IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
CHE’LA MCCLAIN, ) ) Plaintiff, ) No. 25 CV 7675 ) v. ) Judge Jeffrey I. Cummings ) CAPITAL VISION SERVICES, LLC ) d/b/a MYEYEDR., ) ) Defendant. )
MEMORANDUM OPINION AND ORDER
Plaintiff Che’la McClain brings this suit on behalf of a putative class of similarly situated persons alleging that Capital Vision Services, LLC d/b/a MyEyeDr. (“defendant” or “MyEyeDr.”) surreptitiously installed a computer code on its website that transmitted her individually identifiable health information to Google for advertising purposes. Plaintiff asserts five claims arising from MyEyeDr.’s alleged conduct: (1) violations of the Electronic Communications Privacy Act (the “ECPA”), 18 U.S.C. §2511(1), et seq.; (2) negligence; (3) breach of implied contract; (4) breach of confidence; and (5) unjust enrichment. Before the Court are two motions: (1) defendant’s motion to dismiss for failure to state a claim, (Dckt. #15); and (2) plaintiff’s motion to reassign Jenkins v. Capital Vision Services d/b/a MyEyeDr., Case No. 25-cv-10000 (“Jenkins”) to this Court and consolidate it with the present matter, (Dckt. #24). For the reasons set forth below, the Court grants in part and denies in part the motion to dismiss for failure to state a claim, and grants the motion to consolidate and reassign. I. FACTS ALLEGED IN THE COMPLAINT The Court draws the facts set forth below from plaintiff’s complaint (the “Complaint”). (Dckt. #1). Capital Vision Services manages an “affiliated doctor-owned medical practice” under the name MyEyeDr. (Id. ¶2). Like most medical practices today, MyEyeDr. maintains a website (https://www.myeyedr.com) that assists patients in managing their care. (Id. ¶¶1, 70, 72). Through the website, patients can, among other things, book an eye exam at one of MyEyeDr.’s locations. (Id. ¶¶13, 70, 72). Website operators like MyEyeDr. have the ability to deploy analytic products on their
websites. (Id. ¶¶44, 51–52). These products allow companies to track users’ behavior, including “how customers interact across [their] sites.” (Id. ¶52). MyEyeDr. incorporated the product at issue in this case—Google Analytics—by adding code to each page of its website. (Id. ¶53). The code identifies what webpages a user visits on MyEyeDr.’s website, records what they click on, and collects information about the user (including their IP address, device operating system, operating system version, browser, language, screen resolution, and user ID). (Id.). The tracker then allegedly transmits that information via Google Analytics back to Google, where it can be combined with other data and used for marketing. (Id. ¶¶56, 58). Plaintiff and the putative class members (the “Class”) are individuals who accessed
MyEyeDr.’s website and booked an eye exam. (Id. ¶82). In plaintiff’s case, she accessed MyEyeDr.’s website in May 2025, scheduled an eye exam, and indicated whether she used glasses or contacts. (Id. ¶8). Plaintiff alleges that “by embedding [its] website with Google Analytics,” MyEyeDr., without her or the Class’s knowledge or consent, “intercept[ed] and disclose[d] sensitive details about [her and the Class’s] confidential eye exams . . . to Google,” including personally identifiable information (“PII”), such as their patient status and whether they use . . . glasses or contacts.” (Id. ¶¶73, 114). According to plaintiff, MyEyeDr. promised to keep her and the Class’s PII and protected health information (“PHI”) secure, and through its use of Google Analytics, shared that information in violation of the ECPA. She further alleges that MyEyeDr.’s failure to keep its promises to safeguard her and the Class’s PII and PHI gives rise to causes of action for negligence, breach of implied contract, breach of confidence, and unjust enrichment. II. PROCEDURAL HISTORY Plaintiff filed her class action Complaint in this matter on July 8, 2025. (Id.).
Approximately six weeks later, on August 21, 2025, a separate group of plaintiffs filed Jenkins, bringing the same five claims alleged in this action, as well as additional claims for invasion of privacy and breach of fiduciary duty. (See Jenkins, Dckt. #1). The parties did not mention Jenkins to this Court at the time it was filed, nor did they reference it in their Initial Joint Status Report dated September 12, 2025. (Dckt. #6). On September 30, 2025, MyEyeDr. filed a timely motion to dismiss plaintiff’s Complaint. (Dckt. #15). This Court instructed plaintiff to review defendant’s motion and to file either an amended complaint or a response by October 31, 2025. (Dckt. #18). Plaintiff did neither. Instead, on October 30, 2025, the day before her amended complaint or response was due, plaintiff filed a “Statement of Intent to Move for Consolidation.”
(Dckt. #22). Two weeks later, plaintiff followed with a motion seeking to reassign Jenkins to this Court and consolidate it with the instant matter. (Dckt. #24). Plaintiff did not address the merits of defendant’s motion to dismiss in either of her submissions. III. DISCUSSION Pending before the Court are defendant’s motion to dismiss and plaintiff’s motion to reassign and consolidate. Before reaching the merits of the parties’ motions, the Court must first determine the order in which to address them. Plaintiff argues that the Court should “adjudicate [d]efendant’s motion to dismiss after a consolidated complaint is filed” to avoid “potentially duplicative or unnecessary motion practice.” (Dckt. #22 at 2). The Court disagrees. Courts nationwide have determined that it is proper to begin with the motion to dismiss where a motion to consolidate is also pending. See, e.g., Bossier v. Freese & Goss PLLC, No. 3:17-CV-1454-L- BK, 2017 WL 7087762 (N.D.Tex. Oct. 4, 2017), report and recommendation adopted, No. 3:17- CV-1454-L, 2018 WL 588243, at *2 (N.D.Tex. Jan. 29, 2018) (reaching motion to dismiss before motion to consolidate); Amiga, Inc. v. Hyperion VOF, No. C07-631RSM, 2008 WL
163623, at *4 n.3 (W.D.Wash. Jan. 17, 2008) (“The Court has determined that it shall address this motion to dismiss prior to ruling on the motion to consolidate.”). This is a sensible way in which to proceed because it will never be necessary to reach the motion to consolidate if the motion to dismiss is granted. See, e.g., Young v. U.S. Dep’t of Just., No. 87 CIV. 8307 (JFK), 1988 WL 131302, at *7 (S.D.N.Y. Nov. 28, 1988), aff’d, 882 F.2d 633 (2d Cir. 1989) (granting defendant’s motion to dismiss before concluding that there was no need to address plaintiff’s motion to consolidate). As such, the Court begins with defendant’s motion to dismiss. A. DEFENDANT’S MOTION TO DISMISS Defendant seeks dismissal pursuant to Rule 12(b)(6), arguing that plaintiff has failed to
plausibly allege each of her claims. For the reasons set forth below, the Court finds that plaintiff has properly alleged her ECPA, negligence, and unjust enrichment claims, but further finds that plaintiff’s implied breach of contract and breach of confidence claims should be dismissed. 1. Legal Standard To survive a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), a complaint must “state a claim to relief that is plausible on its face.” Bell. Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). Plausibility requires a plaintiff to “go beyond mere speculation or conjecture.” Wertymer v. Walmart, Inc., 142 F.4th 491, 495 (7th Cir. 2025). The complaint must plead “factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Nonetheless, the “notice-pleading standard is deliberately undemanding.” Orr v. Shicker, 147 F.4th 734, 740 (7th Cir. 2025) (cleaned up). To this point, the Federal Rules require “no more than a statement of the claim” without the pleading of evidence to support it, Berk v. Choy, 607 U.S. ___, 2026 WL 135974, at *5 (2026), and the Rules likewise “do not require a plaintiff to
plead legal theories.” Vidimos, Inc. v. Laser Lab Ltd., 99 F.3d 217, 222 (7th Cir. 1996). Where, as here, a plaintiff fails to file a response to a motion to dismiss, the defendant still carries the burden of persuasion and a court may not dismiss a claim based only on the plaintiff’s failure to respond. See Marcure v. Lynn, 992 F.3d 625, 631 (7th Cir. 2021) (explaining that Rule 12(b)(6) “imposes an affirmative obligation on a movant that we cannot ignore merely because a nonmovant provides no responsive arguments”); Swafford v. Jordan, No. 21-3189, 2022 WL 2829762, at *2 (7th Cir. July 20, 2022) (“[D]istrict courts cannot rely solely on the plaintiff’s lack of response as the reason to grant a motion to dismiss.”). Dismissal of an action under Rule 12(b)(6) is “warranted only if no relief could be granted under any set of
facts that could be proved consistent with the allegations.” Christensen v. Cnty. of Boone, 483 F.3d 454, 458 (7th Cir. 2007). 2. Plaintiff has adequately alleged a claim under the ECPA. The Court turns first to plaintiff’s claim under the ECPA. The ECPA provides a private cause of action against “any person who . . . intentionally intercepts, [or] endeavors to intercept, . . . any wire, oral, or electronic communication.” 18 U.S.C. §2511(1)(a), (5)(a)(ii). The same is true for any person who intentionally discloses or uses, or endeavors to disclose or use, the contents of an intercepted communication. 18 U.S.C. §2511(1)(c), (d). The statute provides an exception, however, when the person intercepting a communication “is a party to the communication or where one of the parties to the communication has given prior consent to such interception.” 18 U.S.C. §2511(2)(d). In other words, because plaintiff alleges that MyEyeDr. was a party to the alleged communications, the ECPA would not apply. But the analysis does not stop there. There is an exception to the “party exception” (i.e., an exception to the exception) where the aggrieved individual has had her communications intentionally intercepted by a party
to those communications for the purpose of committing a crime or tort. 18 U.S.C. §§2520, 2511(2)(d). As another court summarized it, “the ECPA makes it unlawful to intentionally intercept communications. But a party to the conversation is free to intercept its own communications, unless it does so for the purpose of committing an act that is a crime or a tort.” Stein v. Edward-Elmhurst Health, No. 23-CV-14515, 2025 WL 580556, at *4 (N.D.Ill. Feb. 21, 2025). Plaintiff’s Complaint suggests the applicability of the criminal or tortious purpose “exception to the exception” found in Section 2511(2)(d). In particular, she alleges that MyEyeDr. violated the Health Insurance Portability and Accountability Act (“HIPAA”) because
it disclosed her health information to Google. HIPAA provides criminal and civil penalties against a healthcare provider who “knowingly . . . discloses individually identifiable health information to another person.” 42 U.S.C. §1320d(6). Defendant advances five arguments against the application of the crime-tort exception: (1) the crime or tort in question was not independent of the communication intercepted; (2) plaintiff’s allegations that the purpose of the interception was for commercial gain negate the applicability of the exception; (3) the contents of the intercepted communications did not constitute individually identifiable health information (“IIHI”) under HIPAA; (4) plaintiff consented to the interception and disclosure by establishing a Gmail account; and (5) plaintiff fails to allege that “contents” of communications concerning her particular health conditions were intercepted or disclosed. None of these arguments are availing. a. Criminal or tortious purpose “independent” of intercepting data.
MyEyeDr. first argues that the crime-tort exception does not apply because plaintiff has not alleged that MyEyeDr. acted with a criminal or tortious purpose independent of the purpose of intercepting her data. In support of its argument, MyEyeDr. relies on the decision in Doe 1 v. Chestnut Health Sys., Inc., where the court found plaintiffs’ allegations that defendant’s criminal or tortious conduct occurred “simultaneously” and “contemporaneously” with the interception “made clear” that its complaint was “about the interception itself, and not an independent act.” No. 1:24-CV-01475-JEH-RLH, 2025 WL 1616635, at *12 (C.D.Ill. June 6, 2025). Chestnut, however, is an outlier, and the weight of authority in this District and nationwide holds that “[a] disclosure that violates HIPAA is a violation of law that is independent of a violation of the ECPA.” Stein, 2025 WL 580556, at *2; see also Allen v. Midwest Express Care, Inc., No. 24-CV-05348, 2025 WL 2240253, at *3 (N.D.Ill. Aug. 6, 2025) (“Plaintiff properly alleges that Defendant intentionally violated HIPAA when it allowed Plaintiff’s IIHI to be intercepted, disclosed, viewed, analyzed, and used by third parties, which is distinct from the improper interception in the ECPA claim.”); Doe v. Deaconess Illinois Union Cnty. Hosp., Inc., No. 3:24-CV-02284-NJR, 2025 WL 2771415, at *11 (S.D.Ill. Sept. 29, 2025) (finding defendant’s alleged disclosure of plaintiff’s PII and PHI constituted a secondary act that
supported the application of the crime-tort exception); B.N. v. Oregon Reprod. Med., LLC, No. 3:25-CV-00202-IM, 2025 WL 3165965, at *3 (D.Or. Nov. 12, 2025) (“This Court agrees with the reasoning in those cases that a HIPAA violation can be an independent act sufficient to invoke the crime-tort exception.”). In sum: because plaintiff alleges that MyEyeDr.’s disclosure of her health information violated HIPAA, she has alleged a criminal or tortious purpose independent of the interception of her information. b. Interception for the purpose of financial gain. MyEyeDr. next argues that the exception does not apply because plaintiff herself alleges
that the purpose of MyEyeDr.’s interception was not to commit a crime or tort but, instead, for financial gain. (Dckt. #16 at 17–18; see also Dckt. #1 ¶112 (alleging “Defendant specifically used Google Analytics to track and utilize Plaintiff’s and Class members’ PII and PHI for financial gain.”)). Although defendant has cited a handful of decisions that support its position,1 other courts have held to the contrary. In particular, multiple courts have rejected the argument that the ECPA requires plaintiffs to show that defendants had “a criminal or tortious purpose” when they intercepted plaintiffs’ PII and PHI. See, e.g., Stein v. Edward-Elmhurst Health, No. 23-cv-14515, 2026 WL 594752, at *1–5 (N.D.Ill. Mar. 3, 2026) (citing cases). Courts have further held that the crime-tort
exception is not rendered inapplicable because a defendant acts with the primary purpose of
1 See Dckt. #16 at 17–18 (citing Rodriguez v. FastMed Urgent Care, PC., 741 F.Supp.3d 352, 364 (E.D.N.C. 2024) (finding that plaintiff’s claim failed to fit within the crime-tort exception where defendant “intercepted and disclosed the class members’ information for commercial use or gain, not to commit a crime or tort.”); In re DoubleClick Inc. Priv. Litig., 154 F.Supp.2d 497, 518 (S.D.N.Y. 2001); In re Meta Pixel Healthcare Litig., 647 F.Supp 3d 778, 797 (N.D.Cal. 2022) (finding that plaintiff had not met their burden to show that the law and facts “clearly favor[ed” their position on the ECPA exceptions, but expressly noting that “claim w[ould] present differently in a motion to dismiss context”)). Defendant also cites Desnick v. American Broadcasting Cos., Inc., 44 F.3d 1345 (7th Cir. 1995), where the Seventh Circuit concluded “that the Crime-Tort Exception did not apply where the defendant sent undercover testers into a doctor’s office, later broadcasting the footage on television, because it did not do so for the purpose of defaming the plaintiffs, but to see whether the doctors would recommend unneeded cataract surgery.” Allen, 2025 WL 2240253, at *3. As the Allen court explained, Desnick is distinguishable from cases where (as here) the plaintiff alleges that defendant disclosed her IIHI and “HIPAA imposes criminal liability for such disclosure.” Id. at *3. making money. See, e.g., Stein, 2025 WL 580556, at *4–5; Allen, 2025 WL 2240253, at *3; Lugo v. Inova Health Care Servs., No. 1:24-CV-700 (PTG/WEF), 2025 WL 905191, at *8 (E.D.Va. Mar. 25, 2025) (“[H]aving a commercial purpose in addition to the purpose of violating HIPAA . . . does not immunize INOVA from Plaintiff’s ECPA claims.”); Kurowski v. Rush Sys. for Health, No. 22 C 5380, 2023 WL 8544084, at *3 (N.D.Ill. Dec. 11, 2023) (“Kurowski alleges
that Rush knowingly transmits this data and that it does so for the purpose of financial gain. . . . All of these allegations, taken together, are sufficient to invoke the HIPAA exception-to-the- party-exception quoted earlier.”); Smith v. Loyola Univ. Med. Ctr., No. 23 CV 15828, 2024 WL 3338941, at *7 (N.D.Ill. July 9, 2024) (same); In re Group Health Plan Litigation, 709 F.Supp.3d 707, 720 (D.Minn. 2023) (“[T]his district has not found that the crime-tort exception to the [ECPA] is inapplicable where the defendant’s primary motivation was to make money.”).2 This Court finds persuasive the above decisions finding that a defendant’s alleged commercial or financial purpose does not render the ECPA’s crime-tort exception inapplicable. Again, the crime-tort exception to the one-party consent rule applies if a defendant intercepts the
communication “for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.” See 18 U.S.C. §2511(2)(d). As the court in Stein explained, “the statutory text . . . gives no hint that conduct falls outside the reach of the statute if a person acted based on financial motivations. . . . The ‘act’ must be criminal or tortious, but the ‘purpose’ does not need to be criminal or tortious.” Stein, 2025 WL 580556, at *5–6. Here, the Complaint alleges that MyEyeDr. acted when it disclosed plaintiff’s health
2 Defendant incorrectly argues that the In re Group Health Plan Litigation court stated that “this district has not found that the crime-tort exception to the Wiretap Act is applicable where the defendant’s primary motivation was to make money.” (Dckt. #16 at 18) (emphasis added). information to a third party in violation of 42 U.S.C. §1320d-6(a)(3). That is sufficient at this stage to defeat the ECPA’s one-party consent rule. c. The contents constituted IIHI. Defendant devotes a significant portion of its brief to its argument that the crime-tort exception does not apply because plaintiff’s IP address, the fact that she scheduled an
appointment, and the fact that she does not wear glasses do not constitute IIHI protected from disclosure by HIPAA. (Dckt. #16 at 19–25). HIPAA defines IIHI as: [A]ny information, including demographic information collected from an individual, that—(A) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and—(i) identifies the individual; or (ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.
42 U.S.C. §1320d(6). Courts in this District and around the nation have concluded that appointment information may constitute IIHI under HIPAA. See, e.g., A.D. v. Aspen Dental Mgmt., Inc., No. 24 C 1404, 2024 WL 4119153 at *3 (N.D.Ill. Sept. 9, 2024) (finding information about medical appointments “qualifies as IIHI for purposes of HIPAA.”); Kane v. Univ. of Rochester, No. 23- CV-6027-FPG, 2024 WL 1178340, at *6 (W.D.N.Y. Mar. 19, 2024) (“The Court finds it plausible that, at the very least, the information transmitted when a user attempts to schedule an appointment with a physician is information that is received by a health care provider, Defendant, that relates to . . . the provision of health care to an individual, that is, the appointment the user is attempting to make, and with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.”) (cleaned up); Vriezen v. Infinite Health Collaborative, P.A., No. 24-CV-3743 (NEB/DJF), 2025 WL 2992204, at *5–6 (D.Minn. Sept. 30, 2025) (finding information transmitted when a user requests an appointment constituted IIHI); Gay v. Garnet Health, No. 23-CV-06950 (NSR), 2024 WL 4203263, at *2 (S.D.N.Y. Sept. 16, 2024) (finding allegation that plaintiff used website “to schedule appointments,” among others, sufficient to avoid dismissal of ECPA claim).3
Based on the foregoing cases, the Court finds that plaintiff has sufficiently alleged that MyEyeDr. disclosed her IIHI, at minimum, by disclosing the fact that she made an appointment. d. Plaintiff did not consent to the alleged interception. MyEyeDr. next argues that plaintiff’s claims under the ECPA fail as a matter of law because she consented to the alleged interception when she created a Gmail account. (Dckt. #16 at 26). In support, defendant relies on Smith v. Facebook, Inc., where the court determined that plaintiffs’ consent to Facebook’s data and cookies polices, which were laid out in the complaint, barred their claim under the ECPA. 262 F.Supp.3d 943, 955 (N.D.Cal. 2017). The Complaint at issue in this case does not set forth the language of the relevant Google policies, let alone contain
3 Defendant’s reliance on two decisions that held that plaintiff’s appointment information was not sufficient to qualify as “medical information” under the California Confidentiality Medical Information Act, (Dckt. #16 at 24 (citing cases)), is misplaced. This is so because “the definition of ‘individually identifiable health information’ under federal law differs markedly from” the definition of “medical information” in the CMIA. Eisenhower Med. Ctr. v. Sup. Ct., 172 Cal.Rptr.3d 165, 170 (Cal.Ct.App. 2014). In particular, “under the CMIA a prohibited release by a health care provider must include more than individually identifiable information but must also include information relating to medical history, mental or physical condition, or treatment of the individual.” Id. Defendant’s reliance on Kurowski, where the court initially found that plaintiff’s allegations that she used the defendant’s website to exchange communications about appointments, were “too vague to allow an inference . . . [that defendant] was actually disclosing IIHI,” is likewise misplaced. Kurowski, 2023 WL 4707184 at *3. The Kurowski court allowed a later version of the complaint to proceed where plaintiff alleged that the hospital “actively chose to employ the tracking technology on certain pages of its website that were likely to contain IIHI, such as within the MyChart patient portal or on pages prompting patients to schedule appointments.” Kurowski v. Rush Sys. for Health, No. 22 C 5380, 2024 WL 3455020, at *4 (N.D.Ill. July 18, 2024). allegations about consent that reach the same level of specificity in Smith. The Court therefore cannot decide the consent issue in defendant’s favor at the motion to dismiss stage. e. Plaintiff plausibly alleges that the “contents” of her communications were disclosed.
Finally, defendant argues that plaintiff has not alleged that the “contents” of her communications concerning her health condition were intercepted or disclosed. Again, to state a claim under the relevant provisions of ECPA, plaintiff must allege that defendant intentionally intercepted the contents of an electronic communication. 18 U.S.C. §2511(1). The ECPA defines “contents as “any information concerning the substance, purport, or meaning” of a communication. 18 U.S.C. §2510(8). Defendant focuses on plaintiff’s IP address and electronic device information, arguing that such information does not constitute “contents” under the ECPA. But, defendant says nothing about plaintiff’s allegation that MyEyeDr. disclosed that she made an appointment with MyEyeDr. with Google. Courts have found similar allegations regarding appointments sufficient to survive a motion to dismiss See, e.g., A.D. v. Aspen Dental Mgmt., Inc., 2024 WL 4119153, at *3, Kane, 2024 WL 1178340, at *6. This Court agreesNo. 3. Plaintiff has adequately alleged a legally cognizable duty owed to her by MyEyeDr.
Defendant next argues that plaintiff has failed to plausibly allege her claim for negligence. The elements of a negligence claim in Illinois are: (1) a duty owed to the plaintiff; (2) a breach of that duty; (3) proximate and actual causation; and (4) an injury. Scott v. Wendy’s Props., 131 F.4th 815, 819 (7th Cir. 2025). Defendant focuses on the first element. Whether a duty exists is a question of law that may be resolved on a motion to dismiss. Wittmeyer v. Heartland All. for Hum. Needs & Rts., No. 23 CV 1108, 2024 WL 182211, at *2 (N.D.Ill. Jan. 17, 2024). Here, plaintiff alleges that defendant “had a duty to exercise reasonable care in safeguarding, securing, and protecting [her] information from being compromised, misused, and disclosed to unauthorized parties” and “a duty of care not to subject [her and others similarly situated] to an unreasonable risk of unauthorized disclosure.” (Dckt. #1 ¶¶119, 121). Defendant contends that plaintiff’s negligence claim cannot proceed because Illinois does not recognize a
common law duty to safeguard personal information. However, multiple recent decisions from this District and one decision from the Illinois Appellate Court have rejected defendant’s position. See, e.g., Allison Theys v. Dental Intelligence, Inc., No. 25 CV 2464, 2026 WL 636743, at *8 (N.D.Ill. Mar. 6, 2026) (“The court therefore cannot conclude at this stage that, as a matter of law, Defendants had no duty to safeguard Plaintiffs’ personal information.”); In re Kemper Sports Mgmt. Data Breach Litig., 24- cv-8503, 2026 WL 25820, at *6 (N.D.Ill. Jan. 5, 2026) (finding that plaintiffs’ amended complaint “states a plausible claim that Kemper owed plaintiffs a duty to protect their personal information”); Nazzaro v. Tecta Am. Corp., No. 25 C 448, 2025 WL 2604790, at *3 (N.D.Ill.
Sept. 9, 2025) (allowing negligence claim based on a common law duty to safeguard information to survive a motion to dismiss); Olson v. Ferrara Candy Co., __ N.E.3d __, 2025 IL App (1st) 241126, ¶53, appeal denied (Ill. June 25, 2025) (holding that the economic loss doctrine did not bar the plaintiffs’ negligence claim because it was based on the employer defendant’s “common law duty to safeguard personal information rather than any express contractual duty”). The Court finds this authority to be persuasive and, further, that it would be premature to conclude as a matter of law at this stage of the case that MyEyeDr. had no duty to safeguard plaintiff’s personal information. The Court therefore finds that plaintiff has adequately alleged that defendant owed her a duty such that her claim for negligence should not be dismissed for this reason. The Court further finds that plaintiff has adequately alleged that she has suffered damages. Specifically, plaintiff alleges that MyEyeDr.’s actions caused her and the class to “have their data shared with third parties without their authorization or consent, receive
unwanted advertisements that reveal seeking treatment for specific medical conditions, fear, anxiety and worry about the status of their PII and PHI, diminution in the value of their personal data for which there is a tangible value, and/or a loss of control over their PII and PHI.” (Dckt. #1 ¶132). A claim of negligence can be based on such damages in Illinois. See, e.g., Deaconess, 2025 WL 2771415, at *4 (finding that allegations that plaintiff and the class suffered “the unauthorized access of [their] Private Information by third parties, the improper disclosure of their Private Information, lost benefit of their bargain, and lost value of their Private Information,” as well as emotional damages, were sufficient to permit plaintiff’s negligence
claim to move forward); Smith, 2024 WL 3338941, at *7 (“Allegations of emotional harm, such as these, are sufficient to state a negligence claim under Illinois law, including in the data privacy context.”); In re Arthur J. Gallagher Data Breach Litig., 631 F.Supp.3d 573, 587 (N.D.Ill. 2022) (“There can be no dispute that Plaintiffs have alleged present injuries or damages; for instance, all allege experiencing emotional harms such as anxiety and increased concerns for the loss of privacy. . . . These types of non-economic damages are recoverable under Illinois law” in a negligence action). 4. Plaintiff fails to plausibly allege any damages to support her claim for breach of an implied contract.
Plaintiff alleges that she and the proposed class members entered into implied contracts with defendant, whereby defendant “agreed to safeguard and not disclose their PII and PHI without consent.” (Dckt. #1 ¶153). In Illinois, the elements of a breach of implied contract claim track those of a breach of express contract claim; a plaintiff must allege: (1) the existence of a valid and enforceable contract; (2) performance by the plaintiff; (3) breach of contract by the defendant; and (4) resultant injury to the plaintiff. Archey v. Osmose Utils. Servs., Inc., No. 20- CV-05247, 2022 WL 3543469, at *2 (N.D.Ill. Aug. 18, 2022) (citing Hess v. Bresney, 784 F.3d 1154, 1158–59 (7th Cir. 2015)). Unlike an express contract, however, the terms of an implied contract are inferred from the conduct of the parties. Gociman v. Loyola Univ. of Chi., 41 F.4th 873, 883 (7th Cir. 2022). Defendant argues that plaintiff fails to allege the first, third, and fourth elements of her claim—that is, the existence of an implied contract, breach of that implied contract, and injury to plaintiff. This Court need only address the last element to find that plaintiff’s claim must be dismissed. To state a breach of contract claim under Illinois law, a plaintiff must allege actual monetary damages, that is “an actual loss or measurable damages resulting from the breach.” Avery v. State Farm Mut. Auto. Ins. Co., 835 N.E.2d 801, 832 (Ill. 2005). Critically, “lost benefit-of-the-bargain allegations . . . are . . . insufficient” and “Illinois has declined to hold that the alleged diminution in value of plaintiffs’ personal information amounts to actual
monetary damages.” Wittmeyer, 2024 WL 182211, at *6, quoting Flores v. Aon Corp., 242 N.E.3d 340, 356 (Ill.App.Ct. 2023); Juenger v. Deaconess Health Sys., Inc., No. 3:24-CV-2332- NJR, 2025 WL 2780221, at *4–5 (S.D.Ill. Sept. 30, 2025) (same); Hannant v. Culbertson, No. 4:24-CV-04164-SLD-RLH, 2025 WL 2413894, at *15–16 (C.D.Ill. Aug. 20, 2025) (same). Yet, that is all plaintiff alleges here: namely, that she and the proposed class sustained “the loss of the benefit of their bargain and diminution in value of their PII and PHI.” (Dckt. #1 ¶154). In the absence of allegations that she sustained actual pecuniary damages, plaintiff has failed to plausibly state a breach of implied contract claim under Illinois law. See Juenger, 2025 WL 2780221, at *5; Hannant, 2025 WL 2413894, at *15–16; Wittmeyer, 2024 WL 182211, at *6.
Accordingly, plaintiff’s implied breach of contract claim is dismissed. 5. Illinois does not recognize a cause of action for breach of confidence. Plaintiff asserts a claim for breach of confidence based on her theory that medical providers, like defendant, owe a duty to their patients to keep their non-public medical information confidential. Courts have recognized, however, that Illinois does not recognize a claim for breach of confidence. See, e.g., Hannant, 2025 WL 2413894, at *17; Kurowski, 683 F.Supp.3d at 845. Accordingly, plaintiff’s breach of confidence claim is dismissed. Id. 6. Plaintiff has adequately alleged an unjust enrichment claim. Finally, defendant seeks dismissal of plaintiff’s unjust enrichment claim. As the Seventh
Circuit has explained: Unjust enrichment is a common-law theory of recovery or restitution that arises when the defendant is retaining a benefit to the plaintiff’s detriment, and this retention is unjust. What makes the retention of the benefit unjust is often due to some improper conduct by the defendant. And usually this improper conduct will form the basis of another claim against the defendant in tort, contract, or statute. So, if an unjust enrichment claim rests on the same improper conduct alleged in another claim, then the unjust enrichment claim will be tied to this related claim – and, of course, unjust enrichment will stand or fall with the related claim.
Cleary v. Philip Morris Inc., 656 F.3d 511, 517 (7th Cir. 2011). Although defendant argues that plaintiff’s unjust enrichment claim must be dismissed because her other claims have fallen, (Dckt. #16 at 29–30), plaintiff’s ECPA and negligence claims have survived, so her unjust enrichment claim lives on as well. See, e.g., In re Kemper, 2026 WL 25820, at *8 (“The foregoing analysis of plaintiffs’ breach of contract and negligence claims also explains why the amended complaint states a claim for unjust enrichment premised on the same underlying conduct.”). Accordingly, for the reasons set forth above, the Court grants defendant’s motion to dismiss in part with respect to plaintiff’s breach of implied contract and breach of confidence
claims, and denies defendant’s motion to dismiss in part with respect to plaintiff’s ECPA, negligence, and unjust enrichment claims. B. MOTION TO REASSIGN AND CONSOLIDATE
The Court next turns to plaintiff’s motion to reassign Jenkins to this Court pursuant to Local Rule 40.4, and to consolidate it with the present matter. (Dckt. #24). For the reasons set forth below, the Court grants plaintiff’s motion. 1. Legal Standard
In order to reassign a case under Local Rule 40.4, plaintiff must satisfy the requirements of both Local Rule 40.4(a) and Local Rule 40.4(b). Lawrence E. Jaffe Pension Plan v. Household Int’l, Inc., No. 02 C 5893, 2003 WL 21011757, at *1 (N.D.Ill. May 5, 2003). First, under Local Rule 40.4(a), “[t]wo or more cases may be related if one or more of the following conditions are met: (1) the cases involve the same property; (2) the cases involve some of the same issues of fact or law; (3) the cases grow out of the same transaction or occurrence; or (4) in class action suits, one or more of the classes involved in the cases is or are of the same.” If the cases are determined to be related under Local Rule 40.4(a), the Court then turns to Local Rule 40.4(b) which sets forth “more stringent criteria” for the case to qualify for reassignment. Williams v. Walsh Const., No. 05 C 6807, 2007 WL 178309, at *2 (N.D.Ill. Jan. 16, 2007). To be reassigned, Local Rule 40.4(b) requires that: “(1) both cases are pending in the same court; (2) the handling of both cases by the same judge is likely to result in a substantial saving of judicial time and effort; (3) the earlier case has not progressed to the point where designating a later-filed case as related would be likely to delay the proceedings in the earlier case substantially; and (4) the cases are susceptible of disposition in a single proceeding.” 2. McClain and Jenkins are related within the meaning of Local Rule 40.4(a).
Plaintiff argues that McClain and Jenkins are related within the meaning of Local Rule 40.4(a) because they “involve the same issues of fact or law.” The Court agrees. Critically, Rule 40.4(a) “does not require complete identity of issues in order for cases to be considered related,” Fairbanks Cap. Corp. v. Jenkins, 02-C-3930, 2002 WL 31655277, at *2 (N.D.Ill. Nov. 25, 2002); rather, commonality of just “some of the same issues of fact or law” is “sufficient to establish relatedness.” Glob. Pat. Holdings, LLC v. Green Bay Packers, Inc., No. 00 C 4623, 2008 WL 1848142, at *3 (N.D.Ill. Apr. 23, 2008). Here, although the complaints allege different interactions with defendant’s website and disclosure of differing health information, (compare McClain Compl., Dckt. #1 ¶8 (alleging plaintiff was prompted to share only whether she wore glasses or contacts) with Jenkins Compl., Jenkins Dckt. #1 ¶72 (alleging plaintiffs were prompted to share the medical issue that prompted the appointment, such as dry eyes)), they involve the same defendant, the same website, and overlapping ECPA, negligence, and unjust enrichment claims. Because there are overlapping issues of fact and law between the cases, they are related within the meaning of Local Rule 40.4(a).
3. The requirements of Local Rule 40.4(b) are satisfied.
Because the cases have been found to be related, the Court turns to the four additional requirements imposed by Local Rule 40.4(b) that must be satisfied before a case can be reassigned: “(1) both cases are pending in the same court; (2) the handling of both cases by the same judge is likely to result in a substantial saving of judicial time and effort; (3) the earlier case has not progressed to the point where designating a later-filed case as related would be likely to delay the proceedings in the earlier case substantially; and (4) the cases are susceptible of disposition in a single proceeding.” Both McClain and Jenkins are pending in the Northern District of Illinois, so the first requirement is easily met. Moreover, McClain has not progressed
to the point where designating Jenkins as related would delay it substantially. Jenkins was filed just six weeks after the present action, and an answer has not been filed in either matter. See Mach. Movers, Riggers, and Mach. Erectors, Local 136 Defined Contribution Ret. Fund v. Joseph/Anthony, Inc., No. 03 C 8707, 2004 WL 1631646, at *2 (N.D.Ill. July 16, 2004) (finding no substantial delay where both cases were “in the relatively early stages of litigation”). The third factor is, thus, also satisfied. The two issues that must be resolved by the Court then are: (1) whether reassignment will result in substantial savings of judicial time and effort; and (2) whether the actions are susceptible to disposition in a single proceeding. Plaintiff argues that reassigning Jenkins would save judicial time and effort because
“both actions involve the same defendant, the same website, nearly identical causes of action, and the same requested relief.” (Dckt. #24 at 6). Plaintiff further argues that “absent reassignment of [Jenkins] to this Court, another judge will be required to invest similar time and effort.” (Id.) As for the fourth factor, plaintiff argues that the two cases are susceptible to disposition in a single proceeding because they “involve nearly identical legal claims and overlapping classes and seek the same damages and injunctive relief for the alleged interception and disclosure of the plaintiffs’ sensitive health information.” (Id. at 7.) Defendant admits that the cases are “substantially duplicative,” and involve “substantially similar parties, claims, and requests for relief,” (Dckt. #26-1 at 3), but resists reassignment on the basis that its motion to dismiss was also pending at the time that plaintiff sought reassignment, (Dckt. #26 at 6–10). In light of the fact that the Court has now adjudicated defendant’s motion to dismiss, this argument is moot. Moreover, the Court otherwise finds that the second and fourth requirements of Local Rule 40.4(b) are met. The plaintiffs in both actions allege that MyEyeDr. customers booked online
appointments with an optometrist for an eye exam. They both also allege that the website employed a code that tracked user activity, and that MyEyeDr. shared this information with third parties, including Google, without user permission. The Court thus agrees with plaintiff that the reassignment of Jenkins will save judicial time and effort given the significant overlap in facts and claims and the fact that the cases involve the same defendant, involve the same website, and seek substantially similar relief. See Pactiv Corp. v. Multisorb Techs., Inc., No. 10 C 461, 2011 WL 686813, at *3 (N.D.Ill. Feb. 15, 2011) (granting reassignment where the discovery and damage analyses between the cases were similar, and there was “significant overlap” in the defenses); River Vill. W. LLC v. Peoples Gas Light and Coke Co., No. 05 C 2103, 2007 WL
541948 (N.D.Ill. Feb. 14, 2007) (finding substantial judicial resources would be saved for purposes of reassignment and consolidation where the three cases had, among other things, “identical defendants, the same legal theories, substantially similar factual theories, and involve the same Chicago River”). Indeed, defendant further admits that the two additional claims in Jenkins, for invasion of privacy and breach of fiduciary duty, are closely related to plaintiff’s allegations related to HIPAA, such that the causes of action in both cases are “substantially similar.” (Dckt. #26-1 at 3–4). Furthermore, as discussed above, the differences between the cases are significantly outweighed by the legal and factual similarities, such that it would be more efficient to handle the cases in one proceeding. See Freeman v. Bogusiewicz, No. 03 C 2908, 2004 WL 1879045, at *2 (N.D.Ill. Aug. 11, 2004) (finding that reassignment was appropriate where “[t]he facts and issues in both cases are similar in nature and can be handled more efficiently in one proceeding”); see also Global Patent Holdings, 2008 WL 1848142, at *4 (reassignment proper in part because “both actions involve prima facie fundamentally similar claims and defenses that
will likely be amenable to dispositive treatment in unified proceedings”). Accordingly, the Court finds that the factors favoring reassignment of Jenkins to this Court have been met. 4. McClain and Jenkins should be consolidated. Federal Rule of Civil Procedure 42(a) provides that “[i]f actions before the court involve a common question of law or fact, the court may . . . consolidate the actions.” Fed.R.Civ.P. 42(a)(2). The decision to consolidate cases is left to discretion of the district court. Stingley v. Laci Transp., Inc., No. 18-CV-06221, 2020 WL 12182491, at *2 (N.D.Ill. Dec. 1, 2020). As set forth above, at their core, the claims and issues being litigated in Jenkins substantially overlap with those at issue here—namely that plaintiffs visited defendant’s website, made an
appointment, and had their health data transmitted to Google. See, e.g., Eason v. Illinois DCFS, No. 07 C 50015, 2009 WL 10740445, at *2 (N.D.Ill. June 25, 2009) (common questions of law and fact weighed in favor or consolidation even where the case involved “separate and distinct incidents”). The fact that the Jenkins plaintiffs were asked to share the medical issue prompting their appointments, such as red eyes, whereas the present plaintiff was only prompted to share whether she wore glasses or contacts, is not a meaningful enough distinction to weigh against consolidation. The Court therefore finds that consolidation is proper. See Blair v. Equifax Check Servs., Inc., 181 F.3d 832, 839 (7th Cir. 1999) (“By far the best means of avoiding wasteful overlap when related suits are pending in the same court is to consolidate all before a single judge.”). In sum: Both reassignment under Local Rule 40.4 and consolidation under Rule 42 are warranted. Accordingly, the Court, in its discretion, grants plaintiffs motion. CONCLUSION For the reasons set forth above, defendant’s motion to dismiss, (Dckt. #15), is granted in part with respect to plaintiffs claims for breach of an implied contract and breach of confidence, and denied in part with respect to plaintiff's ECPA, negligence, and unjust enrichment claims. Plaintiff's motion to consolidate and reassign related actions, (Dckt. #24), is granted. The Jenkins case, No. 25-cv-10000, which is currently pending before Judge Harjani, should be reassigned to the undersigned’s calendar pursuant to Local Rule 40.4, and the Court requests that the Executive Committee approve the reassignment. After reassignment, the Jenkins case will be consolidated with this case for all further proceedings. The Clerk is directed to forward a copy of this Opinion and Order to the Executive Committee and Judge Harjani. See L.R. 40.4(d).
Date: March 13, 2026
United States District Court Judge