1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 DANIEL GLIKSMAN, Case No.24-cv-08650-AMO Plaintiff, 8 ORDER GRANTING IN PART AND 9 v. DENYING IN PART MOTION TO DISMISS 10 HEALTHLINE MEDIA, LLC, Re: Dkt. No. 51 Defendant. 11
12 13 This is a putative data privacy class action. Defendant Healthline Media, LLC’s motion to 14 dismiss was heard before this Court on February 5, 2026. Having read the parties’ papers and 15 carefully considered the arguments therein and those made at the hearing, as well as the relevant 16 legal authority, and good cause appearing, the Court GRANTS IN PART and DENIES IN 17 PART the motion for the following reasons. 18 I. BACKGROUND 19 A. Factual Background1 20 Healthline Media, LLC (“Healthline”) operates a portfolio of consumer-facing websites 21 which publish health and wellness-related articles. Dkt. No. 44, Amended Complaint ¶¶ 1, 17, 20 22 (“Am. Compl.”). Healthline’s websites use third-party trackers known as “pixels.” Id. ¶ 3. 23 Specifically, Healthline uses the TikTok Pixel, the Microsoft Clarity Pixel, and the Adnx Pixel 24 (collectively, the “Pixels”). Id. ¶ 6. The Pixels track, record, and collect website users’ 25 information, including their searches and IP addresses, which are subsequently communicated to 26 1 These facts are drawn from the allegations in Gliksman’s complaint, which the Court accepts as 27 true and construes in the light most favorable to Gliksman. See Manzarek v. St. Paul Fire & 1 third party platforms and advertisers – TikTok and Microsoft – without consent from the website’s 2 visitor. Id. ¶¶ 4-5, 21. Healthline leverages the user data to sell advertising space on its websites 3 and to earn additional revenue. Id. ¶ 7. The Pixels also allow Healthline to place advertisements 4 on other companies’ websites, increasing brand awareness and sales. Id. The data that the Pixels 5 collect from consumers can be used to identify specific individuals, even without information such 6 as the person’s name or address, and to determine the location of the individual. Id. ¶ 8. 7 TikTok Pixel. The TikTok Pixel enables advertisers to track users’ website interactions 8 through the user’s browser. Id. ¶ 33. “The TikTok Pixel collects and transmits search terms, 9 URL[s], or article titles that convey health symptoms, conditions, or diagnoses in addition to 10 supplementary metadata, including information such as ad/event details (related to the clicked ad), 11 timestamp (time page was viewed), IP address (which can identify a person’s geographic 12 location), device details (make, model, operating system) and browser information.” Id. ¶ 34. The 13 TikTok Pixel uses a process called “fingerprinting,” through which the Pixel collects as much data 14 as it can about an anonymous website visitor and matches it with existing data that TikTok has 15 acquired about millions of users. Id. ¶ 36. The TikTok Pixel also offers an “AutoAdvanced 16 Matching” feature which automatically collects additional information from visitors who interact 17 with a business’s website or application, such as email addresses, phone numbers, and other 18 identifiers. Id. ¶ 38. 19 Microsoft Clarity Pixel. Healthline also implements the Microsoft Clarity Pixel and, in 20 addition to other information, discloses users’ Machine Unique Identifier (“MUID”) to Microsoft, 21 which is a unique and persistent identifier generated by Microsoft and assigned to a specific 22 browser to track users’ activity across the internet. Id. ¶¶ 43-44. 23 Adnx Pixel. Finally, Healthline uses the Adnx Pixel, developed by the software company 24 Xandr, which was acquired by Microsoft in 2021. Id. ¶¶ 49-50. Like the other Pixels, the Adnx 25 Pixel allows companies to sell advertising space on their website by using the Adnx pixel to 26 receive, store, and analyze information collected from website visitors. Id. ¶ 52. The Adnx pixel 27 is installed on Healthline’s websites and sends the user’s IP address to Xandr, which stores it in a 1 user’s IP address. Id. ¶ 54. 2 Healthline knowingly installed the Pixels. Id. ¶ 62. In 2022, Healthline was sued for 3 violations of the Video Privacy Protection Act, 18 U.S.C. § 2710, et seq., based on its use of the 4 Meta Pixel on its website. Id. ¶ 57. Healthline also recently announced a $1.55 million settlement 5 with the Attorney General of California relating to allegations that Healthline’s online tracking 6 technology, including pixels, violated the California Consumer Privacy Act (“CCPA”). Id. ¶ 58. 7 “Healthline allows online trackers, like cookies and pixels, to communicate data about readers to 8 advertisers and other third parties. Healthline shared data that could uniquely identify the 9 consumer, in addition to the title of the article they were reading.” Id. ¶ 59 (quoting California 10 Attorney General’s press release on the settlement). 11 Plaintiff Daniel Gliksman visited Healthline’s website numerous times. Id. ¶ 63. During 12 the last year, Gliksman searched for and viewed articles regarding sensitive health conditions on 13 Healthline.com, including 14 , among other topics. Id. ¶ 9. 15 After Gliksman searched Healthline’s website, he received advertisements for various exercise 16 programs and medical studies related to . Id. ¶ 68. 17 B. Procedural Background 18 Gliksman filed suit against Healthline on December 2, 2024. Dkt. No. 1. On February 27, 19 2025, Healthline filed a motion to dismiss Gliksman’s complaint. Dkt. No. 21. On August 14, 20 2025, the Court granted Healthline’s motion to dismiss with leave to amend because Gliksman 21 failed to adequately allege he had Article III standing. Dkt. No. 39.2 On September 11, 2025, 22 Gliksman filed an amended complaint. Dkt. No. 44. The amended complaint brings two claims: 23 (1) violation of California’s Invasion of Privacy Act (Cal. Penal Code § 638.51) and (2) violation 24 of California’s Invasion of Privacy Act (Cal. Penal Code § 631(a)). Id. On October 2, 2025, 25 Healthline filed a motion to dismiss, arguing that Gliksman lacked Article III standing and failed 26 27 2 On August 27, 2025, Healthline filed a motion to stay discovery pending resolution of its 1 to state a claim under Federal Rule of Civil Procedure 12(b)(6). Dkt. No. 51. Gliksman filed an 2 opposition on December 23, 2025, Dkt. No. 56, and Healthline’s reply followed on November 20, 3 2025, Dkt. No. 57. 4 II. LEGAL STANDARD 5 A. 12(b)(1) 6 “To satisfy Article III’s case or controversy requirement, a plaintiff must establish that 7 [they] ha[ve] standing to invoke the jurisdiction of the federal courts.” Bowen v. Energizer 8 Holdings, Inc., 118 F.4th 1134, 1142 (9th Cir. 2024) (citing TransUnion LLC v. Ramirez, 594 U.S. 9 413, 423 (2021)). Article III standing requires a showing of an injury in fact that is traceable to 10 the challenged conduct and redressable by a favorable ruling. See Spokeo, Inc. v. Robins, 578 U.S. 11 330, 338 (2016) (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61 (1992)). “Only those 12 plaintiffs who have been concretely harmed by a defendant’s statutory violation may sue that 13 private defendant over that violation in federal court.” TransUnion LLC v. Ramirez, 594 U.S. 413, 14 427 (2021) (emphasis in original). 15 A challenge to standing under Rule 12(b)(1) can be facial or factual. A facial attack 16 presumes “the truth of the plaintiff’s allegations but asserts that they ‘are insufficient on their face 17 to invoke federal jurisdiction.’ ” Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014) (quoting 18 Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004)). A factual attack “contests 19 the truth of the plaintiff’s factual allegations, usually by introducing evidence outside the 20 pleadings.” Id. Here, Healthline’s challenge to standing is facial, as Healthline does not contest 21 the truth of Gliksman’s factual allegations, but rather argues that they are insufficient to confer 22 standing. See, e.g., Dkt. No. 51 at 10 (Gliksman lacks standing “because he does not allege facts 23 demonstrating that he suffered an Article III injury-in-fact.”). “The district court resolves a facial 24 attack as it would a motion to dismiss under Rule 12(b)(6): Accepting the plaintiff’s allegations as 25 true and drawing all reasonable inferences in the plaintiff's favor, the court determines whether the 26 allegations are sufficient as a legal matter to invoke the court’s jurisdiction.” Leite, 749 F.3d at 27 1121. 1 B. 12(b)(6) 2 Federal Rule of Civil Procedure 8 requires a complaint to include “a short and plain 3 statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). A 4 complaint that fails to meet this standard may be dismissed pursuant to Federal Rule of Civil 5 Procedure Rule 12(b)(6). To overcome a Rule 12(b)(6) motion to dismiss, the factual allegations 6 in the plaintiff’s complaint “ ‘must . . . suggest that the claim has at least a plausible chance of 7 success.’ ” Levitt v. Yelp! Inc., 765 F.3d 1123, 1135 (9th Cir. 2014) (quoting In re Century 8 Aluminum Co. Sec. Litig., 729 F.3d 1104, 1107 (9th Cir. 2013) (alterations in original)). In 9 deciding a Rule 12(b)(6) motion, courts “accept factual allegations in the complaint as true and 10 construe the pleadings in the light most favorable to the nonmoving party.” Manzarek, 519 F.3d at 11 1031. 12 “[A]llegations in a complaint . . . may not simply recite the elements of a cause of action, 13 but must contain sufficient allegations of underlying facts to give fair notice and to enable the 14 opposing party to defend itself effectively.” Levitt, 765 F.3d at 1135 (quoting Starr v. Baca, 652 15 F.3d 1202, 1216 (9th Cir. 2011)). The court may dismiss a claim “where there is either a lack of a 16 cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal claim.” 17 Hinds Invs., L.P. v. Angioli, 654 F.3d 846, 850 (9th Cir. 2011) (citing Johnson v. Riverside 18 Healthcare Sys., LP, 534 F.3d 1116, 1121 (9th Cir. 2008)). 19 III. DISCUSSION 20 The Court first analyzes whether Gliksman has standing to bring this suit, as it is a 21 threshold issue, and then assesses Healthline’s argument that Gliksman failed to state a claim upon 22 which relief can be granted. 23 A. Standing 24 Healthline argues that Gliksman fails to adequately allege he has standing because (1) 25 “most of the information allegedly collected by the Pixels (e.g., IP addresses, generic browsing 26 data, and basic contact information) does not implicate a ‘protectable privacy interest’ as a matter 27 of law[,]” (2) he fails to allege facts sufficient to demonstrate that both the Pixels were configured 1 of his private information, and (3) even if Gliksman plausibly alleges collection, he still lacks 2 standing because the Pixels anonymouslycollected his information. Dkt. No. 51 at 33. 3 i. Protectable Privacy Interest 4 To demonstrate Article III standing for a California Invasion of Privacy Act (“CIPA”) 5 claim, Gliksman must allege facts demonstrating that his interaction with Healthline’s website 6 disclosed information that “implicates a protectable privacy interest.” Khamooshi v. Politico LLC, 7 786 F. Supp. 3d 1174, 1179 (N.D. Cal. 2025) (internal citation and quotation omitted). Whether a 8 plaintiff’s privacy interest “is infringed depends on whether the information at issue is actually 9 personal and private,” and whether it has a “ ‘close relationship’ to a ‘harm traditionally 10 recognized as providing a basis for a lawsuit in American courts.’ ” Lien v. Talkdesk, Inc., No. 11 24-CV-06467, 2025 WL 551664, at *1 (N.D. Cal. Feb. 19, 2025) (quoting TransUnion LLC, 594 12 U.S. at 432). Determining whether Gliksman has alleged disclosure of information that 13 “implicates a protectable privacy interest[,]’ ” Khamooshi, 786 F. Supp. at 1179, “requires [the 14 Court’s] consideration of the nature of the allegedly intercepted information,” Lien, 2025 WL 15 551664, at *1 (internal quotation and alteration omitted). “The Ninth Circuit has held that the 16 disclosure of sensitive private information constitutes a ‘concrete and particularized’ injury for 17 purposes of Article III where plaintiffs ‘sufficiently allege[ ] a clear invasion of the historically 18 recognized right to privacy.’ ” Cottle v. Plaid Inc., 536 F. Supp. 3d 461, 480 (N.D. Cal. 2021). 19 As an initial matter, Gliksman argues that Article III standing is satisfied because he has 20 alleged a statutory violation. This is not so. See Popa v. Microsoft Corp., 153 F.4th 784, 792 (9th 21 Cir. 2025) (rejecting argument that “any plaintiff alleging a violation of [a] statute will satisfy 22 Article III.”). 23 Nonetheless, Gliksman adequately alleges that he disclosed sensitive private information 24 and that Healthline invaded a historically recognized right to privacy.3 Gliksman searched for and 25 viewed articles related to his own sensitive health conditions including “ 26 27 3 Healthline concedes as much in their reply brief: “Gliksman’s Amended Complaint generically 1 ” Am. 2 Compl. ¶ 64. He also searched for and viewed articles relating to health conditions of his family 3 members, including . Id. The Ninth Circuit recognizes 4 that “[v]iolations of the right to privacy have long been actionable at common law,” and that “[a] 5 right to privacy ‘encompass[es] the individual’s control of information concerning his or her 6 person.’ ” In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589, 598 (9th Cir. 2020) 7 (citations omitted). The information Gliksman shared with Healthline is sensitive medical 8 information and therefore implicates a “protectible privacy interest.” Khamooshi, 786 F. Supp. at 9 1179; see also St. Aubin v. Carbon Health Techs., Inc., No. 24-CV-00667-JST, 2024 WL 10 4369675, at *12 (N.D. Cal. Oct. 1, 2024) (“It is well-settled under California law that, although 11 not absolute, people have a privacy interest in their medical history and information.”) (citations 12 and quotations omitted); R.C. v. Sussex Publishers, LLC, No. 24-CV-02609-JSC, 2025 WL 13 948060, at *3 (N.D. Cal. Mar. 28, 2025) (finding plaintiffs satisfied Article III standing where 14 they shared medical information with defendant); Yockey v. Salesforce, Inc., 688 F. Supp. 3d 962, 15 969-970 (N.D. Cal. 2023) (same). 16 ii. Pixels Configured to Collect Gliksman’s Information 17 Next, Healthline argues that Gliksman did not plausibly allege an interaction with 18 Healthline’s website that would cause the collection of his cognizable private information because 19 he “does not articulate when he accessed the [w]ebsite, what articles he actually viewed (only 20 vague topics are mentioned), and how he allegedly accessed those articles (e.g., by searching or 21 browsing the [w]ebsite).” Dkt. No. 51 at 19-20 (citing Heiting v. FKA Distrib. Co., No. 2:24-CV- 22 07314-HDV-AGR, 2025 WL 736594, at *3 (C.D. Cal. Feb. 3, 2025)). But Heiting is inapposite. 23 In Heiting plaintiff alleged only that “she is ‘a person who visited [d]efendant’s [w]ebsite[.]’ ” Id. 24 That is not the case here, where Gliksman alleged that he “visited Defendant’s website numerous 25 times over the last year to view health content and articles” and “searched for and viewed articles 26 related to his own sensitive health conditions[.]” Am. Compl. ¶¶ 64-66. 27 Healthline’s reliance on Cody v. E. Gluck Corp., No. 23-CV-02286-HSG, 2024 WL 1 that plaintiff failed to adequately allege that defendant collected her information where plaintiff 2 did not statethat she used defendant’s chat feature, the mechanism that allegedly collected 3 personal information, on defendant’s website. 2024 WL 4314187, at *2. But here, unlike in 4 Cody, Gliksman alleges that he used Healthline’s site in a way that would cause the collection of 5 his personal information. Am. Compl. ¶ 67 (“Healthline’s Pixels collected and transmitted the 6 search terms, URLs, and article titles” and “[t]hird [p]arties including TikTok, Microsoft, and 7 Xandr intercepted this information about Plaintiff in real time and used it to serve him with 8 advertisements related to health conditions, symptoms, and diagnoses conveyed through 9 Defendant’s Pixels on Healthline.com.”). 10 Healthline further argues that “Gliksman makes no efforts to demonstrate how and when 11 each of the Pixels collect[ed]” his personal information, without citing to any case law requiring 12 that information to establish standing. Dkt. No. 51 at 20. “At the motion to dismiss stage, a 13 plaintiff is not required to allege how and when their communications are captured.” St. Aubin, 14 2024 WL 4369675, at *6. Thus, Healthline’s argument that Gliksman failed to adequately allege 15 that the Pixels collected his information is unavailing. 4 16 iii. Anonymity 17 Finally, Healthline contends that Gliksman has no privacy interest because the alleged 18 collection of his information was anonymous. Dkt. No. 51 at 21. This argument is unpersuasive. 19 Gliksman alleges that, “[w]ithout Plaintiff’s knowledge or consent, Defendant’s Pixels deployed a 20 de-anonymization process to identify Plaintiff using electronic impulses generated from Plaintiff’s 21 device[.]” Am. Compl. ¶ 72. Gliksman further states that “[t]he data, information and 22 communications that Defendant surreptitiously obtains from Plaintiff and Class members are used 23 by third parties to whom Defendant sells and/or shares Plaintiff’s and Class members’ information 24 to identify them and make personalized advertisements to Plaintiff and Class members 25 individually.” Id. ¶ 78. Healthline argues these allegations are insufficient because Gliksman 26 “does not allege that he was using a personal browser or device, or that his browser was 27 1 configured to allow cookies.” Dkt. No. 51 at 22. But Healthline cites no cases stating that 2 Gliksman is required to dispel every way in which his data may, at one time or another, have been 3 collected anonymously. Gliksman alleges that the Pixels deanonymized his data, and he supports 4 this allegation by stating that he was targeted with advertisements related to “ 5 after searching for and viewing articles related to these topics on Healthline.com.” 6 Id. ¶ 68; see R.C., 2025 WL 948060, at *4 (finding Article III standing because “there remains a 7 genuine dispute as to whether the IP information, in conjunction with other information 8 [d]efendant collected, is personally identifying.”). These allegations are enough to adequately 9 allege that Gliksman’s data did not remain anonymous. 10 In conclusion, Gliksman has adequately alleged Article III standing. Thus, the Court 11 DENIES Healthline’s motion to dismiss for lack of standing. 12 B. Failure to State a Claim 13 Next, Healthline argues that Gliksman failed to state a claim upon which relief can be 14 granted as required by Federal Rule of Civil Procedure 8(a)(2). The Court addresses Healthline’s 15 arguments pertaining to each cause of action in turn. 16 i. Count 1: Violation of California’s Invasion of Privacy Act (Cal. Penal 17 Code § 638.51) 18 CIPA Section 638.51 prohibits the use of a “pen register” or “trap and trace device” 19 without consent or a court order. Cal. Penal Code § 638.51(a)-(b). “ ‘Pen register’ means a device 20 or process that records or decodes dialing, routing, addressing, or signaling information 21 transmitted by an instrument or facility from which a wire or electronic communication is 22 transmitted, but not the contents of a communication.” Cal. Penal Code § 638.50(b) (emphasis 23 added). “ ‘Trap and trace device’ means a device or process that captures the incoming electronic 24 or other impulses that identify the originating number or other dialing, routing, addressing, or 25 signaling information reasonably likely to identify the source of a wire or electronic 26 communication, but not the contents of a communication.” Cal. Penal Code § 638.50(c) 27 (emphasis added). 1 on Gliksman’s allegation that each of the Pixels can collect the “contents” of a communication. 2 Dkt. No. 51 at 30-32. Healthline contends that, “[w]hen juxtaposed against CIPA § 631(a), which 3 governs wiretaps and eavesdropping that capture the contents of a communication, it is apparent 4 that CIPA § 631(a) and § 638.51 provide a comprehensive scheme that governs two mutually 5 exclusive technologies.” Id.at 30.5 6 This Court agrees with In re Meta Pixel Tax Filing Cases, which held that “[g]iven CIPA’s 7 purpose to protect Californians’ privacy, it is highly unlikely that the Legislature intended to 8 permit the installation and use of pen registers so long as those devices also record the contents of 9 a third party’s communications.”6 793 F. Supp. 3d 1147, 1154-55 (N.D. Cal. 2025); see also 10 Gabrielli v. Haleon US Inc., No. 25-CV-02555-WHO, 2025 WL 2494368, at *12 (N.D. Cal. Aug. 11 29, 2025) (adopting reasoning). 12 Healthline urges the Court to depart from the holding inIn re Meta Pixel Tax Filing Cases 13 because the rule of lenity bars a broad reading of Section 638.51. Dkt. No. 57 at 9, 19-20. But as 14 other district courts have recognized, “the rule of lenity has little force in this context.” Fregosa v. 15 Mashable, Inc., No. 25-CV-01094-CRB, 2025 WL 2886399, at *9 (N.D. Cal. Oct. 9, 2025). 16 “[T]he rule of lenity applies only if the court can do no more than guess what the legislative body 17 18 5 The Court recognizes that Healthline cites one court in this District which has agreed with Healthline. See Mitchener v. CuriosityStream, Inc., No. 25-CV-01471-NW, 2025 WL 2272413, at 19 *5 (N.D. Cal. Aug. 6, 2025).
20 6 As Judge Pitts stated:
21 Here, there is no doubt that the California Legislature, in enacting CIPA, intended “to protect the right of privacy of the people of this 22 state from what it perceived as a serious threat to the free exercise of personal liberties that cannot be tolerated in a free and civilized 23 society. This philosophy appears to lie at the heart of virtually all the decisions construing [CIPA].” Flanagan v. Flanagan, 27 Cal. 4th 24 766, 775 [, 117 Cal.Rptr.2d 574, 41 P.3d 575] (2002) (cleaned up). Recognizing this intent, the California Supreme Court “has instructed 25 courts to interpret CIPA in the manner that ‘fulfills the legislative purpose of CIPA by giving greater protection to privacy interests.’ ” 26 Matera v. Google, Inc., 15-cv-04062-LHK, 2016 WL 8200619, at *19 (N.D. Cal. 2016) (quoting Flanagan, 27 Cal. 4th at 775, 117 27 Cal.Rptr.2d 574, 41 P.3d 575). 1 intended; there must be an egregious ambiguity and uncertainty to justify invoking the rule.” Id. 2 (quoting People v. Super. Ct. of Riverside Cnty., 81 Cal.App.5th 851, 886 (Cal. Ct. App. 3 2022)) (internal quotations omitted). CIPA is not egregiously ambiguous or uncertain. “[I]ts 4 language, structure, history, and purpose are sufficiently clear, and they leave no need for the 5 Court to merely speculate about its applicability. The statutory text is deliberately expansive [and] 6 designed to encompass new technologies[.]” Id.; see also Riganian v. LiveRamp Holdings, Inc., 7 791 F. Supp. 3d 1075, 1094 (N.D. Cal. 2025) (declining to apply rule of lenity to Section 638.51 8 claim). 9 Healthline additionally states that “for the same reasons Gliksman fails to demonstrate 10 Article III standing, he also fails to establish a substantive violation of CIPA.” Dkt. No. 51 at 32. 11 For the same reasons the Court rejected Healthline’s argument that Gliksman lacks standing, it 12 also rejects this argument. See supra, Section A (“Standing”). Thus, the Court DENIES 13 Healthline’s motion to dismiss Gliksman’s Section 638.51 claim. 14 ii. Count II: Violation of California’s Invasion of Privacy Act (Cal. Penal 15 Code § 631(a)) 16 Next, Healthline moves to dismiss Gliksman’s Section 631(a) claim. “The California 17 Supreme Court has explained that § 631(a) consists of three main clauses which cover ‘three 18 distinct and mutually independent patterns of conduct’: (1) ‘intentional wiretapping,’ (2) ‘willfully 19 attempting to learn the contents or meaning of a communication in transit over a wire,’ and (3) 20 ‘attempting to use or communicate information obtained as a result of engaging in either of the 21 two previous activities.’ ” Jones v. Peloton Interactive, Inc., 720 F. Supp. 3d 940, 945 (S.D. Cal. 22 2024) (citing Tavernetti v. Super. Ct., 22 Cal. 3d 187, 192 (1978)). A fourth clause creates an 23 additional basis for liability for anyone “who aids, agrees with, employs, or conspires with any 24 person or persons to unlawfully do, or permit, or cause to be done any of the other three bases for 25 liability.” Mastel v. Miniclip SA, 549 F. Supp. 3d 1129, 1134 (E.D. Cal. 2021) (internal quotations 26 and citation omitted). 27 Healthline argues that the first three clauses do not apply as a matter of law, and Gliksman 1 he has plausibly stated a claim under the second, third, and fourth clauses. Dkt. No. 56 22-29. 2 The Court addresses each of Healthline’s arguments in turn.7 3 A. Clause Two 4 Clause two makes it unlawful to “willfully and without the consent of all parties to the 5 communication, or in any unauthorized manner, read[], or attempt[] to read, or to learn the 6 contents or meaning of any message, report, or communication while the same is in transit[.]” 7 Cal. Penal Code § 631(a). Healthline contends that this clause does not apply to parties involved 8 in the communication because a party cannot eavesdrop on its own communication. Dkt. No. 51 9 at 24. In response, Gliksman asserts that Healthline violated clause two because “TikTok, Xandr, 10 and Microsoft have eavesdropped through Healthline’s use of Pixels.” Dkt. No. 56 at 23. But 11 Gliksman’s argument misses the mark – it may well be that TikTok, Xandr, or Microsoft 12 eavesdropped on the communication between Healthline and Gliksman. Even so, it does not 13 follow that Healthline also eavesdropped on that communication. The Court agrees with 14 Healthline that it cannot eavesdrop on its own communication. See Swarts v. Home Depot, Inc., 15 689 F. Supp. 3d 732, 744-45 (N.D. Cal. 2023) (holding that Home Depot’s recording of chats with 16 customers did not violate clause two, even though Home Depot allowed a third party to “data mine 17 its chat transcripts” because Home Depot was a party to the communication); Graham v. Noom, 18 Inc., 533 F. Supp. 3d 823, 832 (N.D. Cal. 2021) (“a party to a communication can record it (and is 19 not eavesdropping when it does)”) (citations omitted). Thus, Gliksman has failed to state a claim 20 under the second clause. 21 B. Clause Three 22 A successful cause of action under clause three is dependent upon Gliksman plausibly 23 alleging that Healthline violated either clause one or clause two. Swarts, 689 F. Supp. 3d at 744. 24 Because Gliksman has not adequately pleaded violations of clauses one and two, he has also failed 25 to allege a violation of clause three. In re Google Assistant Priv. Litig., 457 F. Supp. 3d 797, 827 26 (N.D. Cal. 2020) (“Because [p]laintiffs have not [shown a violation of the first or second clause], 27 1 they also have failed to plead a violation of the third clause”). 2 C. Clause Four 3 The fourth clause of Section 631(a) “imposes liability on any person ‘who aids, agrees 4 with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be 5 done any of the acts or things mentioned’ in clauses one through three.” St. Aubin, 2024 WL 6 4369675, at *7 (quoting Cal. Penal Code § 631(a)). Gliksman’s clause four claim relies on an 7 underlying violation of clause two by TikTok, Xandr, and Microsoft. See Dkt. No. 56 at 22. The 8 Court first assesses whether Gliksman has adequately alleged that Healthline aided TikTok, 9 Xandr, or Microsoft, and then assesses whether Gliksman adequately pleaded an underlying clause 10 two violation. 11 i. “Aids, agrees with, employs, or conspires” 12 Healthline contends that, to sufficiently allege a claim under clause four, Gliksman must 13 allege facts that allow the Court to draw “a plausible inference that [Healthline] knowingly agreed 14 with or employed [a third-party] to engage in conduct that violated the wiretapping statute.” Smith 15 v. YETI Coolers, LLC, 754 F. Supp. 3d 933, 943 (N.D. Cal. 2024). Gliksman argues in response 16 that “[t]he statute as worded does not include an intent standard.” Dkt. No. 56 at 27-28 (quoting 17 St. Aubin, 2024 WL 4369675, at *7). Indeed, courts in this District have reached different 18 conclusions as to whether a defendant need knowingly aid, agree with, employ, or conspire with a 19 third-party in order to be liable under clause four. The Court agrees with the YETI Coolers court 20 that clause four requires “some level of knowledge and intent”: 21 Th[e fourth] clause prohibits a defendant from aiding, agreeing with, or employing a third party “to unlawfully do, or permit, or cause” 22 the third party to act in violation of the wiretapping statute. Cal. Pen. Code § 631(a) (emphasis added). That language indicates that 23 the defendant must be acting with the third party in order to have the third party perform acts that violate the statute. At the very least, 24 that requires both knowledge of the conduct that will violate the statute and a purpose of aiding, agreeing with, or employing the 25 third party to commit those acts. By its plain terms, that statutory language does not cover, for example, a defendant who properly and 26 lawfully provides information or access to a third party without any knowledge or intent that the third party will use the information in a 27 manner that violates the statute. Such a defendant has not aided, 1 Yeti Coolers, 754 F. Supp. 3d at 942-43 (emphasis in original). 2 Here, Gliksman alleges that “[d]espite being previously sued for the improper use of pixels 3 on its website and agreeing to a $1.55 million settlement with the State of California related to its 4 improper use of tracking technologies, Healthline affirmatively and knowingly elected to install 5 the TikTok, Microsoft Clarity, and Adnx pixels in order to intercept and transmit valuable 6 personally identifiable information from its website visitors without website visitors’ permission.” 7 Am. Compl. ¶ 60. From these facts, the Court can reasonably infer that Healthline knowingly 8 aided, agreed with, employed, or conspired with a third-party to engage in conduct that violated 9 Section 631(a). 10 ii. Underlying Clause Two Violation 11 Finally, in order to state a claim under clause four, Gliksman must adequately allege that 12 there was an underlying clause two violation. Cal. Penal Code § 631(a). To assert a claim under 13 clause two, Gliksman must assert that TikTok, Microsoft, and Xandr: (a) “willfully” read, (b) “the 14 contents or meaning” of his communication with Healthline, (c) without consent, while (d) “in 15 transit.” Cal. Pen. Code § 631(a). 16 Willfully Read. To meet this prong, Gliksman must allege that TikTok, Microsoft, and 17 Xandr actually read or attempted to read the contents of his communications with Healthline. 18 Gutierrez v. Converse Inc., No. 24-4797, 2025 WL 1895315, at *1 (9th Cir. July 9, 2025) (CIPA ¶ 19 631(a)’s “second clause . . . requires that Salesforce read or attempted to read her chat message”) 20 (emphasis in original). Gliksman’s complaint states that TikTok, Microsoft, and Xandr 21 intercepted his information in real time and “used it to serve him with advertisements related to 22 health conditions, symptoms, and diagnoses conveyed through Defendant’s Pixels on 23 Healthline.com.” Am. Compl. ¶ 67.8 Gliksman supports this assertion by stating that he was 24 “targeted with ads for various exercise programs and medical studies related to 25 8 Healthline also argues that Gliksman’s complaint suffers from a “group pleading deficiency” 26 where he makes assertions as to TikTok, Microsoft, and Xandr together. Dkt. No. 57 at 16. Not so. Gliksman is not attempting to hold TikTok, Microsoft, and Xandr liable in this action. Indeed, 27 they are not named defendants. Rather, “the group pleading doctrine [] is inapplicable, as 1 after searching for and viewing articles related to these topics on Healthline.com.” 2 Id. ¶ 68. 3 The reasonable inference from these allegations is that TikTok, Microsoft, and Xandr 4 willfully read Gliksman’s communications with Healthlinebecause if they had not read the 5 contents of Gliksman’s communications, they would not have known the substance of his 6 searches, and therefore would not have been able to serve him advertisements specifically targeted 7 at Gliksman’s medical conditions. Thus, Gliksman has adequately alleged that TikTok, Microsoft, 8 and Xandr willfully read his communications. 9 Content Information. Under CIPA, “ ‘[c]ontents’ refers to the intended message 10 conveyed by the communication, and does not include record information regarding the 11 characteristics of the message that is generated in the course of the communication.” In re Zynga 12 Priv. Litig., 750 F.3d 1098, 1106 (9th Cir. 2014). The “content” of a communication is “the 13 intended message conveyed by the communication.” Id. On the other hand, “record information” 14 includes “the characteristics of the message that is generated in the course of the communication” 15 such as “the name, address and subscriber number or identity of a subscriber or customer.” Id. 16 Search terms and URLs that reveal search terms constitute “content information.” See In 17 re Facebook Inc. Internet Tracking Litig., 956 F.3d at 605 (concluding search “terms and the 18 resulting URLs could divulge a user’s personal interests, queries, and habits”); In re Meta Pixel 19 Healthcare Litig., 647 F. Supp. 3d 778, 795 (N.D. Cal. 2022) (holding that URLs disclosing 20 search terms or similar communications qualify as a communication). Thus, because Gliksman 21 alleges that the Pixels “collected and transmitted the search terms he entered to reach articles . . ., 22 and the URLs and titles of the articles he viewed,” he adequately alleged that TikTok, Microsoft, 23 and Xandr collected content information. Am. Compl. ¶ 66. 24 Without Consent. Healthline does not contest that Gliksman has adequately pleadedthe 25 “without consent” requirement, and so the Court does not analyze this prong. 26 In Transit. An eavesdropper must read a communication “while the same is in transit or 27 passing over any wire, line, or cable, or is being sent from, or received at any place within this 1 Pixels in Healthline.com to track and simultaneously transmit information in real time from 2 California website visitors, such as Plaintiff and the Class.” Am. Compl. ¶ 70; see also id. ¶¶ 12, 3 61, 105, 111. Healthline contends that this allegation is conclusory, and therefore, inadequate to 4 establish real-time interception in California. Dkt. No. 51 at 27-29 (citing Valenzuela v. Keurig 5 Green Mountain, Inc., 674 F. Supp. 3d 751, 758-59 (N.D. Cal. 2023)). 6 But Gliksmanalleges facts that support his contention. For example, he avers that the 7 TikTok Pixel “works by automatically collecting additional information from visitors who interact 8 with a business’s website or app” and that “[w]hen Healthline requests information such as name, 9 date of birth and address, this data is simultaneously sent to TikTok.” Am. Compl. ¶¶ 38, 39. 10 Gliksman also includes screenshots in his complaint that show the information a user puts into 11 Healthline.com is transmitted in real time. See id. ¶¶ 40-42, 47-48, 54-55; Dkt. No. 56 at 25 12 (citing screenshots to support this contention). Thus, Gliksman’s allegations are not merely 13 conclusory, as Healthline contends, and he has adequately alleged that the Pixels intercepted his 14 data in real time in California. 15 In summary, Gliksman has adequately pleaded a clause four violation of Section 631(a). 16 IV. CONCLUSION 17 For the foregoing reasons, the Court GRANTS IN PART and DENIES IN PART 18 Healthline’s motion to dismiss. Gliksman’s claims that Healthline violated clauses one, two, and 19 three of CIPA Section 631(a) fail as a matter of law andare therefore dismissed without leave to 20 amend. See Foman v. Davis, 371 U.S. 178, 182 (1962) (holding leave to amend may be denied 21 due to “futility of amendment”). Otherwise, Healthline’s motion to dismiss is denied. 22 On April 29, 2026, the Court related this action to Rodriguez v. Healthline Media, 24-cv- 23 8650. See Dkt. No. 68. Rodriguez is stayed pending resolution of the Gliksman motion to 24 dismiss. Accordingly, the Gliksman parties SHALL meet and confer with the Rodriguez parties 25 and, within seven days, file a stipulation with a suggested date for case management conferences 26 to be held in both cases. To be clear, the Court intends to set the conferences on the same date. 27 Should the Rodriguez parties believe a different course is needed, they shall explain their logic. ] file an administrative motion to seal no later than June 30, 2026. Should the parties fail to file a 2 || motion to seal, this Order will be posted publicly on the docket. 3 IT IS SO ORDERED. 4 Dated: June 23, 2026 5 = 6 Lea gate fk 7 United States District Judge 8 9 10 1] 3 12
13 «44
15 16
2 18 19 20 2] 22 23 24 25 26 27 28