Lynch v. Express Scripts Holding Company

Opinion

JONATHAN LYNCH, Case No. 23-cv-01170-AMO

Plaintiff, ORDER RE MOTION TO DISMISS v. Re: Dkt. No. 54 COMPANY, Defendant.

This is a putative class action arising from Plaintiff Jonathan Lynch’s use of Defendant Express Scripts Holding Company’s online pharmacy. Now pending before the Court is Express Scripts’ motion to dismiss Lynch’s second amended complaint. Lynch opposes the motion. The Court, having considered the parties’ papers and the relevant legal authority, GRANTS the motion IN PART and DENIES the motion IN PART for the reasons set forth below. I. BACKGROUND1 Express Scripts is a pharmacy benefits manager serving over 100 million consumers. ECF 51 (“SAC”) ¶ 33. The company runs an online pharmacy, through which it handles millions of prescriptions each year. Id. ¶ 36. The Express Scripts website – www.express-scripts.com – uses the Facebook Pixel. Id. ¶¶ 1, 74. The Pixel is a piece of code that allows Facebook to surreptitiously intercept an individual’s communications with a website, including include page views, button and mouse clicks, names of buttons clicked, microdata, mouse hovers, scrolling, and “other observable website interactions, 1 This background is based on the allegations in Lynch’s second amended complaint, which are taken as true and construed in the light most favorable to him for the purpose of this motion. selections, and communications.” Id. ¶¶ 46, 75-76. Once a user takes any action on the Express Scripts website, such as clicking a button to register, login, or logout of the customer portal, the Facebook Pixel commands the visitor’s device to re-direct the communication between the user and the website to Facebook in real-time. Id. ¶¶ 51, 52. The technology relies on Facebook cookies,2 which enable the company to match a website visitor to that person’s Facebook account. Id. ¶ 49. The Pixel allows developers to measure, optimize, and build audiences for ad campaigns on and off Facebook, which translates to ad revenue for Meta. Id. ¶¶ 29, 31, 42-46. Because the Facebook Pixel was installed on the Express Scripts website, every time Lynch visited the site between April 2022 and December 20223 to obtain prescriptions to treat low insulin and testosterone levels, Facebook received information about the pages and content Lynch viewed, what he clicked on, as well as “mouse clicks and movements, keystrokes, search items, information inputted, pages and content viewed, scroll movements, and copy and paste actions.4 Id. ¶¶ 20, 77. In order to obtain his prescriptions through the site, Lynch had to enter his name, email, address, phone number, payment information, date of birth, gender, insurance information, 2 Facebook uses the “c-user, datr, fr, and fbp” cookies, with browser attribute information, to fingerprint a user’s device. Id. ¶¶ 27, 58. Each Facebook user has a unique c-user cookie value, which “is the Facebook equivalent of a user identification number.” Id. ¶ 59. The datr cookie “identifies [a] person’s specific web browser from which the person is sending the communication” and “is unique to the person’s specific web browser.” Id. ¶ 63. The fr cookie “is an encrypted combination of the c_user and datr cookies.” Id. ¶ 67 (footnote omitted). The fbp cookie “masquerades as a first-party cookie to evade third party cookie blockers and share data more directly between a website that has deployed Pixel and Facebook.” Id. ¶ 68 (footnote omitted). 3 During that period, Lynch also had a Facebook account. Id. ¶¶ 20, 71. He used the same device to access both his Facebook account and the Express Scripts website. Id. ¶ 20.

4 Using publicly available third-party software, Lynch tested web traffic between a computer, operating the Google Chrome browser, and the Express Scripts Platform. Id. ¶¶ 93-95. The testing revealed that the Express Scripts Platform “affirmatively interacted in the background with Facebook servers at least 16 times, 3 of which were connections to Facebook servers and 13 were ‘GET’ requests from Facebook servers.” Id. ¶ 96. A GET request “serves two purposes: it first tells the website what information is being requested and then instructs the website to send the information back to the user. The GET request also transmits a referer header containing the personally-identifiable URL information.” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d and a diagnosis history for his testosterone prescription, which is a controlled substance. Id. ¶ 20. Lynch did not consent to the sharing and interception of this data. Id. Had he known that Express Scripts used the Facebook Pixel to monitor and share his personal and other sensitive information with third parties, Lynch would never have used the Express Scripts Platform5 or shared his information to Express Scripts. Id. Based on the alleged interception and sharing of his personal and other sensitive information, Lynch asserts claims for violations of (1) the Wiretap Act, 18 U.S.C. § 2510, et seq., (2) the California Invasion of Privacy Act, (“CIPA”), Cal. Pen. Code § 631, and (3) the California Confidentiality of Medical Information Act (“CMIA”), Cal. Civ. Code § 56, et seq. SAC ¶¶ 126- 132, ¶¶ 133-150, ¶¶ 151-164. Lynch seeks to assert these claims on behalf of himself and a class of “[a]ll natural persons in the United States who used the Express Scripts Platform and whose communications and/or data were shared with third parties, including Facebook[,]” and “[i]n addition, or in the alternative,” a subclass of “[a]ll natural persons in the State of California who used the Express Scripts platform and whose communications and/or data were shared with third parties, including Facebook.” Id. ¶ 111. A. Motion to Dismiss for Failure to State a Claim To overcome a Rule 12(b)(6) motion to dismiss, the factual allegations in the plaintiff’s complaint “ ‘must . . . suggest that the claim has at least a plausible chance of success.’ ” Levitt v. Yelp! Inc., 765 F.3d 1123, 1135 (9th Cir. 2014) (quoting In re Century Aluminum Co. Sec. Litig., 729 F.3d 1104, 1107 (9th Cir. 2013) (alterations in original)). In ruling on a Rule 12(b)(6) motion, courts “accept factual allegations in the complaint as true and construe the pleadings in the light most favorable to the nonmoving party.” Manzarek, 519 F.3d at 1031. “[A]llegations in a complaint . . . may not simply recite the elements of a cause of action, but must contain sufficient allegations of underlying facts to give fair notice and to enable the opposing party to defend itself effectively.” Levitt, 765 F.3d at 1135 (quoting Starr v. Baca, 652 F.3d 1202, 1216 (9th Cir. 2011)). The court may dismiss a claim “where there is either a lack of a cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal claim.” Hinds Invs., L.P. v. Angioli, 654 F.3d 846, 850 (9th Cir. 2011) (citing Johnson v. Riverside Healthcare Sys., LP, 534 F.3d 1116, 1121 (9th Cir. 2008)). “[T]he non-conclusory ‘factual content’ and reasonable inferences from that content must be plausibly suggestive of a claim entitling the plaintiff to relief.” Moss v. U.S. Secret Service, 572 F.3d 962, 969 (9th Cir. 2009). When deciding whether to grant a motion to dismiss, the court generally “may not consider any material beyond the pleadings.” Hal Roach Studios, Inc. v. Richard Feiner & Co., 896 F.2d 1542, 1555 n.19 (9th Cir. 1990). However, the court may consider material submitted as part of the complaint or relied upon in the complaint and may also consider material subject to judicial notice. See Lee v. City of Los Angeles, 250 F.3d 668, 688-89 (9th Cir. 2001). B. Request for Judicial Notice/Incorporation by Reference A district court may take judicial notice of facts that are “not subject to reasonable dispute” because they are (1) “generally known within the trial court’s territorial jurisdiction,” or (2) “can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b); see United States v. Bernal-Obeso, 989 F.2d 331, 333 (9th Cir. 1993). “Accordingly, ‘[a] court may take judicial notice of matters of public record.’ ” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 999 (9th Cir. 2018) (quoting Lee, 250 F.3d at 688). A court cannot, however, “take judicial notice of disputed facts contained in such public records.” Id. “Unlike rule-established judicial notice, incorporation-by-reference is a judicially created doctrine that treats certain documents as though they are part of the complaint itself. The doctrine prevents plaintiffs from selecting only portions of documents that support their claims, while omitting portions of those very documents that weaken – or doom – their claims.” Id. at 1002. “Although the incorporation-by-reference doctrine is designed to prevent artful pleading by plaintiffs, the doctrine is not a tool for defendants to short-circuit the resolution of a well-pleaded claim.” Id. at 1003. In applying this standard, the Ninth Circuit instructs: When a general conclusion in a complaint contradicts specific facts retold in a document attached to the complaint, incorporated by reference in the complaint, or subject to judicial notice, those specific facts are controlling. Similarly, where a complaint incorrectly summarizes or characterizes a legally operative document attached to the complaint, incorporated by reference in the complaint, or subject to judicial notice, the document itself is controlling. . . . But if specific facts alleged in the complaint contradict specific facts related in a non-legally-operative document attached to the complaint, incorporated by reference in the complaint, or subject to judicial notice, the conflict is resolved in the plaintiff’s favor. In re Finjan Holdings, Inc., 58 F.4th 1048, 1052 n.1 (9th Cir. 2023) (citations omitted). The Court will first take up Express Scripts’ request for judicial notice, ECF 55 (“RJN”), before turning to the motion to dismiss. A. Request for Judicial Notice/Incorporation by Reference Express Scripts asks that the Court take judicial notice of two sets of exhibits. RJN at 2-3. The first set, labeled Exhibits A-E, are attached to the declaration of Matthew Edwards, ECF 54-9, and include: • Exhibit A: A screenshot that appeared during the registration process for Express- Scripts.com from April 2022 to December 2022. • Exhibit B: The Privacy Policy that appeared on Express-Scripts.com and was hyperlinked as part of the registration process for Express-Scripts.com from April 2022 to December 2022. • Exhibit C: The Terms of Use that appeared on Express-Scripts.com and were hyperlinked as part of the registration process for Express-Scripts.com from April 2022 to December 2022. • Exhibit D: Screenshots that appeared during the in-application iOS registration process in the Express Scripts’ iOS application from April 2022 to December 2022, reflecting • Exhibit E: Screenshots that appeared during the in-application Android registration process for Express Scripts’ Android application from April 2022 to December 2022, reflecting the light and dark modes of Android phones. Edwards Decl. ¶¶ 4-8. The second set, labeled Exhibits A-G, are attached to the declaration of Tiffany Cheung, ECF 54-1, and include: • Exhibit A: Meta’s Privacy Policy, effective July 26, 2022, archived by the Internet Archive’s Wayback Machine on May 27, 2022. • Exhibit B: Meta’s Terms of Service, as revised on January 4, 2022, archived by the Internet Archive’s Wayback Machine on March 20, 2022. • Exhibit C: Meta’ s Terms of Service, as revised on July 26, 2022, archived by the Internet Archive’s Wayback Machine on December 31, 2022. • Exhibit D: Meta’s Cookies Policy, effective January 4, 2022, archived by the Internet Archive’s Wayback Machine on November 3, 2022. • Exhibit E: Meta’s Cookies Policy, effective October 5, 2022, archived by the Internet Archive’s Wayback Machine on December 15, 2022. • Exhibit F: Facebook Help Center: How do I manage my future off-Facebook activity? • Exhibit G: Facebook Help Center: Review your off-Facebook activity. Cheung Decl. ¶¶ 2-8. While Lynch objects to Express Scripts’ request for judicial notice on the ground that these documents’ “accuracy can reasonably be questioned,” Opp. at 11 n.1, the Court nonetheless takes judicial notice of the existence of these documents. It does not, however, consider the documents beyond that. See In re Meta Pixel Tax Filing Cases, 724 F. Supp. 3d 987, 1001 (N.D. Cal. 2024) (“This notice is limited to the existence and contents of this July 26, 2022 version of Meta’s terms of service. The Court cannot conclude from Meta’s submission that this was the version in effect during the period relevant to plaintiffs’ claims, or that plaintiffs ever assented to the terms therein.”). The Court also declines to deem the documents incorporated by reference. While the Scripts seeks to do here, as a “tool for defendants to short-circuit the resolution of a well-pleaded claim.” See Khoja, 899 F.3d at 1003. B. Motion to Dismiss Express Scripts moves to dismiss Lynch’s second amended complaint with prejudice, arguing that he fails to satisfy applicable pleading standards, that he consented to the data collection that is the basis of his claims, and that those claims independently fail on the merits for other reasons. Mot. at 16-31. The Court first turns to the sufficiency of Plaintiffs’ allegations before reaching the claim-specific arguments Express Scripts advances in its motion. 1. Adequacy of Allegations Express Scripts attacks the sufficiency of Lynch’s allegations on three grounds. It argues that Lynch’s allegations do not satisfy Rule 8 or Rule 9(b) and that Lynch has failed to cure the deficiencies noted in the Court’s prior order of dismissal. Mot at 16-17. The Court addresses the threshold pleading deficiencies discussed in that order before addressing Express Scripts’ arguments about Rule 8 and Rule 9(b). The Court dismissed Lynch’s first amended complaint due to a number of inconsistent allegations. As relevant here, the Court’s prior order of dismissal determined that:

Lynch . . . fails to consistently allege the identity of the company responsible for the interception that is the subject of his complaint. In some of his allegations, Lynch attributes the alleged wiretapping to Express Scripts. See, e.g., ECF 31 ¶ 88 (alleging that Lynch “reasonably expected that visits to Defendant’s website would be private, and that Defendant would not be intercepting or tapping their communications with Defendant’s website . . . .”); see also id. ¶ 89 (alleging Lynch “reasonably believed . . . interactions with Defendant’s website were private and would not be recorded or monitored for a later playback by Defendant, or worse yet, monitored live while Plaintiff and Class Members were on its website.”); ¶ 93 (alleging that Express Scripts “surreptitiously collected” Lynch’s communications “to gain an unlawful understanding of the habits and preferences of users to its websites,” solely for Express Scripts’ own benefit); ¶ 94 (“Defendant’s use of the Facebook Pixel spyware to intercept Plaintiff’s and Class Members’ electronic communications did not facilitate, was not instrumental, and was not incidental to the transmission of Plaintiff’s and Class Members’ electronic communications with Defendant’s website.”). Elsewhere, Lynch alleges that Facebook is intercepting the communications between him and the Express private electronic communications and transmissions by a third- party, Facebook, when Plaintiff and other Class Members accessed Defendant’s website from within the State of California.”); see also id. ¶ 166 (“Plaintiff and Class Members did not know Defendant was engaging in such interception by a third-party and therefore could not provide consent to have any part of their private electronic communications intercepted with the aiding and abetting of Defendant.”); ¶ 167 (“Plaintiff and Class Members were completely unaware that Defendant had assisted a third-party, Facebook, to intercept and store electronic communications and other personal data until well after it had already occurred and were therefore unable to consent.”). ECF 48 (“Order”) at 1-2. The second amended complaint does not cure this deficiency. As Express Scripts highlights, Lynch alleges in paragraph 75 that “[t]he Facebook Pixel thereafter surreptitiously intercepted and transmitted in real time to Facebook, without Plaintiff’s prior knowledge or consent, a variety of private communications between Plaintiff and Defendant.” SAC ¶ 75. Other paragraphs, however, allege Express Scripts intercepted those communications. In paragraph 83, Lynch alleges “Defendant’s use of the Facebook Pixel to intercept Plaintiff’s electronic communications and share them with Facebook was not instrumental or necessary to Defendant’s provision of any of its goods or services.” Id. ¶ 83. Paragraph 84 likewise alleges “Defendant utilized the Facebook Pixel to intercept the substance of Plaintiff’s . . . electronic communications intentionally and contemporaneously share the information with Facebook, including mouse clicks and movements, keystrokes, search terms, information inputted, pages and content viewed, scroll movements, and copy and paste actions.” Id. ¶ 84. Paragraph 119 similarly attributes the interception to Express Scripts: “Defendant intercepted and recorded the Class Member’s electronic communications without . . . knowledge or consent.” Id. ¶ 119. In light of these inconsistent allegations, Lynch has once again failed to provide Express Scripts fair notice of the conduct giving rise to the federal and state wiretapping claims pleaded in the operative complaint. But for this pleading deficiency, however, Lynch’s allegations otherwise withstand Express Scripts’ pleading challenges. Federal Rule of Civil Procedure 8 requires a complaint to include “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). Here, Lynch alleges that he used the Express Scripts Platform to obtain entered his name, email, phone number, address, payment information, date of birth, gender, insurance information, and a diagnosis history related to the testosterone prescription, which is a controlled substance. Id. Lynch further alleges that the Facebook Pixel tracked his use of the Express Scripts Platform, which communicated his confidential information. Id. Express Scripts disclosed this information, without consent, to Facebook for financial gain. Id. ¶¶ 156, 159-160. According to Lynch, this is the information “Facebook monetizes . . . . by using it to generate highly profitable targeted advertising on-and-off Facebook.” These allegations satisfy Rule 8, and as discussed in this order, plausibly state a claim for relief as required by Rule 12. See Meta Healthcare Pixel Litig., 713 F. Supp. 3d 650, 655 (N.D. Cal. 2024) (declining to dismiss plaintiffs’ privacy claims “simply because their communications with their healthcare providers may have been through publicly available webpages” and finding claims sufficient to proceed to discovery “given that plaintiffs were communicating with their healthcare providers about their healthcare needs, plaintiffs have alleged enough . . . to proceed to discovery.”). The Court rejects Express Scripts’ argument that Lynch must plead additional technical details “connect[ing] the technology at issue to the purported health information captured[.]” Mot. at 17 (citing Doe v. Google, 741 F. Supp. 3d 828 (N.D. Cal. 2024)). The pleading standard which Express Scripts invokes imposes requirements beyond those that apply under Rule 8 and Rule 12(b)(6). See Doe v. FullStory, Inc., 712 F. Supp. 3d 1244, 1259 (N.D. Cal. 2024) (At the motion to dismiss stage, “in the absence of discovery [about] how the TikTok Pixels actually work and what information was tracked, it would be premature to hold that TikTok’s alleged tracking of the various pages that plaintiff may have visited within Favor’s platform when seeking healthcare services cannot constitute an invasion of privacy.”) (footnote omitted). To the extent Express Scripts contends that the Meta Pixel can be configured in different ways on different web properties such that Lynch’s sensitive information could not have been shared or intercepted, that is a matter for consideration at summary judgment or trial. The Court also rejects Express Scripts’ argument that allegations about it “ ‘secretly deploy[ing]’ ” the Meta Pixel and “ ‘knowingly, actively, affirmatively and/or negligently standard. See Mot. at 16 (citing SAC ¶¶ 20, 23, 140-143). The two decisions on which Express Scripts relies do not persuade otherwise. Though the Doe v. Google court suggested that “by insisting that Google’s admonitions to health care providers are part of a plot to steal private health information from its clients, the plaintiffs may well be subjecting their intent-related allegations to the heightened pleading standard of Federal Rule of Civil Procedure 9(b),” it did not resolve the issue and instead found that the plaintiffs there did not satisfy rule 8. 741 F. Supp. 3d at 841-42 (citations omitted). In Rodriguez v. Google, No. 20-cv-04688-RS, 2021 WL 2026726, *6 (N.D. Cal. May 21, 2021), the court found that the plaintiffs’ allegations about secret scripts Google deployed to collect data for a shadow version of Google Analytics were subject to Rule 9(b). In that case, the plaintiffs “walked back” their allegations of surreptitious collection at oral argument, recharacterizing them as a challenge to whether Google adequately disclosed the use of the technology at issue. Id. Unlike in Rodriguez, “[b]ecause [Lynch is] directly challenging [the] alleged data collection rather than challenging any potentially fraudulent or misleading representations about this collection, [his] claims do not sound in fraud and are not subject to Rule 9(b).” See Smith v. Google, LLC, 735 F. Supp. 3d 1188, 1198 (N.D. Cal. 2024). Nonethless, because Lynch has failed to cure the inconsistent wiretapping allegations described in the Court’s prior dismissal order, Express Scripts’ motion to dismiss is GRANTED as to the federal and state wiretapping claims. The Court will allow Lynch one final opportunity to cure those pleading deficiencies in a third amended complaint filed within 21 days of this order. Having dismissed the wiretapping claims, the Court now turns to the remaining arguments Express Scripts raises in its motion, to the extent relevant to Lynch’s remaining CMIA claim. 2. CMIA The CMIA requires “[e]very provider of health care, health care service plan, pharmaceutical company, or contractor who creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information [to] do so in a manner that preserves the confidentiality of the information contained therein.” Cal. Civ. Code § 56.101(a). Express Scripts argues that Lynch’s claim under the CMIA fails because he “does not medical information allegedly provided to Express Scripts was actually viewed by an unauthorized third party.” Mot. at 28. Express Scripts also argues that dismissal is appropriate because Lynch consented to the various terms and policies submitted with its request for judicial notice. Mot. at 17-19. The Court addresses each argument in turn. a. Release of medical information “Medical information” is “any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment.” Cal. Civ. Code § 56.05(j). Medical information is “individually identifiable” when it:

[I]ncludes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other information that, alone or in combination with other publicly available information, reveals the identity of the individual. Id. Lynch alleges that he used the Express Scripts website “to obtain prescriptions to treat low insulin and testosterone levels.” SAC ¶ 20. In order to use the website for that purpose, Lynch “was required to enter his name, email address, phone number, address, and payment information. He was also required to input further information, such as his date of birth, gender, insurance information, and a diagnosis history related to the testosterone prescription, as it is a controlled substance.” Id. These allegations are sufficient to establish that Lynch shared medical information with Express Scripts.6 Indeed, in its opening brief, Express Scripts appears to concede as much: “[t]hat Plaintiff alleges he entered medical information on some unidentified page within Express Scripts’ website to place prescription orders is unsurprising; Express Scripts provides online pharmacy services.” Mot. at 10. Additionally, Lynch’s allegations that Express Scripts “deployed the Facebook Pixel software on its Platform,” SAC ¶ 74, and that the Pixel “surreptitiously intercepted and transmitted in real time to Facebook . . . a variety of private communications between [him] and [Express Scripts,]” id. ¶ 75, plausibly establish that Express Scripts disclosed Lynch’s medical information. The cases on which Express Scripts relies do not compel a different conclusion. For example, in Smith v. Facebook, 262 F. Supp. 3d 943, 954 (N.D. Cal. 2017), “[n]othing about the information” at issue “relate[d] specifically to Plaintiffs’ health.” Here, however, Lynch alleges that he obtained prescriptions using the Express Scripts website for two specific medical conditions and entered diagnosis history relating to at least one medication. SAC ¶ 20. In Eisenhower Med. Ctr. v. Superior Court, 226 Cal. App. 4th 430, 437 (2014), the court concluded “that under the CMIA a prohibited release by a health care provider must include more than individually identifiable information but must also include information relating to medical history, mental or physical condition, or treatment of the individual,” which as discussed above, is what Lynch has plausibly alleged here. For these reasons, Express Scripts’ motion to dismiss on the ground that Lynch has failed to allege disclosure of his medical information within the meaning of the CMIA is DENIED. b. Actual viewing “[A] breach of confidentiality under the CMIA requires a showing that an unauthorized party viewed the confidential information.” Vigil v. Muir Med. Grp. IPA, Inc., 84 Cal. App. 5th 197, 213 (2022). Express Scripts argues that Lynch pleads “zero allegations in the amended complaint from which it could be plausibly inferred that substantive medical information was actually viewed, or that Plaintiff received any targeted advertisements following his use of the Express Scripts website.” Mot. at 31. In opposition, Lynch points to the following allegations in the SAC. “ ‘Facebook monetizes the information it receives through the Facebook Pixel deployed on Defendant’s Express-Scripts.com website by using it to generate highly-profitable targeted advertising on-and ad campaigns to patients based on the specific actions those patients took on Defendant’s website.” Opp. at 27 (quoting SAC ¶¶ 29, 31). Facebook generates revenue “ ‘almost entirely from selling targeted advertising space on Facebook.com, and to all Internet users on non- Facebook sites that integrate Facebook marketing source code on their websites.’ ” Id. (quoting SAC ¶ 44). “ ‘The electronic communications intentionally intercepted and transmitted to Facebook were content generated through Plaintiff’s use, interaction, and communication with Defendant’s Platform relating to the substance, purport, and/or meaning of [Lynch’s] and Class Members’ communications with the Platform. ’ ” Id. (quoting SAC ¶ 88). “ ‘The data collected by the Facebook Pixel identified specific information inputted and content viewed, and transmitted the same to Facebook for its aggregation, use, and sale to drive advertising. Information shared revealed personalized and sensitive information about Plaintiff’s and Class Member’s internet activity and habits.’ ” Id. (quoting SAC ¶ 87). “ ‘[T]he unauthorized interception and disclosure of [Lynch’s] and Class Members’ sensitive electronic communications with Defendant . . . that in turn allowed [Facebook] . . . to read, learn the contents of, make reports on [Lynch’s] and Class Members’ interactions with Defendant’s Platform, and use the information for its own benefit.’ ” Id. (quoting SAC ¶ 4). “ ‘Through the Facebook Pixel embedded in Defendant’s website, Facebook was able to and did access sensitive personal and health information provided by Plaintiff and Class Members to Express Scripts, and incorporated that accessed information into its profiles of Plaintiff and Class Members.’ ” Id. (quoting SAC ¶ 70). Viewing these allegations in the light most favorable to Lynch, the reasonable inference to draw is that Meta actually viewed the information intercepted by its Pixel when building the user profiles that sustain is advertising products. Discovery will afford the parties the opportunity to test that inference, but at the pleading stage, it entitles Lynch to proceed on his CMIA claim. See Cousin v. Sharp Healthcare, 702 F. Supp. 3d 967, 975 (S.D. Cal. 2023) (denying motion to dismiss CMIA claim and finding it was “sufficiently plausible” that plaintiffs’ information was “viewed or otherwise accessed” as defined by the CMIA where plaintiffs alleged upon information and belief that “Meta regularly viewed” the information and that Meta’s business model involves For these reasons, Express Scripts’ motion to dismiss the CMIA for lack of allegations of actual viewing is DENIED. c. Consent Express Scripts also contends that dismissal is appropriate because Lynch consented to Express Scripts’ use of pixel technology when he created an account on the Platform. Mot. at 17- 18. Consent “can be [express] or implied, but any consent must be actual.” Calhoun v. Google, LLC, 113 F.4th 1141, 1147 (9th Cir. 2024) (internal citations and quotations omitted; modification in original). “For consent to be actual, the disclosures must ‘explicitly notify’ users of the conduct at issue.” Id. (citation omitted). “[C]onsent is only effective if the person alleging harm consented ‘to the particular conduct, or to substantially the same conduct’ and if the alleged tortfeasor did not exceed the scope of that consent.” Id. (citations omitted). In determining consent, courts consider “whether the circumstances, considered as a whole, demonstrate that a reasonable person understood that an action would be carried out so that their acquiescence demonstrates knowing authorization.” Id. (quoting Smith v. Facebook, Inc., 745 F. App’x 8, 8 (9th Cir. 2018)). “If that user could have plausibly understood the disclosures ‘as not disclosing that [the defendant] would engage in particular conduct,’ then the disclosures are insufficient to establish consent.” Id. (citing In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 789 (N.D. Cal. 2019)). Here, the disclosures on which Express Scripts relies are not sufficient to establish consent at the pleading stage. The company describes the disclosures “throughout the Privacy Policy a[s] more than adequate to put a reasonable person viewing those disclosures on notice that Express Scripts uses website enhancement technology, including pixels on certain pages within its domain; that the record data collected from this technology may be shared with third parties; and that the technology is used to promote site functionality and for marketing.” Mot. at 18. These generalized disclosures are insufficient to resolve the issue of consent as a matter of law on the pleading stage. See Calhoun v. Google, 526 F. Supp. 3d 605, 620 (N.D. Cal. 2021) (explaining, finding of consent.”). Express Scripts’ resort to Facebook’s terms is equally unavailing. As one court in this district has explained, in deciding a motion for preliminary injunction, “Meta’s policies do not . . . specifically indicate that Meta may acquire health data obtained from Facebook users’ interactions with their medical providers’ websites. Its generalized notice is not sufficient to establish consent.” In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 793 (N.D. Cal. 2022). Moreover, Lynch alleges certain Facebook disclosures indicate Meta “prohibit[s] businesses and organizations from sharing sensitive information with [it], including health and financial data” and promises “take action against that business or organization” “[i]f [it] determines that a business or an organization is violating [its] terms[.]” SAC ¶ 24. Viewed in the light most favorable to Lynch, these allegations suggest he “could have plausibly understood the disclosures “as not disclosing that [the defendant] would engage” in the sharing of his sensitive health information, in which case, “the disclosures are insufficient to establish consent.” See Calhoun, 113 F.4th at 1147 (citing In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 789 (N.D. Cal. 2019)); see also In re Meta Pixel Tax Filing Cases, 724 F. Supp. 3d at 1003-04 (“Drawing all inferences in plaintiffs’ favor, the Court cannot determine at the 12(b)(6) stage that plaintiffs consented to Facebook collecting sensitive financial data simply because the complaint mentions that Meta has certain agreements in place (without conceding assent) and because Meta believes that these agreements adequately disclose the collection practices at issue.”); cf. Smith, 745 F. App’x at 8-9 (finding the collection of “data show[ing] only that [p]laintiffs searched and viewed publicly available health information that cannot, in and of itself, reveal details of an individual’s health status or medical history” to be within the scope of the plaintiffs’ consent to Facebook terms stating “[w]e collect information when you visit or use third-party websites and apps that use our Services[]” and “we use all of the information we have about you to show you relevant ads”). Accordingly, Express Scripts’ motion to dismiss on the basis of consent is DENIED. /// 1 } IV. CONCLUSION 2 For the reasons set forth above, Express Scripts’ motion to dismiss is GRANTED IN 3 PART AND DENIED IN PART. Lynch may file a third amended complaint within 21 days of 4 this order that cures the deficiencies outlined above. Lynch may not otherwise add new claims, 5 parties, or substantive allegations. When filing the third amended complaint, Lynch must include 6 the redline required by Paragraph H.1 of the Court’s Standing Order for Civil Cases. Courtesy 7 copies of all documents are due to chambers within 3 days of filing. 9 Dated: August 5, 2025 10 ‘Med - ll cok ARACELI MARTINEZ-OLGUIN 12 United States District Judge

15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28