1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 JONATHAN LYNCH, Case No. 23-cv-01170-AMO
8 Plaintiff, ORDER RE MOTION TO DISMISS v. 9 Re: Dkt. No. 54 10 EXPRESS SCRIPTS HOLDING COMPANY, 11 Defendant.
12 13 This is a putative class action arising from Plaintiff Jonathan Lynch’s use of Defendant 14 Express Scripts Holding Company’s online pharmacy. Now pending before the Court is Express 15 Scripts’ motion to dismiss Lynch’s second amended complaint. Lynch opposes the motion. The 16 Court, having considered the parties’ papers and the relevant legal authority, GRANTS the motion 17 IN PART and DENIES the motion IN PART for the reasons set forth below. 18 I. BACKGROUND1 19 Express Scripts is a pharmacy benefits manager serving over 100 million consumers. 20 ECF 51 (“SAC”) ¶ 33. The company runs an online pharmacy, through which it handles millions 21 of prescriptions each year. Id. ¶ 36. 22 The Express Scripts website – www.express-scripts.com – uses the Facebook Pixel. Id. ¶¶ 23 1, 74. The Pixel is a piece of code that allows Facebook to surreptitiously intercept an individual’s 24 communications with a website, including include page views, button and mouse clicks, names of 25 buttons clicked, microdata, mouse hovers, scrolling, and “other observable website interactions, 26 1 This background is based on the allegations in Lynch’s second amended complaint, which are 27 taken as true and construed in the light most favorable to him for the purpose of this motion. 1 selections, and communications.” Id. ¶¶ 46, 75-76. Once a user takes any action on the Express 2 Scripts website, such as clicking a button to register, login, or logout of the customer portal, the 3 Facebook Pixel commands the visitor’s device to re-direct the communication between the user 4 and the website to Facebook in real-time. Id. ¶¶ 51, 52. The technology relies on Facebook 5 cookies,2 which enable the company to match a website visitor to that person’s Facebook account. 6 Id. ¶ 49. The Pixel allows developers to measure, optimize, and build audiences for ad campaigns 7 on and off Facebook, which translates to ad revenue for Meta. Id. ¶¶ 29, 31, 42-46. 8 Because the Facebook Pixel was installed on the Express Scripts website, every time 9 Lynch visited the site between April 2022 and December 20223 to obtain prescriptions to treat low 10 insulin and testosterone levels, Facebook received information about the pages and content Lynch 11 viewed, what he clicked on, as well as “mouse clicks and movements, keystrokes, search items, 12 information inputted, pages and content viewed, scroll movements, and copy and paste actions.4 13 Id. ¶¶ 20, 77. In order to obtain his prescriptions through the site, Lynch had to enter his name, 14 email, address, phone number, payment information, date of birth, gender, insurance information, 15 16 2 Facebook uses the “c-user, datr, fr, and fbp” cookies, with browser attribute information, to 17 fingerprint a user’s device. Id. ¶¶ 27, 58. Each Facebook user has a unique c-user cookie value, which “is the Facebook equivalent of a user identification number.” Id. ¶ 59. The datr cookie 18 “identifies [a] person’s specific web browser from which the person is sending the communication” and “is unique to the person’s specific web browser.” Id. ¶ 63. The fr cookie “is 19 an encrypted combination of the c_user and datr cookies.” Id. ¶ 67 (footnote omitted). The fbp cookie “masquerades as a first-party cookie to evade third party cookie blockers and share data 20 more directly between a website that has deployed Pixel and Facebook.” Id. ¶ 68 (footnote omitted). 21 3 During that period, Lynch also had a Facebook account. Id. ¶¶ 20, 71. He used the same device 22 to access both his Facebook account and the Express Scripts website. Id. ¶ 20.
23 4 Using publicly available third-party software, Lynch tested web traffic between a computer, operating the Google Chrome browser, and the Express Scripts Platform. Id. ¶¶ 93-95. The 24 testing revealed that the Express Scripts Platform “affirmatively interacted in the background with 25 Facebook servers at least 16 times, 3 of which were connections to Facebook servers and 13 were ‘GET’ requests from Facebook servers.” Id. ¶ 96. A GET request “serves two purposes: it first 26 tells the website what information is being requested and then instructs the website to send the information back to the user. The GET request also transmits a referer header containing the 27 personally-identifiable URL information.” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 1 and a diagnosis history for his testosterone prescription, which is a controlled substance. Id. ¶ 20. 2 Lynch did not consent to the sharing and interception of this data. Id. Had he known that Express 3 Scripts used the Facebook Pixel to monitor and share his personal and other sensitive information 4 with third parties, Lynch would never have used the Express Scripts Platform5 or shared his 5 information to Express Scripts. Id. 6 Based on the alleged interception and sharing of his personal and other sensitive 7 information, Lynch asserts claims for violations of (1) the Wiretap Act, 18 U.S.C. § 2510, et seq., 8 (2) the California Invasion of Privacy Act, (“CIPA”), Cal. Pen. Code § 631, and (3) the California 9 Confidentiality of Medical Information Act (“CMIA”), Cal. Civ. Code § 56, et seq. SAC ¶¶ 126- 10 132, ¶¶ 133-150, ¶¶ 151-164. Lynch seeks to assert these claims on behalf of himself and a class 11 of “[a]ll natural persons in the United States who used the Express Scripts Platform and whose 12 communications and/or data were shared with third parties, including Facebook[,]” and “[i]n 13 addition, or in the alternative,” a subclass of “[a]ll natural persons in the State of California who 14 used the Express Scripts platform and whose communications and/or data were shared with third 15 parties, including Facebook.” Id. ¶ 111. 16 II. LEGAL STANDARDS 17 A. Motion to Dismiss for Failure to State a Claim 18 To overcome a Rule 12(b)(6) motion to dismiss, the factual allegations in the plaintiff’s 19 complaint “ ‘must . . . suggest that the claim has at least a plausible chance of success.’ ” Levitt v. 20 Yelp! Inc., 765 F.3d 1123, 1135 (9th Cir. 2014) (quoting In re Century Aluminum Co. Sec. Litig., 21 729 F.3d 1104, 1107 (9th Cir. 2013) (alterations in original)). In ruling on a Rule 12(b)(6) motion, 22 courts “accept factual allegations in the complaint as true and construe the pleadings in the light 23 most favorable to the nonmoving party.” Manzarek, 519 F.3d at 1031. 24 “[A]llegations in a complaint . . . may not simply recite the elements of a cause of action, 25 but must contain sufficient allegations of underlying facts to give fair notice and to enable the 26 opposing party to defend itself effectively.” Levitt, 765 F.3d at 1135 (quoting Starr v. Baca, 652 27 1 F.3d 1202, 1216 (9th Cir. 2011)). The court may dismiss a claim “where there is either a lack of a 2 cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal claim.” 3 Hinds Invs., L.P. v. Angioli, 654 F.3d 846, 850 (9th Cir. 2011) (citing Johnson v. Riverside 4 Healthcare Sys., LP, 534 F.3d 1116, 1121 (9th Cir. 2008)). “[T]he non-conclusory ‘factual 5 content’ and reasonable inferences from that content must be plausibly suggestive of a claim 6 entitling the plaintiff to relief.” Moss v. U.S. Secret Service, 572 F.3d 962, 969 (9th Cir. 2009). 7 When deciding whether to grant a motion to dismiss, the court generally “may not consider 8 any material beyond the pleadings.” Hal Roach Studios, Inc. v. Richard Feiner & Co., 896 F.2d 9 1542, 1555 n.19 (9th Cir. 1990). However, the court may consider material submitted as part of 10 the complaint or relied upon in the complaint and may also consider material subject to judicial 11 notice. See Lee v. City of Los Angeles, 250 F.3d 668, 688-89 (9th Cir. 2001). 12 B. Request for Judicial Notice/Incorporation by Reference 13 A district court may take judicial notice of facts that are “not subject to reasonable dispute” 14 because they are (1) “generally known within the trial court’s territorial jurisdiction,” or (2) “can 15 be accurately and readily determined from sources whose accuracy cannot reasonably be 16 questioned.” Fed. R. Evid. 201(b); see United States v. Bernal-Obeso, 989 F.2d 331, 333 (9th Cir. 17 1993). “Accordingly, ‘[a] court may take judicial notice of matters of public record.’ ” Khoja v. 18 Orexigen Therapeutics, Inc., 899 F.3d 988, 999 (9th Cir. 2018) (quoting Lee, 250 F.3d at 688). A 19 court cannot, however, “take judicial notice of disputed facts contained in such public records.” 20 Id. 21 “Unlike rule-established judicial notice, incorporation-by-reference is a judicially created 22 doctrine that treats certain documents as though they are part of the complaint itself. The doctrine 23 prevents plaintiffs from selecting only portions of documents that support their claims, while 24 omitting portions of those very documents that weaken – or doom – their claims.” Id. at 1002. 25 “Although the incorporation-by-reference doctrine is designed to prevent artful pleading by 26 plaintiffs, the doctrine is not a tool for defendants to short-circuit the resolution of a well-pleaded 27 claim.” Id. at 1003. 1 In applying this standard, the Ninth Circuit instructs: 2 When a general conclusion in a complaint contradicts specific facts 3 retold in a document attached to the complaint, incorporated by reference in the complaint, or subject to judicial notice, those 4 specific facts are controlling. Similarly, where a complaint incorrectly summarizes or characterizes a legally operative 5 document attached to the complaint, incorporated by reference in the complaint, or subject to judicial notice, the document itself is 6 controlling. . . . But if specific facts alleged in the complaint 7 contradict specific facts related in a non-legally-operative document attached to the complaint, incorporated by reference in the 8 complaint, or subject to judicial notice, the conflict is resolved in the plaintiff’s favor. 9 10 In re Finjan Holdings, Inc., 58 F.4th 1048, 1052 n.1 (9th Cir. 2023) (citations omitted). 11 III. DISCUSSION 12 The Court will first take up Express Scripts’ request for judicial notice, ECF 55 (“RJN”), 13 before turning to the motion to dismiss. 14 A. Request for Judicial Notice/Incorporation by Reference 15 Express Scripts asks that the Court take judicial notice of two sets of exhibits. RJN at 2-3. 16 The first set, labeled Exhibits A-E, are attached to the declaration of Matthew Edwards, ECF 54-9, 17 and include: 18 • Exhibit A: A screenshot that appeared during the registration process for Express- 19 Scripts.com from April 2022 to December 2022. 20 • Exhibit B: The Privacy Policy that appeared on Express-Scripts.com and was 21 hyperlinked as part of the registration process for Express-Scripts.com from April 2022 22 to December 2022. 23 • Exhibit C: The Terms of Use that appeared on Express-Scripts.com and were 24 hyperlinked as part of the registration process for Express-Scripts.com from April 2022 25 to December 2022. 26 • Exhibit D: Screenshots that appeared during the in-application iOS registration process 27 in the Express Scripts’ iOS application from April 2022 to December 2022, reflecting 1 • Exhibit E: Screenshots that appeared during the in-application Android registration 2 process for Express Scripts’ Android application from April 2022 to December 2022, 3 reflecting the light and dark modes of Android phones. 4 Edwards Decl. ¶¶ 4-8. 5 The second set, labeled Exhibits A-G, are attached to the declaration of Tiffany Cheung, 6 ECF 54-1, and include: 7 • Exhibit A: Meta’s Privacy Policy, effective July 26, 2022, archived by the Internet 8 Archive’s Wayback Machine on May 27, 2022. 9 • Exhibit B: Meta’s Terms of Service, as revised on January 4, 2022, archived by the 10 Internet Archive’s Wayback Machine on March 20, 2022. 11 • Exhibit C: Meta’ s Terms of Service, as revised on July 26, 2022, archived by the 12 Internet Archive’s Wayback Machine on December 31, 2022. 13 • Exhibit D: Meta’s Cookies Policy, effective January 4, 2022, archived by the Internet 14 Archive’s Wayback Machine on November 3, 2022. 15 • Exhibit E: Meta’s Cookies Policy, effective October 5, 2022, archived by the Internet 16 Archive’s Wayback Machine on December 15, 2022. 17 • Exhibit F: Facebook Help Center: How do I manage my future off-Facebook activity? 18 • Exhibit G: Facebook Help Center: Review your off-Facebook activity. 19 Cheung Decl. ¶¶ 2-8. 20 While Lynch objects to Express Scripts’ request for judicial notice on the ground that these 21 documents’ “accuracy can reasonably be questioned,” Opp. at 11 n.1, the Court nonetheless takes 22 judicial notice of the existence of these documents. It does not, however, consider the documents 23 beyond that. See In re Meta Pixel Tax Filing Cases, 724 F. Supp. 3d 987, 1001 (N.D. Cal. 2024) 24 (“This notice is limited to the existence and contents of this July 26, 2022 version of Meta’s terms 25 of service. The Court cannot conclude from Meta’s submission that this was the version in effect 26 during the period relevant to plaintiffs’ claims, or that plaintiffs ever assented to the terms 27 therein.”). The Court also declines to deem the documents incorporated by reference. While the 1 Scripts seeks to do here, as a “tool for defendants to short-circuit the resolution of a well-pleaded 2 claim.” See Khoja, 899 F.3d at 1003. 3 B. Motion to Dismiss 4 Express Scripts moves to dismiss Lynch’s second amended complaint with prejudice, 5 arguing that he fails to satisfy applicable pleading standards, that he consented to the data 6 collection that is the basis of his claims, and that those claims independently fail on the merits for 7 other reasons. Mot. at 16-31. The Court first turns to the sufficiency of Plaintiffs’ allegations 8 before reaching the claim-specific arguments Express Scripts advances in its motion. 9 1. Adequacy of Allegations 10 Express Scripts attacks the sufficiency of Lynch’s allegations on three grounds. It argues 11 that Lynch’s allegations do not satisfy Rule 8 or Rule 9(b) and that Lynch has failed to cure the 12 deficiencies noted in the Court’s prior order of dismissal. Mot at 16-17. The Court addresses the 13 threshold pleading deficiencies discussed in that order before addressing Express Scripts’ 14 arguments about Rule 8 and Rule 9(b). 15 The Court dismissed Lynch’s first amended complaint due to a number of inconsistent 16 allegations. As relevant here, the Court’s prior order of dismissal determined that:
17 Lynch . . . fails to consistently allege the identity of the company responsible for the interception that is the subject of his complaint. 18 In some of his allegations, Lynch attributes the alleged wiretapping to Express Scripts. See, e.g., ECF 31 ¶ 88 (alleging that Lynch 19 “reasonably expected that visits to Defendant’s website would be private, and that Defendant would not be intercepting or tapping 20 their communications with Defendant’s website . . . .”); see also id. ¶ 89 (alleging Lynch “reasonably believed . . . interactions with 21 Defendant’s website were private and would not be recorded or monitored for a later playback by Defendant, or worse yet, 22 monitored live while Plaintiff and Class Members were on its website.”); ¶ 93 (alleging that Express Scripts “surreptitiously 23 collected” Lynch’s communications “to gain an unlawful understanding of the habits and preferences of users to its websites,” 24 solely for Express Scripts’ own benefit); ¶ 94 (“Defendant’s use of the Facebook Pixel spyware to intercept Plaintiff’s and Class 25 Members’ electronic communications did not facilitate, was not instrumental, and was not incidental to the transmission of 26 Plaintiff’s and Class Members’ electronic communications with Defendant’s website.”). Elsewhere, Lynch alleges that Facebook is 27 intercepting the communications between him and the Express private electronic communications and transmissions by a third- 1 party, Facebook, when Plaintiff and other Class Members accessed Defendant’s website from within the State of California.”); see also 2 id. ¶ 166 (“Plaintiff and Class Members did not know Defendant was engaging in such interception by a third-party and therefore 3 could not provide consent to have any part of their private electronic communications intercepted with the aiding and abetting of 4 Defendant.”); ¶ 167 (“Plaintiff and Class Members were completely unaware that Defendant had assisted a third-party, Facebook, to 5 intercept and store electronic communications and other personal data until well after it had already occurred and were therefore 6 unable to consent.”). 7 ECF 48 (“Order”) at 1-2. 8 The second amended complaint does not cure this deficiency. As Express Scripts 9 highlights, Lynch alleges in paragraph 75 that “[t]he Facebook Pixel thereafter surreptitiously 10 intercepted and transmitted in real time to Facebook, without Plaintiff’s prior knowledge or 11 consent, a variety of private communications between Plaintiff and Defendant.” SAC ¶ 75. Other 12 paragraphs, however, allege Express Scripts intercepted those communications. In paragraph 83, 13 Lynch alleges “Defendant’s use of the Facebook Pixel to intercept Plaintiff’s electronic 14 communications and share them with Facebook was not instrumental or necessary to Defendant’s 15 provision of any of its goods or services.” Id. ¶ 83. Paragraph 84 likewise alleges “Defendant 16 utilized the Facebook Pixel to intercept the substance of Plaintiff’s . . . electronic communications 17 intentionally and contemporaneously share the information with Facebook, including mouse clicks 18 and movements, keystrokes, search terms, information inputted, pages and content viewed, scroll 19 movements, and copy and paste actions.” Id. ¶ 84. Paragraph 119 similarly attributes the 20 interception to Express Scripts: “Defendant intercepted and recorded the Class Member’s 21 electronic communications without . . . knowledge or consent.” Id. ¶ 119. In light of these 22 inconsistent allegations, Lynch has once again failed to provide Express Scripts fair notice of the 23 conduct giving rise to the federal and state wiretapping claims pleaded in the operative complaint. 24 But for this pleading deficiency, however, Lynch’s allegations otherwise withstand 25 Express Scripts’ pleading challenges. Federal Rule of Civil Procedure 8 requires a complaint to 26 include “a short and plain statement of the claim showing that the pleader is entitled to relief.” 27 Fed. R. Civ. P. 8(a)(2). Here, Lynch alleges that he used the Express Scripts Platform to obtain 1 entered his name, email, phone number, address, payment information, date of birth, gender, 2 insurance information, and a diagnosis history related to the testosterone prescription, which is a 3 controlled substance. Id. Lynch further alleges that the Facebook Pixel tracked his use of the 4 Express Scripts Platform, which communicated his confidential information. Id. Express Scripts 5 disclosed this information, without consent, to Facebook for financial gain. Id. ¶¶ 156, 159-160. 6 According to Lynch, this is the information “Facebook monetizes . . . . by using it to generate 7 highly profitable targeted advertising on-and-off Facebook.” These allegations satisfy Rule 8, and 8 as discussed in this order, plausibly state a claim for relief as required by Rule 12. See Meta 9 Healthcare Pixel Litig., 713 F. Supp. 3d 650, 655 (N.D. Cal. 2024) (declining to dismiss plaintiffs’ 10 privacy claims “simply because their communications with their healthcare providers may have 11 been through publicly available webpages” and finding claims sufficient to proceed to discovery 12 “given that plaintiffs were communicating with their healthcare providers about their healthcare 13 needs, plaintiffs have alleged enough . . . to proceed to discovery.”). 14 The Court rejects Express Scripts’ argument that Lynch must plead additional technical 15 details “connect[ing] the technology at issue to the purported health information captured[.]” Mot. 16 at 17 (citing Doe v. Google, 741 F. Supp. 3d 828 (N.D. Cal. 2024)). The pleading standard which 17 Express Scripts invokes imposes requirements beyond those that apply under Rule 8 and Rule 18 12(b)(6). See Doe v. FullStory, Inc., 712 F. Supp. 3d 1244, 1259 (N.D. Cal. 2024) (At the motion 19 to dismiss stage, “in the absence of discovery [about] how the TikTok Pixels actually work and 20 what information was tracked, it would be premature to hold that TikTok’s alleged tracking of the 21 various pages that plaintiff may have visited within Favor’s platform when seeking healthcare 22 services cannot constitute an invasion of privacy.”) (footnote omitted). To the extent Express 23 Scripts contends that the Meta Pixel can be configured in different ways on different web 24 properties such that Lynch’s sensitive information could not have been shared or intercepted, that 25 is a matter for consideration at summary judgment or trial. 26 The Court also rejects Express Scripts’ argument that allegations about it “ ‘secretly 27 deploy[ing]’ ” the Meta Pixel and “ ‘knowingly, actively, affirmatively and/or negligently 1 standard. See Mot. at 16 (citing SAC ¶¶ 20, 23, 140-143). The two decisions on which Express 2 Scripts relies do not persuade otherwise. Though the Doe v. Google court suggested that “by 3 insisting that Google’s admonitions to health care providers are part of a plot to steal private 4 health information from its clients, the plaintiffs may well be subjecting their intent-related 5 allegations to the heightened pleading standard of Federal Rule of Civil Procedure 9(b),” it did not 6 resolve the issue and instead found that the plaintiffs there did not satisfy rule 8. 741 F. Supp. 3d 7 at 841-42 (citations omitted). In Rodriguez v. Google, No. 20-cv-04688-RS, 2021 WL 2026726, 8 *6 (N.D. Cal. May 21, 2021), the court found that the plaintiffs’ allegations about secret scripts 9 Google deployed to collect data for a shadow version of Google Analytics were subject to Rule 10 9(b). In that case, the plaintiffs “walked back” their allegations of surreptitious collection at oral 11 argument, recharacterizing them as a challenge to whether Google adequately disclosed the use of 12 the technology at issue. Id. Unlike in Rodriguez, “[b]ecause [Lynch is] directly challenging [the] 13 alleged data collection rather than challenging any potentially fraudulent or misleading 14 representations about this collection, [his] claims do not sound in fraud and are not subject to Rule 15 9(b).” See Smith v. Google, LLC, 735 F. Supp. 3d 1188, 1198 (N.D. Cal. 2024). 16 Nonethless, because Lynch has failed to cure the inconsistent wiretapping allegations 17 described in the Court’s prior dismissal order, Express Scripts’ motion to dismiss is GRANTED 18 as to the federal and state wiretapping claims. The Court will allow Lynch one final opportunity 19 to cure those pleading deficiencies in a third amended complaint filed within 21 days of this order. 20 Having dismissed the wiretapping claims, the Court now turns to the remaining arguments 21 Express Scripts raises in its motion, to the extent relevant to Lynch’s remaining CMIA claim. 22 2. CMIA 23 The CMIA requires “[e]very provider of health care, health care service plan, 24 pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, 25 destroys, or disposes of medical information [to] do so in a manner that preserves the 26 confidentiality of the information contained therein.” Cal. Civ. Code § 56.101(a). 27 Express Scripts argues that Lynch’s claim under the CMIA fails because he “does not 1 medical information allegedly provided to Express Scripts was actually viewed by an unauthorized 2 third party.” Mot. at 28. Express Scripts also argues that dismissal is appropriate because Lynch 3 consented to the various terms and policies submitted with its request for judicial notice. Mot. at 4 17-19. The Court addresses each argument in turn. 5 a. Release of medical information 6 “Medical information” is “any individually identifiable information, in electronic or 7 physical form, in possession of or derived from a provider of health care, health care service plan, 8 pharmaceutical company, or contractor regarding a patient’s medical history, mental health 9 application information, reproductive or sexual health application information, mental or physical 10 condition, or treatment.” Cal. Civ. Code § 56.05(j). Medical information is “individually 11 identifiable” when it:
12 [I]ncludes or contains any element of personal identifying information sufficient to allow identification of the individual, such 13 as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone 14 or in combination with other publicly available information, reveals the identity of the individual. 15 16 Id. 17 Lynch alleges that he used the Express Scripts website “to obtain prescriptions to treat low 18 insulin and testosterone levels.” SAC ¶ 20. In order to use the website for that purpose, Lynch 19 “was required to enter his name, email address, phone number, address, and payment information. 20 He was also required to input further information, such as his date of birth, gender, insurance 21 information, and a diagnosis history related to the testosterone prescription, as it is a controlled 22 substance.” Id. These allegations are sufficient to establish that Lynch shared medical 23 information with Express Scripts.6 Indeed, in its opening brief, Express Scripts appears to 24 concede as much: “[t]hat Plaintiff alleges he entered medical information on some unidentified 25 page within Express Scripts’ website to place prescription orders is unsurprising; Express Scripts 26 provides online pharmacy services.” Mot. at 10. Additionally, Lynch’s allegations that Express 27 1 Scripts “deployed the Facebook Pixel software on its Platform,” SAC ¶ 74, and that the Pixel 2 “surreptitiously intercepted and transmitted in real time to Facebook . . . a variety of private 3 communications between [him] and [Express Scripts,]” id. ¶ 75, plausibly establish that Express 4 Scripts disclosed Lynch’s medical information. 5 The cases on which Express Scripts relies do not compel a different conclusion. For 6 example, in Smith v. Facebook, 262 F. Supp. 3d 943, 954 (N.D. Cal. 2017), “[n]othing about the 7 information” at issue “relate[d] specifically to Plaintiffs’ health.” Here, however, Lynch alleges 8 that he obtained prescriptions using the Express Scripts website for two specific medical 9 conditions and entered diagnosis history relating to at least one medication. SAC ¶ 20. In 10 Eisenhower Med. Ctr. v. Superior Court, 226 Cal. App. 4th 430, 437 (2014), the court concluded 11 “that under the CMIA a prohibited release by a health care provider must include more than 12 individually identifiable information but must also include information relating to medical history, 13 mental or physical condition, or treatment of the individual,” which as discussed above, is what 14 Lynch has plausibly alleged here. 15 For these reasons, Express Scripts’ motion to dismiss on the ground that Lynch has failed 16 to allege disclosure of his medical information within the meaning of the CMIA is DENIED. 17 b. Actual viewing 18 “[A] breach of confidentiality under the CMIA requires a showing that an unauthorized 19 party viewed the confidential information.” Vigil v. Muir Med. Grp. IPA, Inc., 84 Cal. App. 5th 20 197, 213 (2022). 21 Express Scripts argues that Lynch pleads “zero allegations in the amended complaint from 22 which it could be plausibly inferred that substantive medical information was actually viewed, or 23 that Plaintiff received any targeted advertisements following his use of the Express Scripts 24 website.” Mot. at 31. 25 In opposition, Lynch points to the following allegations in the SAC. “ ‘Facebook 26 monetizes the information it receives through the Facebook Pixel deployed on Defendant’s 27 Express-Scripts.com website by using it to generate highly-profitable targeted advertising on-and 1 ad campaigns to patients based on the specific actions those patients took on Defendant’s 2 website.” Opp. at 27 (quoting SAC ¶¶ 29, 31). Facebook generates revenue “ ‘almost entirely 3 from selling targeted advertising space on Facebook.com, and to all Internet users on non- 4 Facebook sites that integrate Facebook marketing source code on their websites.’ ” Id. (quoting 5 SAC ¶ 44). “ ‘The electronic communications intentionally intercepted and transmitted to 6 Facebook were content generated through Plaintiff’s use, interaction, and communication with 7 Defendant’s Platform relating to the substance, purport, and/or meaning of [Lynch’s] and Class 8 Members’ communications with the Platform. ’ ” Id. (quoting SAC ¶ 88). “ ‘The data collected 9 by the Facebook Pixel identified specific information inputted and content viewed, and transmitted 10 the same to Facebook for its aggregation, use, and sale to drive advertising. Information shared 11 revealed personalized and sensitive information about Plaintiff’s and Class Member’s internet 12 activity and habits.’ ” Id. (quoting SAC ¶ 87). “ ‘[T]he unauthorized interception and disclosure 13 of [Lynch’s] and Class Members’ sensitive electronic communications with Defendant . . . that in 14 turn allowed [Facebook] . . . to read, learn the contents of, make reports on [Lynch’s] and Class 15 Members’ interactions with Defendant’s Platform, and use the information for its own benefit.’ ” 16 Id. (quoting SAC ¶ 4). “ ‘Through the Facebook Pixel embedded in Defendant’s website, 17 Facebook was able to and did access sensitive personal and health information provided by 18 Plaintiff and Class Members to Express Scripts, and incorporated that accessed information into 19 its profiles of Plaintiff and Class Members.’ ” Id. (quoting SAC ¶ 70). 20 Viewing these allegations in the light most favorable to Lynch, the reasonable inference to 21 draw is that Meta actually viewed the information intercepted by its Pixel when building the user 22 profiles that sustain is advertising products. Discovery will afford the parties the opportunity to 23 test that inference, but at the pleading stage, it entitles Lynch to proceed on his CMIA claim. See 24 Cousin v. Sharp Healthcare, 702 F. Supp. 3d 967, 975 (S.D. Cal. 2023) (denying motion to 25 dismiss CMIA claim and finding it was “sufficiently plausible” that plaintiffs’ information was 26 “viewed or otherwise accessed” as defined by the CMIA where plaintiffs alleged upon information 27 and belief that “Meta regularly viewed” the information and that Meta’s business model involves 1 For these reasons, Express Scripts’ motion to dismiss the CMIA for lack of allegations of 2 actual viewing is DENIED. 3 c. Consent 4 Express Scripts also contends that dismissal is appropriate because Lynch consented to 5 Express Scripts’ use of pixel technology when he created an account on the Platform. Mot. at 17- 6 18. 7 Consent “can be [express] or implied, but any consent must be actual.” Calhoun v. 8 Google, LLC, 113 F.4th 1141, 1147 (9th Cir. 2024) (internal citations and quotations omitted; 9 modification in original). “For consent to be actual, the disclosures must ‘explicitly notify’ users 10 of the conduct at issue.” Id. (citation omitted). “[C]onsent is only effective if the person alleging 11 harm consented ‘to the particular conduct, or to substantially the same conduct’ and if the alleged 12 tortfeasor did not exceed the scope of that consent.” Id. (citations omitted). In determining 13 consent, courts consider “whether the circumstances, considered as a whole, demonstrate that a 14 reasonable person understood that an action would be carried out so that their acquiescence 15 demonstrates knowing authorization.” Id. (quoting Smith v. Facebook, Inc., 745 F. App’x 8, 8 16 (9th Cir. 2018)). “If that user could have plausibly understood the disclosures ‘as not disclosing 17 that [the defendant] would engage in particular conduct,’ then the disclosures are insufficient to 18 establish consent.” Id. (citing In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. 19 Supp. 3d 767, 789 (N.D. Cal. 2019)). 20 Here, the disclosures on which Express Scripts relies are not sufficient to establish consent 21 at the pleading stage. The company describes the disclosures “throughout the Privacy Policy a[s] 22 more than adequate to put a reasonable person viewing those disclosures on notice that Express 23 Scripts uses website enhancement technology, including pixels on certain pages within its domain; 24 that the record data collected from this technology may be shared with third parties; and that the 25 technology is used to promote site functionality and for marketing.” Mot. at 18. These 26 generalized disclosures are insufficient to resolve the issue of consent as a matter of law on the 27 pleading stage. See Calhoun v. Google, 526 F. Supp. 3d 605, 620 (N.D. Cal. 2021) (explaining, 1 finding of consent.”). 2 Express Scripts’ resort to Facebook’s terms is equally unavailing. As one court in this 3 district has explained, in deciding a motion for preliminary injunction, “Meta’s policies do not . . . 4 specifically indicate that Meta may acquire health data obtained from Facebook users’ interactions 5 with their medical providers’ websites. Its generalized notice is not sufficient to establish 6 consent.” In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 793 (N.D. Cal. 7 2022). Moreover, Lynch alleges certain Facebook disclosures indicate Meta “prohibit[s] 8 businesses and organizations from sharing sensitive information with [it], including health and 9 financial data” and promises “take action against that business or organization” “[i]f [it] 10 determines that a business or an organization is violating [its] terms[.]” SAC ¶ 24. Viewed in the 11 light most favorable to Lynch, these allegations suggest he “could have plausibly understood the 12 disclosures “as not disclosing that [the defendant] would engage” in the sharing of his sensitive 13 health information, in which case, “the disclosures are insufficient to establish consent.” 14 See Calhoun, 113 F.4th at 1147 (citing In re Facebook, Inc., Consumer Priv. User Profile Litig., 15 402 F. Supp. 3d 767, 789 (N.D. Cal. 2019)); see also In re Meta Pixel Tax Filing Cases, 724 F. 16 Supp. 3d at 1003-04 (“Drawing all inferences in plaintiffs’ favor, the Court cannot determine at 17 the 12(b)(6) stage that plaintiffs consented to Facebook collecting sensitive financial data simply 18 because the complaint mentions that Meta has certain agreements in place (without conceding 19 assent) and because Meta believes that these agreements adequately disclose the collection 20 practices at issue.”); cf. Smith, 745 F. App’x at 8-9 (finding the collection of “data show[ing] only 21 that [p]laintiffs searched and viewed publicly available health information that cannot, in and of 22 itself, reveal details of an individual’s health status or medical history” to be within the scope of 23 the plaintiffs’ consent to Facebook terms stating “[w]e collect information when you visit or use 24 third-party websites and apps that use our Services[]” and “we use all of the information we have 25 about you to show you relevant ads”). 26 Accordingly, Express Scripts’ motion to dismiss on the basis of consent is DENIED. 27 /// 1 |} IV. CONCLUSION 2 For the reasons set forth above, Express Scripts’ motion to dismiss is GRANTED IN 3 || PART AND DENIED IN PART. Lynch may file a third amended complaint within 21 days of 4 || this order that cures the deficiencies outlined above. Lynch may not otherwise add new claims, 5 parties, or substantive allegations. When filing the third amended complaint, Lynch must include 6 || the redline required by Paragraph H.1 of the Court’s Standing Order for Civil Cases. Courtesy 7 || copies of all documents are due to chambers within 3 days of filing. 8 IT IS SO ORDERED. 9 Dated: August 5, 2025 10 ‘Med - ll cok ARACELI MARTINEZ-OLGUIN 12 United States District Judge
15 16
= 17
Z 18 19 20 21 22 23 24 25 26 27 28