Jane Doe, on behalf of herself and others similarly situated v. CRH Healthcare, LLC, d/b/a Peachtree Immediate Care, et al.

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF GEORGIA ATLANTA DIVISION

JANE DOE, on behalf of herself and

others similarly situated,

Plaintiff,

v. CIVIL ACTION FILE

NO. 1:25-CV-6353-TWT CRH HEALTHCARE, LLC, d/b/a

Peachtree Immediate Care, et al.,

Defendants.

OPINION AND ORDER

This is a privacy case. It is before the Court on the Defendants’ Motion to Dismiss [Doc. 26]. As set forth below, the Defendants’ Motion to Dismiss [Doc. 26] is GRANTED. I. Background1 This case centers around medical privacy concerns related to Google tracking and data collection tools. The Defendants own and control a website with the domain https://www.peachtreemed.com/ (the “Website”). (Am. Compl. ¶ 2 [Doc. 22]). They use the Website to connect the Plaintiff and other patients to the Defendants’ digital healthcare platforms with the goal of increasing profits. ( ¶ 31). In furtherance of that goal, they installed Google tracking and data collection tools on the Website for marketing and analytical purposes.

1 The Court accepts the facts as alleged in the Amended Complaint as true for purposes of the present Motion to Dismiss. , 941 F.3d 1116, 1122 (11th Cir. 2019). ( ¶¶ 3-4, 32). The Defendants use two Google programs to collect data from individuals arriving at their website. The first is Google Analytics. Google

Analytics is designed to capture and transmit a wide range of user interactions, including page views, search queries, button clicks, form submissions, transaction details, and error events, providing the Defendants with real-time reporting on patient activity. ( ¶ 38). By default, Google Analytics collects IP addresses, device/browser identifiers, and referral URLs, linking these with specific actions taken on the site. ( ¶ 39). It also records acquisition data,

showing whether a patient arrived via search, referral, or advertising, and engagement data, including the pages viewed, forms completed, and time spent on sensitive treatment-related pages. ( ). It does so by using certain “cookies”2 that contain a unique client identifier used to distinguish each user on the Website. ( ¶¶ 43-45). Next is Google DoubleClick. Google DoubleClick is Google’s advertising technology platform that uses tracking pixels and “cookies” to collect

information about users’ browsing behavior across websites. ( ¶ 46). When

2 A “cookie” in this context is defined as “a small file or part of a file stored on an Internet user’s computer, created and subsequently read by a website server, and containing personal information (such as a user identification code, customized preferences, or a record of pages visited).” , Merriam-Webster.com Dictionary, https://merriam- webster.com/dictionary/cookie (last visited Jul. 15, 2026). 2 a user visits a website that has Google DoubleClick tracking code installed, like the Website, DoubleClick drops cookies on the user’s browser to track their activity, which allows Google to identify and track individual users as they

move across different websites, building detailed profiles of their interests, behaviors, and demographics. ( ¶ 47). This information, in turn, allows Google to enable targeted advertising, allowing the Defendants to display personalized advertisements. ( ¶ 48). Despite enabling these tracking tools, the Defendants encouraged and/or required patients to use the Website to, among other things, “book

medical appointments, locate treatment facilities, pay bills, search medical specialties and treatment options, obtain telehealth services, and more.” ( ¶ 2). Any protected health information (“PHI”) and personally identifying information (“PII”) entered by these patients is shared with Google through their tracking tools. ( ¶¶ 3-4). This sharing occurred without the written authorization of the Plaintiff or other patients using the Website. ( ¶ 8). This is in stark contrast to the Defendants’ express promise to patients on the

Website that the Defendants would not disclose their PHI outside of their written authorization. ( ¶ 4). The Plaintiff is one such patient. She is an individual who used the Website to seek confidential treatment for a urinary tract infection. ( ¶ 16). She scheduled an appointment at the Sharpsburg location of Defendant

3 Peachtree Immediate Care UC, LLC (“Peachtree Immediate Care”) on the Defendants’ website. ( ). In order to book the appointment, the Plaintiff was required to provide extensive personal and medical information, including

stating her reason for seeking care, submitting identifying details such as her full name, date of birth, sex assigned at birth, telephone number, and email address. ( ). The Plaintiff expected that her online communications and disclosures with the Defendants were solely between herself and the Defendants and that such communications and disclosures would not be transmitted to or disclosed to a third party, including Google. ( ¶ 18).

Information entered by the Plaintiff as well as other potential class members, like their appointments, their selected locations, and details about their URL navigations, were disclosed to Google. ( ). Accordingly, the Plaintiff filed her Complaint with this Court with the intention of bringing a class action and brings claims against the Defendants for: (1) negligence and negligence per se; (2) breach of fiduciary duty; (3) breach of implied contract; (4) breach of express contract; (5) unjust enrichment; and (6) violations of the Electronic

Communications Privacy Act (“ECPA”). ( ¶ 13). II. Legal Standard A complaint should be dismissed under Rule 12(b)(6) only where it appears that the facts alleged fail to state a “plausible” claim for relief. , 556 U.S. 662, 678 (2009); Fed. R. Civ. P. 12(b)(6). A complaint may

4 survive a motion to dismiss for failure to state a claim; however, even if it is “improbable” that a plaintiff would be able to prove those facts; even if the possibility of recovery is extremely “remote and unlikely.”

, 550 U.S. 544, 556 (2007). In ruling on a motion to dismiss, the Court must accept the facts pleaded in the complaint as true and construe them in the light most favorable to the plaintiff. , 711 F.2d 989, 994-95 (11th Cir. 1983); , 40 F.3d 247, 251 (7th Cir. 1994) (noting that at the pleading stage, the plaintiff

“receives the benefit of imagination”). Generally, notice pleading is all that is required for a valid complaint. , 753 F.2d 974, 975 (11th Cir. 1985). Under notice pleading, the plaintiff need only give the defendant fair notice of the plaintiff’s claim and the grounds upon which it rests. , 551 U.S. 89, 93 (2007) (citing , 550 U.S. at 555). III. Discussion

The Defendants advance several arguments in support of their Motion to Dismiss. The Court takes each in turn. A. Cognizable Losses (Counts 1-5) The Defendants argue that the Plaintiff fails to plead a cognizable loss as to her negligence, breach of contract, breach of fiduciary duty, and unjust

5 enrichment claims. (Br. in Supp. of Defs.’ Mot. to Dismiss, at 5 [Doc. 26-1]). Under Georgia law, the elements of a negligence claim are: “(1) a legal duty to conform to a standard of conduct raised by the law for the protection of others

against unreasonable risks of harm; (2) a breach of this standard; (3) a causal connection between the conduct and the injury; and (4) ” , 315 Ga. App. 214, 219 (2012) (citation modified).3 The elements of a breach of contract claim are: “(1) breach and the (2) (3) to the party who has the right to complain about the contract being broken.” , 321 Ga. App.

584, 590 (2013) (citation modified). The elements of a breach of fiduciary duty claim are: “(1) the existence of a fiduciary duty; (2) breach of that duty; and (3) ” , 325 Ga. App. 194, 201 (2013) (citation modified). Finally, for a plaintiff to state a claim for unjust enrichment, she must show: (1) that there is no legal contract, (2) that the plaintiff conferred a benefit to the defendant, (3) that the plaintiff would suffer if the plaintiff was not

3 Negligence per se is a subset of a negligence claim. As codified under Georgia law, “[w]hen the law requires a person to perform an act for the benefit of another or to refrain from doing an act which may injure another, although no cause of action is given in express terms, the injured party may recover for the breach of such legal duty if he suffers damage thereby.” O.C.G.A. § 51-1-6. In other words, where case law does not impose a duty on a defendant to protect a plaintiff from negligence, a statute may create a duty and satisfy the duty element of negligence. Negligence per se does not modify any of the other elements of the claim. 6 compensated for the conferral of a benefit, and (4) it is equitable for the defendant to compensate the plaintiff. , 299 Ga. App. 440, 449 (2009). In other words, each of the four claims require there

to be a cognizable loss suffered by the Plaintiff in order to recover. The question, then, is whether “the disclosure of Plaintiff’s and Class Members’ Private Information to Google” constitutes a cognizable loss under these causes of action. (Am. Compl. ¶ 173; ¶¶ 132-33, 139, 142, 144-49, 172, 178). This Court has already once concluded that such information does not constitute a loss. In , the plaintiffs

similarly brought suit alleging that the defendants’ use of Meta Pixel, a tracking tool installed to optimize their advertising and marketing, collected PII and PHI when the plaintiffs visited the defendants’ website for medical purposes and also collected information from their patient portal. 2024 WL 3972984, at *1 (N.D. Ga. Aug. 28, 2024). Meta Pixel’s collection of this information led to the plaintiffs filing their complaint alleging claims of (1) invasion of privacy, (2) breach of fiduciary duty, (3) negligence, (4) breach

of contract, (5) unjust enrichment, and (6) violations of the ECPA. ; ( Am. Compl. ¶ 124-90 (alleging the same underlying claims with the exception of invasion of privacy)). The plaintiffs identified their damages as arising out of (1) invasion of privacy, including increased spam and targeted advertising, (2) loss of

7 confidentiality, (3) embarrassment, emotional distress, humiliation, and loss of enjoyment of life, (4) lost time and opportunity costs associated with mitigation, (5) loss of benefit of the bargain, (6) diminution of value of their

private information, and (7) the continued and ongoing risk to their private information. , 2024 WL 3972984 at *3. The defendants challenged whether these injuries were cognizable losses under breach of fiduciary duty, negligence, breach of contract, and unjust enrichment. In addressing this question, this Court noted that the growing body of case law within this district has “foreclosed certain types of damages claims, like the

ones the [p]laintiffs make here, in cases involving alleged data privacy breaches.” (citing , 2022 WL 3699967, at *2-5 (N.D. Ga. Jul. 22, 2022), then citing , 2018 WL 1465766, at *4 (N.D. Ga. Mar. 12, 2018)). Specifically, the Court took issue with the following attributes of the plaintiffs’ alleged injuries: These damages are alleged in the identical conclusory fashion for each of the identified [p]laintiffs. No facts are alleged that any of the [p]laintiffs have actually suffered any of these damages. No facts are alleged that would explain how receiving targeted advertisements from Facebook and [Defendant] Piedmont would plausibly cause of the [p]laintiffs to suffer these damages. This is not a case where the [p]laintiffs’ personal information was stolen by criminal hackers with malicious intent. The [p]laintiffs received targeted advertisements because they are Facebook users and have Facebook IDs.

8 Ultimately, this Court concluded that such damages are not actionable under breach of fiduciary duty, negligence, breach of contract, or unjust enrichment theories, in line with several cases nationally. at *3-4 (citing

, 899 F. Supp. 2d 331, 339-40 (E.D. Pa. 2012)(discussing the fact that “[o]ther district courts examining the issue have found that the collection and sale of this kind of information does not carry a compensable value to consumers, and cannot sustain a finding of injury without a specific showing that the plaintiff has sustained a resulting loss.”). Since this Court’s decision in , courts within this district

have not changed their tune. , 799 F. Supp. 3d 1268, 1275-76 (N.D. Ga. 2025) (reviewing and relying on the case to conclude that the plaintiffs failed to adequately allege damages for their breach of fiduciary duty claim). In this case, the Plaintiff argues that she has adequately alleged a cognizable loss because the Amended Complaint alleges privacy harms both traditionally recognized in Georgia as well as statutorily recognized within the

ECPA. ( Pl.’s Br. in Opp’n to Defs.’ Mot. to Dismiss, at 5-6 [Doc. 30]). She also argues that she has alleged harms arising out of emotional distress embarrassment, humiliation, and loss of enjoyment of life. ( at 6).4 But both

4 Curiously, the Plaintiff portrays her arguments as establishing that the Plaintiff’s claims meet Article III standing requirements of injury-in fact. ( at 5-6). But the Defendants’ arguments are made under a Rule 12(b)(6) 9 and explicitly hold that, even if such categories of damages were actionable, they cannot be pled in a conclusory or speculative manner. , 2024 WL 3972984 at *3;

, 799 F. Supp. 3d at 1275-76. This is especially true where a plaintiff makes “general allegations of ‘physical and emotional damage’” and must connect the facts pled in bulk to the specific moments where damages arose in this category. , 799 F. Supp. 3d at 1276 (quoting , 806 F. App’x 847, 850 (11th Cir. 2020)).

Like and , this is a data privacy case not predicated on a hacker’s data breach. Acknowledging this similarity, the Plaintiff fails to make this necessary link within her Amended Complaint to prop up her claims for negligence, breach of fiduciary duty, breach of contract, and unjust enrichment. None of the Plaintiff’s allegations explain what damages the Plaintiff or other potential class members actually

motion to dismiss for failure to state a claim, not a Rule 12(b)(1) motion to dismiss for lack of subject-matter jurisdiction. , 2024 WL 6981206, at *1 (N.D. Ga. Dec. 27, 2024) (“‘Because standing is jurisdictional, a motion [to] dismiss for lack of standing is treated as a motion under Rule 12(b)(1) … [.]’ , 524 F. 3d 1229, 1232 (11th Cir. 2008).”). Indeed, the Court views the Defendants’ arguments as addressing a key element of each of the state-law claims rather than asserting that the Plaintiff has no standing at all. In any case, the Court addresses the Plaintiff’s arguments as if they were made under Rule 12(b)(6). 10 suffered from the Defendants’ actions. The Plaintiff merely defers to a jury, but without anything more, the deferral fits the bill for speculative damages. Indeed, the Court is unsure if the Plaintiff argues her loss of privacy category

of damages arises under a theory of diminution of value or under a theory of information misuse. Even if asserted, this would not succeed in this district. , 2024 WL 3972984 at *3; , 799 F. Supp. 3d at 1275-76. The only discussion of actual damages happens in a boilerplate fashion at the end of each count and is not connected to the facts of the Amended Complaint. ( Am. Compl. ¶¶ 132, 139, 142, 148-49, 172, 178).

This is not sufficient to survive dismissal. Thus, the Plaintiff has failed to plead a cognizable loss for Counts 1-5. These claims are dismissed without prejudice. , 2024 WL 3972984 at *3 (“Accordingly, the [p]laintiffs’ claim for breach of fiduciary duty should be dismissed without prejudice.”). B. ECPA Claim (Count 6) The Plaintiff’s remaining claim arises out of Section 2511. Under that

criminal statute, any person who “intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication” or “intentionally discloses, or endeavors to disclose, to any other person the contents of any wire, oral, or electronic communication, knowing or having reason to know that the

11 information was obtained through the interception of a wire, oral, or electronic communication” is in violation of the ECPA. 18 U.S.C. §§ 2511(1)(a), (c). The ECPA also provides a private right of action for violations of the statute. 18

U.S.C. § 2520(a). The Defendants argue for dismissal of the claim for a few reasons. First, they argue that they are a “party” to the communication and thus are exempted from the ECPA. ( Br. in Supp. of Defs.’ Mot. to Dismiss, at 20-23). Second, they argue that, even if the “party” exception does not apply, the Plaintiff does not allege sufficient facts that show that the information communicated was “contents” under the ECPA. ( at 24-25). Because the

party exception applies to the Defendants, the Court need not address the second argument. The ECPA states that it shall not be unlawful “for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication . . . unless such communication is intercepted for the purpose of committing any criminal or tortious act.” 18 U.S.C. § 2511(2)(d). The party exception is an exception, not the rule. Although

a plaintiff generally bears the burden of establishing a violation of the ECPA, a defendant has the burden of establishing that the party exception applies. , 329 F.3d 9, 19 (1st Cir. 2003); , 2025 WL 1456757, at *1 (M.D. Fla. May 21, 2025) (reiterating a prior holding within the criminal case that the “party exception” was a defense to a violation

12 of the FWA instead of an element of the offense, shifting the burden to the defense). The parties do not dispute whether the Defendants were parties to the

communications. Indeed, this is because the Amended Complaint makes it clear that the Defendants were the intended recipients of the Plaintiff’s communications in order to obtain health services. However, they do dispute whether the crime-tort exception, an exception to the party exception, applies. “[T]he ECPA’s so-called ‘crime-tort’ exception allows a plaintiff to state a claim under the ECPA in spite of a defendant’s consent to the communications, if the

plaintiff plausibly alleges that the communications were ‘intercepted for the purpose of committing any criminal or tortious act.’” , 824 F. Supp. 3d 1257, 1269 (S.D. Fla. 2026) (quoting 18 U.S.C. § 2511(2)(d)). Previous decisions applying the crime-tort exception to similar facts are admittedly inconsistent within this district. In , this Court held that the plaintiffs failed to plead that the crime-tort exception

applies after conducting a review of how other circuits addressed similar website tracking cases and finding that the weight of authority favors dismissal. , 2024 WL 3972984 at *4. A year later, Judge Boulee took a different approach and concluded that the plaintiffs adequately pled that the crime-tort exception could apply because the plaintiffs

13 alleged that the defendants affirmatively included tracking tools on their website and that such an action suggested either a criminal or tortious intent to disclose private information before the plaintiffs’ information was

intercepted. , 799 F. Supp. 3d at 1278-79. To resolve the issue, the Court finds the Third Circuit’s decision in , 806 F.3d 125 (3d Cir. 2015), to be instructive. There, the plaintiffs brought suit in part under the same provision of the ECPA against the defendants for their use of tracking cookies on their website. at 130-34. After resolving that the party

exception applied to the ECPA claim, the court then considered whether the crime-tort exception applied. at 144-45. Reviewing authority from the Second, Seventh, and Ninth Circuits to understand what torts implicate the crime-tort exception, the Third Circuit concluded that the tortious act alleged must not arise out of the wiretapping itself but must be secondary to the action. at 145, 145 n. 8. In other words, the Third Circuit explained, the tort must be independent of the intentional act of recording. at 145. Applying this rule

to the facts alleged, the Third Circuit concluded that the plaintiffs failed to invoke the crime-tort exception because they failed to plead any tortious or criminal use of the intercepted data. As this Court acknowledged previously in , the weight of authority on the party exception supports this conclusion. , 2024 WL 3972984 at *4

14 (collecting cases). Acknowledging the requirements of the crime-tort exception, the Court ultimately holds that the Plaintiff fails to plead sufficient facts to avoid application of the party exception. Even if the Court assumes that the Plaintiffs state law claims survive, the tortious actions are not separate from the predicate wiretap itself. It is that action that forms the center of the breach of fiduciary duty and negligence claims and the Plaintiff does not argue otherwise. If not for this requirement, the Court would agree with Judge Boulee that the Plaintiff properly pled the crime-tort exception. But the weight of authority on the crime-tort exception follows this rule when considering the ECPA. See Piedmont Healthcare, 2024 WL 3972984 at *4 (collecting cases). Therefore, the Court dismisses the Plaintiffs ECPA claim without prejudice. IV. Conclusion For the foregoing reasons, the Defendants’ Motion to Dismiss [Doc. 26] is GRANTED. If the Plaintiff does not file a Second Amended Complaint within fourteen (14) days of this Order, this dismissal will be with prejudice. SO ORDERED, this 29th day of July, 2026.

T terns, □□□ dlvn THOMAS W. THRASH, JR. United States District Judge