Daniel Gliksman v. Healthline Media, LLC

Opinion

DANIEL GLIKSMAN, Case No.24-cv-08650-AMO Plaintiff, ORDER GRANTING IN PART AND v. DENYING IN PART MOTION TO DISMISS Re: Dkt. No. 51 Defendant.

This is a putative data privacy class action. Defendant Healthline Media, LLC’s motion to dismiss was heard before this Court on February 5, 2026. Having read the parties’ papers and carefully considered the arguments therein and those made at the hearing, as well as the relevant legal authority, and good cause appearing, the Court GRANTS IN PART and DENIES IN PART the motion for the following reasons. A. Factual Background1 Healthline Media, LLC (“Healthline”) operates a portfolio of consumer-facing websites which publish health and wellness-related articles. Dkt. No. 44, Amended Complaint ¶¶ 1, 17, 20 (“Am. Compl.”). Healthline’s websites use third-party trackers known as “pixels.” Id. ¶ 3. Specifically, Healthline uses the TikTok Pixel, the Microsoft Clarity Pixel, and the Adnx Pixel (collectively, the “Pixels”). Id. ¶ 6. The Pixels track, record, and collect website users’ information, including their searches and IP addresses, which are subsequently communicated to 1 These facts are drawn from the allegations in Gliksman’s complaint, which the Court accepts as true and construes in the light most favorable to Gliksman. See Manzarek v. St. Paul Fire & third party platforms and advertisers – TikTok and Microsoft – without consent from the website’s visitor. Id. ¶¶ 4-5, 21. Healthline leverages the user data to sell advertising space on its websites and to earn additional revenue. Id. ¶ 7. The Pixels also allow Healthline to place advertisements on other companies’ websites, increasing brand awareness and sales. Id. The data that the Pixels collect from consumers can be used to identify specific individuals, even without information such as the person’s name or address, and to determine the location of the individual. Id. ¶ 8. TikTok Pixel. The TikTok Pixel enables advertisers to track users’ website interactions through the user’s browser. Id. ¶ 33. “The TikTok Pixel collects and transmits search terms, URL[s], or article titles that convey health symptoms, conditions, or diagnoses in addition to supplementary metadata, including information such as ad/event details (related to the clicked ad), timestamp (time page was viewed), IP address (which can identify a person’s geographic location), device details (make, model, operating system) and browser information.” Id. ¶ 34. The TikTok Pixel uses a process called “fingerprinting,” through which the Pixel collects as much data as it can about an anonymous website visitor and matches it with existing data that TikTok has acquired about millions of users. Id. ¶ 36. The TikTok Pixel also offers an “AutoAdvanced Matching” feature which automatically collects additional information from visitors who interact with a business’s website or application, such as email addresses, phone numbers, and other identifiers. Id. ¶ 38. Microsoft Clarity Pixel. Healthline also implements the Microsoft Clarity Pixel and, in addition to other information, discloses users’ Machine Unique Identifier (“MUID”) to Microsoft, which is a unique and persistent identifier generated by Microsoft and assigned to a specific browser to track users’ activity across the internet. Id. ¶¶ 43-44. Adnx Pixel. Finally, Healthline uses the Adnx Pixel, developed by the software company Xandr, which was acquired by Microsoft in 2021. Id. ¶¶ 49-50. Like the other Pixels, the Adnx Pixel allows companies to sell advertising space on their website by using the Adnx pixel to receive, store, and analyze information collected from website visitors. Id. ¶ 52. The Adnx pixel is installed on Healthline’s websites and sends the user’s IP address to Xandr, which stores it in a user’s IP address. Id. ¶ 54. Healthline knowingly installed the Pixels. Id. ¶ 62. In 2022, Healthline was sued for violations of the Video Privacy Protection Act, 18 U.S.C. § 2710, et seq., based on its use of the Meta Pixel on its website. Id. ¶ 57. Healthline also recently announced a $1.55 million settlement with the Attorney General of California relating to allegations that Healthline’s online tracking technology, including pixels, violated the California Consumer Privacy Act (“CCPA”). Id. ¶ 58. “Healthline allows online trackers, like cookies and pixels, to communicate data about readers to advertisers and other third parties. Healthline shared data that could uniquely identify the consumer, in addition to the title of the article they were reading.” Id. ¶ 59 (quoting California Attorney General’s press release on the settlement). Plaintiff Daniel Gliksman visited Healthline’s website numerous times. Id. ¶ 63. During the last year, Gliksman searched for and viewed articles regarding sensitive health conditions on Healthline.com, including , among other topics. Id. ¶ 9. After Gliksman searched Healthline’s website, he received advertisements for various exercise programs and medical studies related to . Id. ¶ 68. B. Procedural Background Gliksman filed suit against Healthline on December 2, 2024. Dkt. No. 1. On February 27, 2025, Healthline filed a motion to dismiss Gliksman’s complaint. Dkt. No. 21. On August 14, 2025, the Court granted Healthline’s motion to dismiss with leave to amend because Gliksman failed to adequately allege he had Article III standing. Dkt. No. 39.2 On September 11, 2025, Gliksman filed an amended complaint. Dkt. No. 44. The amended complaint brings two claims: (1) violation of California’s Invasion of Privacy Act (Cal. Penal Code § 638.51) and (2) violation of California’s Invasion of Privacy Act (Cal. Penal Code § 631(a)). Id. On October 2, 2025, Healthline filed a motion to dismiss, arguing that Gliksman lacked Article III standing and failed 2 On August 27, 2025, Healthline filed a motion to stay discovery pending resolution of its to state a claim under Federal Rule of Civil Procedure 12(b)(6). Dkt. No. 51. Gliksman filed an opposition on December 23, 2025, Dkt. No. 56, and Healthline’s reply followed on November 20, 2025, Dkt. No. 57. A. 12(b)(1) “To satisfy Article III’s case or controversy requirement, a plaintiff must establish that [they] ha[ve] standing to invoke the jurisdiction of the federal courts.” Bowen v. Energizer Holdings, Inc., 118 F.4th 1134, 1142 (9th Cir. 2024) (citing TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021)). Article III standing requires a showing of an injury in fact that is traceable to the challenged conduct and redressable by a favorable ruling. See Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61 (1992)). “Only those plaintiffs who have been concretely harmed by a defendant’s statutory violation may sue that private defendant over that violation in federal court.” TransUnion LLC v. Ramirez, 594 U.S. 413, 427 (2021) (emphasis in original). A challenge to standing under Rule 12(b)(1) can be facial or factual. A facial attack presumes “the truth of the plaintiff’s allegations but asserts that they ‘are insufficient on their face to invoke federal jurisdiction.’ ” Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014) (quoting Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004)). A factual attack “contests the truth of the plaintiff’s factual allegations, usually by introducing evidence outside the pleadings.” Id. Here, Healthline’s challenge to standing is facial, as Healthline does not contest the truth of Gliksman’s factual allegations, but rather argues that they are insufficient to confer standing. See, e.g., Dkt. No. 51 at 10 (Gliksman lacks standing “because he does not allege facts demonstrating that he suffered an Article III injury-in-fact.”). “The district court resolves a facial attack as it would a motion to dismiss under Rule 12(b)(6): Accepting the plaintiff’s allegations as true and drawing all reasonable inferences in the plaintiff's favor, the court determines whether the allegations are sufficient as a legal matter to invoke the court’s jurisdiction.” Leite, 749 F.3d at 1121. B. 12(b)(6) Federal Rule of Civil Procedure 8 requires a complaint to include “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). A complaint that fails to meet this standard may be dismissed pursuant to Federal Rule of Civil Procedure Rule 12(b)(6). To overcome a Rule 12(b)(6) motion to dismiss, the factual allegations in the plaintiff’s complaint “ ‘must . . . suggest that the claim has at least a plausible chance of success.’ ” Levitt v. Yelp! Inc., 765 F.3d 1123, 1135 (9th Cir. 2014) (quoting In re Century Aluminum Co. Sec. Litig., 729 F.3d 1104, 1107 (9th Cir. 2013) (alterations in original)). In deciding a Rule 12(b)(6) motion, courts “accept factual allegations in the complaint as true and construe the pleadings in the light most favorable to the nonmoving party.” Manzarek, 519 F.3d at 1031. “[A]llegations in a complaint . . . may not simply recite the elements of a cause of action, but must contain sufficient allegations of underlying facts to give fair notice and to enable the opposing party to defend itself effectively.” Levitt, 765 F.3d at 1135 (quoting Starr v. Baca, 652 F.3d 1202, 1216 (9th Cir. 2011)). The court may dismiss a claim “where there is either a lack of a cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal claim.” Hinds Invs., L.P. v. Angioli, 654 F.3d 846, 850 (9th Cir. 2011) (citing Johnson v. Riverside Healthcare Sys., LP, 534 F.3d 1116, 1121 (9th Cir. 2008)). The Court first analyzes whether Gliksman has standing to bring this suit, as it is a threshold issue, and then assesses Healthline’s argument that Gliksman failed to state a claim upon which relief can be granted. A. Standing Healthline argues that Gliksman fails to adequately allege he has standing because (1) “most of the information allegedly collected by the Pixels (e.g., IP addresses, generic browsing data, and basic contact information) does not implicate a ‘protectable privacy interest’ as a matter of law[,]” (2) he fails to allege facts sufficient to demonstrate that both the Pixels were configured of his private information, and (3) even if Gliksman plausibly alleges collection, he still lacks standing because the Pixels anonymouslycollected his information. Dkt. No. 51 at 33. i. Protectable Privacy Interest To demonstrate Article III standing for a California Invasion of Privacy Act (“CIPA”) claim, Gliksman must allege facts demonstrating that his interaction with Healthline’s website disclosed information that “implicates a protectable privacy interest.” Khamooshi v. Politico LLC, 786 F. Supp. 3d 1174, 1179 (N.D. Cal. 2025) (internal citation and quotation omitted). Whether a plaintiff’s privacy interest “is infringed depends on whether the information at issue is actually personal and private,” and whether it has a “ ‘close relationship’ to a ‘harm traditionally recognized as providing a basis for a lawsuit in American courts.’ ” Lien v. Talkdesk, Inc., No. 24-CV-06467, 2025 WL 551664, at *1 (N.D. Cal. Feb. 19, 2025) (quoting TransUnion LLC, 594 U.S. at 432). Determining whether Gliksman has alleged disclosure of information that “implicates a protectable privacy interest[,]’ ” Khamooshi, 786 F. Supp. at 1179, “requires [the Court’s] consideration of the nature of the allegedly intercepted information,” Lien, 2025 WL 551664, at *1 (internal quotation and alteration omitted). “The Ninth Circuit has held that the disclosure of sensitive private information constitutes a ‘concrete and particularized’ injury for purposes of Article III where plaintiffs ‘sufficiently allege[ ] a clear invasion of the historically recognized right to privacy.’ ” Cottle v. Plaid Inc., 536 F. Supp. 3d 461, 480 (N.D. Cal. 2021). As an initial matter, Gliksman argues that Article III standing is satisfied because he has alleged a statutory violation. This is not so. See Popa v. Microsoft Corp., 153 F.4th 784, 792 (9th Cir. 2025) (rejecting argument that “any plaintiff alleging a violation of [a] statute will satisfy Article III.”). Nonetheless, Gliksman adequately alleges that he disclosed sensitive private information and that Healthline invaded a historically recognized right to privacy.3 Gliksman searched for and viewed articles related to his own sensitive health conditions including “ 3 Healthline concedes as much in their reply brief: “Gliksman’s Amended Complaint generically ” Am. Compl. ¶ 64. He also searched for and viewed articles relating to health conditions of his family members, including . Id. The Ninth Circuit recognizes that “[v]iolations of the right to privacy have long been actionable at common law,” and that “[a] right to privacy ‘encompass[es] the individual’s control of information concerning his or her person.’ ” In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589, 598 (9th Cir. 2020) (citations omitted). The information Gliksman shared with Healthline is sensitive medical information and therefore implicates a “protectible privacy interest.” Khamooshi, 786 F. Supp. at 1179; see also St. Aubin v. Carbon Health Techs., Inc., No. 24-CV-00667-JST, 2024 WL 4369675, at *12 (N.D. Cal. Oct. 1, 2024) (“It is well-settled under California law that, although not absolute, people have a privacy interest in their medical history and information.”) (citations and quotations omitted); R.C. v. Sussex Publishers, LLC, No. 24-CV-02609-JSC, 2025 WL 948060, at *3 (N.D. Cal. Mar. 28, 2025) (finding plaintiffs satisfied Article III standing where they shared medical information with defendant); Yockey v. Salesforce, Inc., 688 F. Supp. 3d 962, 969-970 (N.D. Cal. 2023) (same). ii. Pixels Configured to Collect Gliksman’s Information Next, Healthline argues that Gliksman did not plausibly allege an interaction with Healthline’s website that would cause the collection of his cognizable private information because he “does not articulate when he accessed the [w]ebsite, what articles he actually viewed (only vague topics are mentioned), and how he allegedly accessed those articles (e.g., by searching or browsing the [w]ebsite).” Dkt. No. 51 at 19-20 (citing Heiting v. FKA Distrib. Co., No. 2:24-CV- 07314-HDV-AGR, 2025 WL 736594, at *3 (C.D. Cal. Feb. 3, 2025)). But Heiting is inapposite. In Heiting plaintiff alleged only that “she is ‘a person who visited [d]efendant’s [w]ebsite[.]’ ” Id. That is not the case here, where Gliksman alleged that he “visited Defendant’s website numerous times over the last year to view health content and articles” and “searched for and viewed articles related to his own sensitive health conditions[.]” Am. Compl. ¶¶ 64-66. Healthline’s reliance on Cody v. E. Gluck Corp., No. 23-CV-02286-HSG, 2024 WL that plaintiff failed to adequately allege that defendant collected her information where plaintiff did not statethat she used defendant’s chat feature, the mechanism that allegedly collected personal information, on defendant’s website. 2024 WL 4314187, at *2. But here, unlike in Cody, Gliksman alleges that he used Healthline’s site in a way that would cause the collection of his personal information. Am. Compl. ¶ 67 (“Healthline’s Pixels collected and transmitted the search terms, URLs, and article titles” and “[t]hird [p]arties including TikTok, Microsoft, and Xandr intercepted this information about Plaintiff in real time and used it to serve him with advertisements related to health conditions, symptoms, and diagnoses conveyed through Defendant’s Pixels on Healthline.com.”). Healthline further argues that “Gliksman makes no efforts to demonstrate how and when each of the Pixels collect[ed]” his personal information, without citing to any case law requiring that information to establish standing. Dkt. No. 51 at 20. “At the motion to dismiss stage, a plaintiff is not required to allege how and when their communications are captured.” St. Aubin, 2024 WL 4369675, at *6. Thus, Healthline’s argument that Gliksman failed to adequately allege that the Pixels collected his information is unavailing. 4 iii. Anonymity Finally, Healthline contends that Gliksman has no privacy interest because the alleged collection of his information was anonymous. Dkt. No. 51 at 21. This argument is unpersuasive. Gliksman alleges that, “[w]ithout Plaintiff’s knowledge or consent, Defendant’s Pixels deployed a de-anonymization process to identify Plaintiff using electronic impulses generated from Plaintiff’s device[.]” Am. Compl. ¶ 72. Gliksman further states that “[t]he data, information and communications that Defendant surreptitiously obtains from Plaintiff and Class members are used by third parties to whom Defendant sells and/or shares Plaintiff’s and Class members’ information to identify them and make personalized advertisements to Plaintiff and Class members individually.” Id. ¶ 78. Healthline argues these allegations are insufficient because Gliksman “does not allege that he was using a personal browser or device, or that his browser was configured to allow cookies.” Dkt. No. 51 at 22. But Healthline cites no cases stating that Gliksman is required to dispel every way in which his data may, at one time or another, have been collected anonymously. Gliksman alleges that the Pixels deanonymized his data, and he supports this allegation by stating that he was targeted with advertisements related to “ after searching for and viewing articles related to these topics on Healthline.com.” Id. ¶ 68; see R.C., 2025 WL 948060, at *4 (finding Article III standing because “there remains a genuine dispute as to whether the IP information, in conjunction with other information [d]efendant collected, is personally identifying.”). These allegations are enough to adequately allege that Gliksman’s data did not remain anonymous. In conclusion, Gliksman has adequately alleged Article III standing. Thus, the Court DENIES Healthline’s motion to dismiss for lack of standing. B. Failure to State a Claim Next, Healthline argues that Gliksman failed to state a claim upon which relief can be granted as required by Federal Rule of Civil Procedure 8(a)(2). The Court addresses Healthline’s arguments pertaining to each cause of action in turn. i. Count 1: Violation of California’s Invasion of Privacy Act (Cal. Penal Code § 638.51) CIPA Section 638.51 prohibits the use of a “pen register” or “trap and trace device” without consent or a court order. Cal. Penal Code § 638.51(a)-(b). “ ‘Pen register’ means a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.” Cal. Penal Code § 638.50(b) (emphasis added). “ ‘Trap and trace device’ means a device or process that captures the incoming electronic or other impulses that identify the originating number or other dialing, routing, addressing, or signaling information reasonably likely to identify the source of a wire or electronic communication, but not the contents of a communication.” Cal. Penal Code § 638.50(c) (emphasis added). on Gliksman’s allegation that each of the Pixels can collect the “contents” of a communication. Dkt. No. 51 at 30-32. Healthline contends that, “[w]hen juxtaposed against CIPA § 631(a), which governs wiretaps and eavesdropping that capture the contents of a communication, it is apparent that CIPA § 631(a) and § 638.51 provide a comprehensive scheme that governs two mutually exclusive technologies.” Id.at 30.5 This Court agrees with In re Meta Pixel Tax Filing Cases, which held that “[g]iven CIPA’s purpose to protect Californians’ privacy, it is highly unlikely that the Legislature intended to permit the installation and use of pen registers so long as those devices also record the contents of a third party’s communications.”6 793 F. Supp. 3d 1147, 1154-55 (N.D. Cal. 2025); see also Gabrielli v. Haleon US Inc., No. 25-CV-02555-WHO, 2025 WL 2494368, at *12 (N.D. Cal. Aug. 29, 2025) (adopting reasoning). Healthline urges the Court to depart from the holding inIn re Meta Pixel Tax Filing Cases because the rule of lenity bars a broad reading of Section 638.51. Dkt. No. 57 at 9, 19-20. But as other district courts have recognized, “the rule of lenity has little force in this context.” Fregosa v. Mashable, Inc., No. 25-CV-01094-CRB, 2025 WL 2886399, at *9 (N.D. Cal. Oct. 9, 2025). “[T]he rule of lenity applies only if the court can do no more than guess what the legislative body 5 The Court recognizes that Healthline cites one court in this District which has agreed with Healthline. See Mitchener v. CuriosityStream, Inc., No. 25-CV-01471-NW, 2025 WL 2272413, at *5 (N.D. Cal. Aug. 6, 2025).

6 As Judge Pitts stated:

Here, there is no doubt that the California Legislature, in enacting CIPA, intended “to protect the right of privacy of the people of this state from what it perceived as a serious threat to the free exercise of personal liberties that cannot be tolerated in a free and civilized society. This philosophy appears to lie at the heart of virtually all the decisions construing [CIPA].” Flanagan v. Flanagan, 27 Cal. 4th 766, 775 [, 117 Cal.Rptr.2d 574, 41 P.3d 575] (2002) (cleaned up). Recognizing this intent, the California Supreme Court “has instructed courts to interpret CIPA in the manner that ‘fulfills the legislative purpose of CIPA by giving greater protection to privacy interests.’ ” Matera v. Google, Inc., 15-cv-04062-LHK, 2016 WL 8200619, at *19 (N.D. Cal. 2016) (quoting Flanagan, 27 Cal. 4th at 775, 117 Cal.Rptr.2d 574, 41 P.3d 575). intended; there must be an egregious ambiguity and uncertainty to justify invoking the rule.” Id. (quoting People v. Super. Ct. of Riverside Cnty., 81 Cal.App.5th 851, 886 (Cal. Ct. App. 2022)) (internal quotations omitted). CIPA is not egregiously ambiguous or uncertain. “[I]ts language, structure, history, and purpose are sufficiently clear, and they leave no need for the Court to merely speculate about its applicability. The statutory text is deliberately expansive [and] designed to encompass new technologies[.]” Id.; see also Riganian v. LiveRamp Holdings, Inc., 791 F. Supp. 3d 1075, 1094 (N.D. Cal. 2025) (declining to apply rule of lenity to Section 638.51 claim). Healthline additionally states that “for the same reasons Gliksman fails to demonstrate Article III standing, he also fails to establish a substantive violation of CIPA.” Dkt. No. 51 at 32. For the same reasons the Court rejected Healthline’s argument that Gliksman lacks standing, it also rejects this argument. See supra, Section A (“Standing”). Thus, the Court DENIES Healthline’s motion to dismiss Gliksman’s Section 638.51 claim. ii. Count II: Violation of California’s Invasion of Privacy Act (Cal. Penal Code § 631(a)) Next, Healthline moves to dismiss Gliksman’s Section 631(a) claim. “The California Supreme Court has explained that § 631(a) consists of three main clauses which cover ‘three distinct and mutually independent patterns of conduct’: (1) ‘intentional wiretapping,’ (2) ‘willfully attempting to learn the contents or meaning of a communication in transit over a wire,’ and (3) ‘attempting to use or communicate information obtained as a result of engaging in either of the two previous activities.’ ” Jones v. Peloton Interactive, Inc., 720 F. Supp. 3d 940, 945 (S.D. Cal. 2024) (citing Tavernetti v. Super. Ct., 22 Cal. 3d 187, 192 (1978)). A fourth clause creates an additional basis for liability for anyone “who aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the other three bases for liability.” Mastel v. Miniclip SA, 549 F. Supp. 3d 1129, 1134 (E.D. Cal. 2021) (internal quotations and citation omitted). Healthline argues that the first three clauses do not apply as a matter of law, and Gliksman he has plausibly stated a claim under the second, third, and fourth clauses. Dkt. No. 56 22-29. The Court addresses each of Healthline’s arguments in turn.7 A. Clause Two Clause two makes it unlawful to “willfully and without the consent of all parties to the communication, or in any unauthorized manner, read[], or attempt[] to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit[.]” Cal. Penal Code § 631(a). Healthline contends that this clause does not apply to parties involved in the communication because a party cannot eavesdrop on its own communication. Dkt. No. 51 at 24. In response, Gliksman asserts that Healthline violated clause two because “TikTok, Xandr, and Microsoft have eavesdropped through Healthline’s use of Pixels.” Dkt. No. 56 at 23. But Gliksman’s argument misses the mark – it may well be that TikTok, Xandr, or Microsoft eavesdropped on the communication between Healthline and Gliksman. Even so, it does not follow that Healthline also eavesdropped on that communication. The Court agrees with Healthline that it cannot eavesdrop on its own communication. See Swarts v. Home Depot, Inc., 689 F. Supp. 3d 732, 744-45 (N.D. Cal. 2023) (holding that Home Depot’s recording of chats with customers did not violate clause two, even though Home Depot allowed a third party to “data mine its chat transcripts” because Home Depot was a party to the communication); Graham v. Noom, Inc., 533 F. Supp. 3d 823, 832 (N.D. Cal. 2021) (“a party to a communication can record it (and is not eavesdropping when it does)”) (citations omitted). Thus, Gliksman has failed to state a claim under the second clause. B. Clause Three A successful cause of action under clause three is dependent upon Gliksman plausibly alleging that Healthline violated either clause one or clause two. Swarts, 689 F. Supp. 3d at 744. Because Gliksman has not adequately pleaded violations of clauses one and two, he has also failed to allege a violation of clause three. In re Google Assistant Priv. Litig., 457 F. Supp. 3d 797, 827 (N.D. Cal. 2020) (“Because [p]laintiffs have not [shown a violation of the first or second clause], they also have failed to plead a violation of the third clause”). C. Clause Four The fourth clause of Section 631(a) “imposes liability on any person ‘who aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned’ in clauses one through three.” St. Aubin, 2024 WL 4369675, at *7 (quoting Cal. Penal Code § 631(a)). Gliksman’s clause four claim relies on an underlying violation of clause two by TikTok, Xandr, and Microsoft. See Dkt. No. 56 at 22. The Court first assesses whether Gliksman has adequately alleged that Healthline aided TikTok, Xandr, or Microsoft, and then assesses whether Gliksman adequately pleaded an underlying clause two violation. i. “Aids, agrees with, employs, or conspires” Healthline contends that, to sufficiently allege a claim under clause four, Gliksman must allege facts that allow the Court to draw “a plausible inference that [Healthline] knowingly agreed with or employed [a third-party] to engage in conduct that violated the wiretapping statute.” Smith v. YETI Coolers, LLC, 754 F. Supp. 3d 933, 943 (N.D. Cal. 2024). Gliksman argues in response that “[t]he statute as worded does not include an intent standard.” Dkt. No. 56 at 27-28 (quoting St. Aubin, 2024 WL 4369675, at *7). Indeed, courts in this District have reached different conclusions as to whether a defendant need knowingly aid, agree with, employ, or conspire with a third-party in order to be liable under clause four. The Court agrees with the YETI Coolers court that clause four requires “some level of knowledge and intent”: Th[e fourth] clause prohibits a defendant from aiding, agreeing with, or employing a third party “to unlawfully do, or permit, or cause” the third party to act in violation of the wiretapping statute. Cal. Pen. Code § 631(a) (emphasis added). That language indicates that the defendant must be acting with the third party in order to have the third party perform acts that violate the statute. At the very least, that requires both knowledge of the conduct that will violate the statute and a purpose of aiding, agreeing with, or employing the third party to commit those acts. By its plain terms, that statutory language does not cover, for example, a defendant who properly and lawfully provides information or access to a third party without any knowledge or intent that the third party will use the information in a manner that violates the statute. Such a defendant has not aided, Yeti Coolers, 754 F. Supp. 3d at 942-43 (emphasis in original). Here, Gliksman alleges that “[d]espite being previously sued for the improper use of pixels on its website and agreeing to a $1.55 million settlement with the State of California related to its improper use of tracking technologies, Healthline affirmatively and knowingly elected to install the TikTok, Microsoft Clarity, and Adnx pixels in order to intercept and transmit valuable personally identifiable information from its website visitors without website visitors’ permission.” Am. Compl. ¶ 60. From these facts, the Court can reasonably infer that Healthline knowingly aided, agreed with, employed, or conspired with a third-party to engage in conduct that violated Section 631(a). ii. Underlying Clause Two Violation Finally, in order to state a claim under clause four, Gliksman must adequately allege that there was an underlying clause two violation. Cal. Penal Code § 631(a). To assert a claim under clause two, Gliksman must assert that TikTok, Microsoft, and Xandr: (a) “willfully” read, (b) “the contents or meaning” of his communication with Healthline, (c) without consent, while (d) “in transit.” Cal. Pen. Code § 631(a). Willfully Read. To meet this prong, Gliksman must allege that TikTok, Microsoft, and Xandr actually read or attempted to read the contents of his communications with Healthline. Gutierrez v. Converse Inc., No. 24-4797, 2025 WL 1895315, at *1 (9th Cir. July 9, 2025) (CIPA ¶ 631(a)’s “second clause . . . requires that Salesforce read or attempted to read her chat message”) (emphasis in original). Gliksman’s complaint states that TikTok, Microsoft, and Xandr intercepted his information in real time and “used it to serve him with advertisements related to health conditions, symptoms, and diagnoses conveyed through Defendant’s Pixels on Healthline.com.” Am. Compl. ¶ 67.8 Gliksman supports this assertion by stating that he was “targeted with ads for various exercise programs and medical studies related to 8 Healthline also argues that Gliksman’s complaint suffers from a “group pleading deficiency” where he makes assertions as to TikTok, Microsoft, and Xandr together. Dkt. No. 57 at 16. Not so. Gliksman is not attempting to hold TikTok, Microsoft, and Xandr liable in this action. Indeed, they are not named defendants. Rather, “the group pleading doctrine [] is inapplicable, as after searching for and viewing articles related to these topics on Healthline.com.” Id. ¶ 68. The reasonable inference from these allegations is that TikTok, Microsoft, and Xandr willfully read Gliksman’s communications with Healthlinebecause if they had not read the contents of Gliksman’s communications, they would not have known the substance of his searches, and therefore would not have been able to serve him advertisements specifically targeted at Gliksman’s medical conditions. Thus, Gliksman has adequately alleged that TikTok, Microsoft, and Xandr willfully read his communications. Content Information. Under CIPA, “ ‘[c]ontents’ refers to the intended message conveyed by the communication, and does not include record information regarding the characteristics of the message that is generated in the course of the communication.” In re Zynga Priv. Litig., 750 F.3d 1098, 1106 (9th Cir. 2014). The “content” of a communication is “the intended message conveyed by the communication.” Id. On the other hand, “record information” includes “the characteristics of the message that is generated in the course of the communication” such as “the name, address and subscriber number or identity of a subscriber or customer.” Id. Search terms and URLs that reveal search terms constitute “content information.” See In re Facebook Inc. Internet Tracking Litig., 956 F.3d at 605 (concluding search “terms and the resulting URLs could divulge a user’s personal interests, queries, and habits”); In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 795 (N.D. Cal. 2022) (holding that URLs disclosing search terms or similar communications qualify as a communication). Thus, because Gliksman alleges that the Pixels “collected and transmitted the search terms he entered to reach articles . . ., and the URLs and titles of the articles he viewed,” he adequately alleged that TikTok, Microsoft, and Xandr collected content information. Am. Compl. ¶ 66. Without Consent. Healthline does not contest that Gliksman has adequately pleadedthe “without consent” requirement, and so the Court does not analyze this prong. In Transit. An eavesdropper must read a communication “while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this Pixels in Healthline.com to track and simultaneously transmit information in real time from California website visitors, such as Plaintiff and the Class.” Am. Compl. ¶ 70; see also id. ¶¶ 12, 61, 105, 111. Healthline contends that this allegation is conclusory, and therefore, inadequate to establish real-time interception in California. Dkt. No. 51 at 27-29 (citing Valenzuela v. Keurig Green Mountain, Inc., 674 F. Supp. 3d 751, 758-59 (N.D. Cal. 2023)). But Gliksmanalleges facts that support his contention. For example, he avers that the TikTok Pixel “works by automatically collecting additional information from visitors who interact with a business’s website or app” and that “[w]hen Healthline requests information such as name, date of birth and address, this data is simultaneously sent to TikTok.” Am. Compl. ¶¶ 38, 39. Gliksman also includes screenshots in his complaint that show the information a user puts into Healthline.com is transmitted in real time. See id. ¶¶ 40-42, 47-48, 54-55; Dkt. No. 56 at 25 (citing screenshots to support this contention). Thus, Gliksman’s allegations are not merely conclusory, as Healthline contends, and he has adequately alleged that the Pixels intercepted his data in real time in California. In summary, Gliksman has adequately pleaded a clause four violation of Section 631(a). For the foregoing reasons, the Court GRANTS IN PART and DENIES IN PART Healthline’s motion to dismiss. Gliksman’s claims that Healthline violated clauses one, two, and three of CIPA Section 631(a) fail as a matter of law andare therefore dismissed without leave to amend. See Foman v. Davis, 371 U.S. 178, 182 (1962) (holding leave to amend may be denied due to “futility of amendment”). Otherwise, Healthline’s motion to dismiss is denied. On April 29, 2026, the Court related this action to Rodriguez v. Healthline Media, 24-cv- 8650. See Dkt. No. 68. Rodriguez is stayed pending resolution of the Gliksman motion to dismiss. Accordingly, the Gliksman parties SHALL meet and confer with the Rodriguez parties and, within seven days, file a stipulation with a suggested date for case management conferences to be held in both cases. To be clear, the Court intends to set the conferences on the same date. Should the Rodriguez parties believe a different course is needed, they shall explain their logic. ] file an administrative motion to seal no later than June 30, 2026. Should the parties fail to file a 2 motion to seal, this Order will be posted publicly on the docket. 4 Dated: June 23, 2026 5 = 6 Lea gate fk 7 United States District Judge 8 9 10 1] 12

13 «44

15 16

18 19 20 2] 22 23 24 25 26 27 28