invasion of privacy, “Plaintiffs must show that (1) they possess a legally protected privacy interest, (2) they maintain a reasonable expectation of privacy, and (3) the intrusion is so serious … as to constitute an egregious breach of social norms such that the breach is highly offensive.” In re Facebook, 956 F.3d at 601 (internal quotations omitted). To satisfy the third element, plaintiffs must allege specific private information upon which a defendant intruded, such that a court can analyze whether the sharing of that information plausibly constituted an egregious breach of social norms. Jones v. Tonal Systems, Inc., 751 F.Supp.3d 1025, 1043 (S.D. Cal. 2024) (holding “conclusory allegations” lacking “requisite specificity” with “only sparing references to the nature of the communications” insufficient to state a claim for invasion of privacy under the California Constitution); see also In re Yahoo Mail Litig., 7 F.Supp.3d 1016, 1040 (N.D. Cal. 2014) (“To the extent Plaintiffs claim a legally protected privacy interest and reasonable expectation of privacy in email generally based on the mere fact that Yahoo intercepted and distributed their emails, regardless of the specific content in the emails, Plaintiffs’ claim fails as a matter of law.”). Here, Plaintiff alleges that “Sensitive and confidential information that Plaintiff and Class Members intended to keep private has been compromised, undermining the fundamental confidentiality of the relationship.” FAC ¶ 126. However, as explained above, Plaintiff’s factual allegations show only that she used Defendant’s website, but not how she used it or what her visits revealed about her healthcare information. See id. ¶ 72-74. Because Plaintiff has not alleged specific private information, the Court cannot analyze whether the alleged intrusion upon that information is so egregious as to constitute a breach of social norms. See Jones, 751 F.Supp.3d at 1043. Thus, the Court GRANTS Defendant’s motion to dismiss Count III of the FAC on the grounds that Plaintiff has not alleged a serious intrusion upon privacy. D. Count IV: Use of a Pen Register or Trap and Trace Device Defendant argues that Plaintiff’s fourth claim for use of a pen register or trap and trace device should be dismissed on the grounds that Plaintiff has failed to allege sufficient facts to state a claim under the statute. Mot. at 2. The Court disagrees, finding that Plaintiff has plausibly alleged all elements of that cause of action. To state a claim for improper use of a pen register or trap and trace device, a plaintiff must allege that a defendant used a “device or process” capable of recording “dialing, routing, addressing, or signaling information […] but not the contents of a communication” from a “wire or electronic communication” without a court order. Cal. Penal Code § 638.50-51. Data capable of being associated with a user’s identity falls within the statutory definition of addressing information. Shah v. Fandom, Inc., 754 F.Supp.3d 924, 929 (N.D. Cal 2024) (finding that plaintiff stated a claim for violation of Cal. Penal Code § 638.51 by alleging a website used software that tracked her internet protocol (“IP”) address). The Meta Pixel software meets the statutory definition of a pen register or trap and trace device because it is “software that identifies consumers, gathers data, and correlates that data through unique ‘fingerprinting.’” Zarif v. Hwareh.com, Inc., 789 F.Supp.3d 880, 898 (S.D. Cal. 2025) (quoting Greenley v. Kochava, Inc., 684 F.Supp.3d 1024, 1050 (S.D. Cal 2025); see also Moody v. C2 Educational Systems Inc., 742 F.Supp.3d 1072, 1077 (C.D. Cal. 2024) (finding that software that tracked browser and device data and form data met the definition of a pen register or trap and trace device). Thus, a plaintiff may state a claim for violation of § 638.51 by alleging that a defendant used the Meta Pixel on their site and that the Meta Pixel tracked record or identifying information regarding their use of the site. See id. Here, Plaintiff alleges that Defendant installed the Meta Pixel on their website and that it tracked information related to her visit to the site and her Facebook ID. FAC ¶ 72- 74. These allegations are sufficient to state a claim for Use of a Pen Register or Trap and Trace Device because they plausibly show that Defendant used a device to record or capture addressing information without a court order. See Zarif, 789 F.Supp.3d at 898. Defendant does not raise any other grounds for dismissal regarding Count IV of Plaintiffs complaint. See generally Mot. Thus, the motion to dismiss Count IV is DENIED. E. Count V: Violation of California’s Confidentiality of Medical Information Act Defendant argues that Plaintiff’s fifth cause of action under the California Confidentiality of Medical Information Act (“CMIA”) should be dismissed because Plaintiff has not alleged sufficient facts to show private medical information. Mot. at 25. The Court agrees. The CMIA defines actionable medical information as information “regarding a patient’s medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment.” Cal. Civ. Code § 56.05(1). The CMIA’s definition of protected information “does not encompass demographic or numeric information that does not reveal medical history, diagnosis, or care.” Eisenhower Med. Ctr. v. Superior Ct., 226 Cal. App. 4th 430, 435 (2014). Here, as explained above, Plaintiff alleges only that she visited Defendant’s website and that those visits constitute protected medical information. FAC ¶ 72-74. However, Plaintiff does not allege what actionable medical information her visits revealed. See Cal. Civ. Code § 56.05(1). Without allegations of any specific information that could reveal medical history, diagnosis, care, or patient status, the Court cannot find that Plaintiff has plausibly stated a claim under the CMIA. See Eisenhower Med. Ctr., 226 Cal. App. 4th at 435. Thus, the Court GRANTS Defendant’s motion to dismiss Count V of the FAC. // l IV. CONCLUSION For the foregoing reasons, Defendant’s motion to dismiss is GRANTED as to Counts I, HU, UI, and V and DENIED as to Count IV. At the hearing on this motion, Plaintiff's counsel stated that Plaintiff could readily remedy the issues with Counts I, II, I, and V given leave to amend. The Court thus GRANTS leave to amend, finding that it would not be futile. The Court does not reach the remainder of Defendant’s arguments for dismissal or the motion to strike the CMIA class allegations today, finding it appropriate to address those arguments after Plaintiff has alleged an actionable factual basis for her privacy-related claims. Dated: November 21, 2025 7 Se 4. Honorable James E. Sunmons Jr. United States District Judge