M.D. v. Google LLC

• Court: District Court, N.D. California
• Decided: September 23, 2025
• Docket: 3:24-cv-06369
• Status: Unknown

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 M.D., et al., Case No. 24-cv-06369-AMO

8 Plaintiffs, ORDER GRANTING DEFENDANTS’ 9 v. MOTIONS TO DISMISS

10 GOOGLE LLC, et al., Re: Dkt. Nos. 37, 40 Defendants. 11

12 13 This is a putative data privacy class action against two tech behemoths. Plaintiffs allege 14 that Defendants Google, LLC (“Google”) and Meta Platforms, Inc. (“Meta”) improperly gleaned 15 their personal health data, including erectile dysfunction prescriptions, from a website. Google 16 and Meta’s motions to dismiss were heard before this Court on July 10, 2025. Having read the 17 papers filed by the parties and carefully considered their arguments therein and those made at the 18 hearing, as well as the relevant legal authority, and good cause appearing, the Court hereby 19 GRANTS the motions to dismiss for the following reasons. 20 I. BACKGROUND1 21 Non-party Dermacare, LLC d/b/a BlueChew (“BlueChew”) operates www.bluechew.com 22 (the “Website”) and provides “a technology platform which enables registered users to connect 23 with physicians and other health care providers for the diagnosis and treatment of erectile 24 dysfunction.” FAC ¶ 2. Plaintiff M.D. is a California citizen who, on December 6, 2022, and 25 January 4, 2023, was prescribed and ordered erectile dysfunction medication through the Website. 26

27 1 This factual background is taken from the allegations in the operative complaint, which the Court 1 First Am. Compl. (“FAC,” Dkt. No. 34) ¶ 7. Plaintiff O.F., a Pennsylvania citizen, purchased 2 erectile dysfunction medication through the Website in January 2022. FAC ¶ 9. Plaintiff J.P., a 3 Maryland citizen, purchased erectile dysfunction medication through the Website in August 2024. 4 FAC ¶ 11. 5 In using the Website, Plaintiffs and class members provided protected health information 6 to BlueChew for the purpose of obtaining medical treatment, including providing responses to a 7 “medical profile” questionnaire to determine whether they qualify for erectile dysfunction 8 medication. FAC ¶¶ 20-24, Figures 1-4. Defendants intercepted Plaintiffs’ sensitive health 9 information conveyed through the Website using the Facebook Tracking Pixel, Google Analytics 10 tool, and other similar software. FAC ¶ 32. The data transferred by BlueChew to Google and 11 Meta included a Website user’s name, birthday, email address, and a pseudonymous identifier 12 created and assigned to them by BlueChew. FAC ¶¶ 44, 68-69. The data intercepted and 13 collected also included de-anonymized, prescription erectile dysfunction medications purchased 14 by Plaintiffs and class members on the Website. FAC ¶¶ 3-4, 35, 39 (illustrating how the 15 Facebook Tracking Pixel functions to intercept private health information from the Website); id. 16 ¶¶ 61-75 (same as to Google’s tracking technologies). Examples of Defendants’ interceptions 17 from the Website show that Defendants intercepted personally identifying information such as 18 name, state of residence, email address, and various forms of protected health information. For 19 example, Google intercepted information showing that a BlueChew user registered on the 20 Website, added a medication to their cart, and ultimately purchased the medication. FAC ¶ 67-69, 21 Figures 8 and 9. Meta accomplished the same using its technology. FAC ¶ 40, Figures 4 and 5; 22 see also id. ¶ 41 (“Through the Facebook Tracking Pixel, Defendant Facebook intercepted and 23 recorded ‘AddToCart’ and ‘CompleteRegistration’ events, which detail information about which 24 prescription the patient was purchasing on the Website.”); id. ¶¶ 42-44. Plaintiffs’ protected 25 health information intercepted by Defendants was personally identifiable, and Defendants used 26 Plaintiffs’ and class members’ intercepted health information for the purpose of targeted 27 advertising. FAC ¶¶ 5, 36, 57, 73-74. At some point after Plaintiffs’ respective purchases on 1 medications,” but they do not allege whether those ads were served by Meta, Google, or another 2 entity. FAC ¶¶ 8, 10, 12. 3 Plaintiffs advance the following claims in the FAC: 4 • (1) violation of the California Invasion of Privacy Act (“CIPA”), California Penal Code 5 section 631 (Claim I); 6 • (2) violation of CIPA, California Penal Code section 632 (Claim II); and 7 • (3) invasion of privacy under the California Constitution (Claim III). 8 • (4) Plaintiff O.F.’s claim for a violation of the Pennsylvania Wiretapping Act (“WESCA”), 9 18 Pa. Cons. Stat. § 5701 et seq., on behalf of a putative Pennsylvania class (FAC ¶¶ 120- 10 28); and 11 • (5) Plaintiff J.P.’s claim for a violation of the Maryland Wiretapping and Electronic 12 Surveillance Act (“MWESA”), Md. Cts. & Jud. Proc. Code Sec. 10-401 et seq. on behalf 13 of a putative Maryland class (FAC ¶¶ 129-40). 14 M.D seeks to represent a putative California class including “all natural persons in California who, 15 during the class period, purchased medication on www.bluechew.com.” FAC ¶ 78. Plaintiff O.F. 16 brings claims on behalf of himself and an identical class of persons in Pennsylvania. FAC ¶ 79. 17 Plaintiff J.P. brings claims on behalf of himself and an identical class of persons in Maryland. 18 FAC ¶ 80. 19 II. DISCUSSION 20 Defendants both move to dismiss the Complaint for failure to state a claim. See Dkt. Nos. 21 37, 40. The Court begins by taking up Defendants’ requests for judicial notice, the contents of 22 which inform the subsequent analysis of the motions to dismiss. 23 A. Request for Judicial Notice 24 Each Defendant filed their own request for judicial notice. See Dkt. No. 39 (Meta); Dkt. 25 No. 41 (Google). A district court may take judicial notice of facts that are “not subject to 26 reasonable dispute” because they are (1) “generally known within the trial court’s territorial 27 jurisdiction,” or (2) “can be accurately and readily determined from sources whose accuracy 1 F.2d 331, 333 (9th Cir. 1993). “Accordingly, ‘[a] court may take judicial notice of matters of 2 public record.’ ” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 999 (9th Cir. 2018) 3 (quoting Lee, 250 F.3d at 688). A court cannot, however, “take judicial notice of disputed facts 4 contained in such public records.” Id. 5 “Unlike rule-established judicial notice, incorporation-by-reference is a judicially created 6 doctrine that treats certain documents as though they are part of the complaint itself. The doctrine 7 prevents plaintiffs from selecting only portions of documents that support their claims, while 8 omitting portions of those very documents that weaken – or doom – their claims.” Khoja, 899 9 F.3d at 1002. “Although the incorporation-by-reference doctrine is designed to prevent artful 10 pleading by plaintiffs, the doctrine is not a tool for defendants to short-circuit the resolution of a 11 well-pleaded claim.” Id. at 1003. 12 Google requests the Court take judicial notice of several documents, including screenshots 13 of webpages as well as iterations of Google’s and BlueChew’s terms, all of them with differing 14 effective dates. See McKinley Corbo Decl. (Dkt. No. 41-1). Google avers that all of these 15 materials are incorporated by reference into the Complaint and that all of these materials, 16 consisting of publicly available webpages, are not subject to reasonable dispute and are capable of 17 accurate and ready determination. See Google RJN (Dkt. No. 41). 18 Similarly, Meta requests the Court take judicial notice of several categories of materials, 19 including screenshots of webpages as well as Meta’s and BlueChew’s terms. See Blunschi Decl., 20 Exs. 1-21 (Dkt. No. 38). Meta avers that all of these materials are incorporated by reference into 21 the Complaint and that all of these materials, consisting of publicly available webpages, are not 22 subject to reasonable dispute and are capable of accurate and ready determination. See Meta RJN 23 (Dkt. No. 39). 24 Though Plaintiffs argue in their brief that the Court should disregard the materials as 25 insufficiently authenticated and too attenuated to the dates of Plaintiffs’ access of the website, see, 26 e.g., Opp. to Meta (Dkt. No. 42) at 10-12, Plaintiffs’ counsel made clear at the hearing that they 27 did not object to the Court considering the materials submitted for judicial notice in its assessment 1 see Hrg. Tr. (Dkt. No. 55) at 15. The Court therefore GRANTS the request for judicial notice of 2 the existence of the various terms and policies at issue, and it considers the materials incorporated 3 by reference. 4 B. Motions to Dismiss 5 1. Legal Standard 6 A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests for the legal 7 sufficiency of the claims alleged in the complaint. Ileto v. Glock, 349 F.3d 1191, 1199-1200 (9th 8 Cir. 2003). Under Federal Rule of Civil Procedure 8, which requires that a complaint include a 9 “short and plain statement of the claim showing that the pleader is entitled to relief,” Fed. R. Civ. 10 P. 8(a)(2), a complaint may be dismissed under Rule 12(b)(6) if the plaintiff fails to state a 11 cognizable legal theory, or has not alleged sufficient facts to support a cognizable legal theory. 12 Somers v. Apple, Inc., 729 F.3d 953, 959 (9th Cir. 2013). 13 While the court is to accept as true all the factual allegations in the complaint, it need not 14 accept legally conclusory statements unsupported by factual allegations. Ashcroft v. Iqbal, 556 15 U.S. 662, 678-79 (2009). The complaint must proffer sufficient facts to state a claim for relief that 16 is plausible on its face. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 558-59 (2007) (citations 17 and quotations omitted). “A claim has facial plausibility when the plaintiff pleads factual content 18 that allows the court to draw the reasonable inference that the defendant is liable for the 19 misconduct alleged.” Iqbal, 556 U.S. at 678 (citation omitted). “[W]here the well-pleaded facts 20 do not permit the court to infer more than the mere possibility of misconduct, the complaint has 21 alleged – but it has not ‘show[n]’ – that the pleader is entitled to relief.” Id. at 679. 22 Review is generally limited to the contents of the complaint, although the court can also 23 consider a document on which the complaint relies if the document is central to the claims asserted 24 in the complaint, and no party questions the authenticity of the document. See Sanders v. Brown, 25 504 F.3d 903, 910 (9th Cir. 2007). The court may consider matters that are properly the subject of 26 judicial notice, Knievel v. ESPN, 393 F.3d 1068, 1076 (9th Cir. 2005); Lee v. City of Los Angeles, 27 250 F.3d 668, 688-89 (9th Cir. 2001), and may also consider documents referenced extensively in 1 Teamster Jt. Council Pension Tr. Fund v. Am. W. Holding Corp., 320 F.3d 920, 925 n.2 (9th Cir. 2 2003). If dismissal is warranted, it is generally without prejudice, unless it is clear that the 3 complaint cannot be saved by any amendment. Sparling v. Daou, 411 F.3d 1006, 1013 (9th Cir. 4 2005). 5 2. Consent 6 Among the several arguments raised by Google and Meta, Defendants move to dismiss on 7 the grounds that Plaintiffs consented to having their information collected on BlueChew’s website 8 and shared with Defendants. “Consent generally defeats privacy claims.” Javier v. Assurance IQ, 9 LLC, No. 4:20-CV-02860-JSW, 2021 WL 940319, at *2 (N.D. Cal. Mar. 9, 2021). “On a motion 10 to dismiss, the burden of proof to show consent rests with defendants.” Doe v. FullStory, Inc., 712 11 F. Supp. 3d 1244, 1253 (N.D. Cal. 2024); Doe v. Meta Platforms, Inc., 690 F. Supp. 3d 1064, 12 1077-78 (N.D. Cal. 2023) (“On this motion to dismiss, the issue of consent is front and center and 13 the burden of proof to show this exemption applies is on Meta.”). Under CIPA, WESCA, and 14 MWESA, a plaintiff must plausibly allege that the complained-of interception occurred without 15 consent. To state claims under CIPA sections 631 and 632, Plaintiff M.D. must plausibly allege, 16 among other things, that he did not consent to the alleged interception or recording. See Cal. 17 Penal Code §§ 631(a) and 632(a). Like CIPA, Plaintiff O.F.’s WESCA claim requires a plaintiff 18 to plausibly allege a lack of consent – it “contains an exception to its prohibition on the 19 interception of electronic communications ‘where all parties to the communication have given 20 prior consent to such interception.’ ” Vonbergen v. Liberty Mut. Ins. Co., 705 F. Supp. 3d 440, 21 458 (E.D. Pa. 2023) (quoting 18 Pa. Cons. Stat. § 5704(4)). Plaintiff J.P.’s MWESA claim 22 likewise requires a plaintiff to plausibly allege a lack of consent – it protects only “those who do 23 not consent to the interception of their private conversations.” Agnew v. State, 197 A.3d 27, 33 24 (Md. Ct. App. 2018). Even the sole non-statutory cause of action, Plaintiff M.D.’s invasion of 25 privacy claim under California law, falters if Defendants demonstrate consent because a plaintiff 26 cannot have a reasonable expectation of privacy if they consented to the intrusion. Hill v. Nat’l 27 Collegiate Athletic Assn., 7 Cal. 4th 1, 26 (1994) (“The plaintiff in an invasion of privacy case 1 privacy, i.e., he or she must not have manifested by his or her conduct a voluntary consent to the 2 invasive actions of defendant.”); see also Opperman v. Path, Inc., 205 F. Supp. 3d 1064, 1072 3 (N.D. Cal. 2016). All claims thus rely on the absence of Plaintiffs’ consent to the challenged data 4 interception. 5 Here, Plaintiffs allege they did not consent to Defendant’s interception of their personal 6 information conveyed to BlueChew. FAC ¶ 6; see also id. ¶ 13 (Defendants “committed the 7 interceptions at issue without Plaintiffs’ knowledge, consent, or express written authorization.”), 8 id. ¶¶ 58, 93. Defendants argue that Plaintiffs consented to BlueChew’s transmission of 9 information about their activity on its website to service providers like Meta and Google, pointing 10 to BlueChew’s sign-up process. After a visitor navigates to BlueChew’s website and clicks 11 “choose plan,” see FAC ¶ 21 (Fig. 2), the visitor is asked to sign up for an account, see, e.g., 12 Blunschi Decl., Exs. 5-9 at 1. To sign up, a visitor must affirmatively “agree to [the] Terms & 13 Conditions,” which are hyperlinked and which incorporate the Privacy Policy. Blunschi Decl., 14 Exs. 5-9 at 1. The visitor cannot proceed to enter personal information or order medication without 15 logging into a preexisting account or signing up for a new one. Id. 16 Both Defendants contend that BlueChew’s Privacy Policy disclosed throughout the 17 relevant time period (2022 to 2024, when Plaintiffs allege they used the BlueChew website, see 18 FAC ¶¶ 7-11) both that BlueChew may collect and use information about users’ activity on its 19 website and that BlueChew may share that information. Defendants argue that BlueChew’s 20 Privacy Policy discloses its use of vended analytics technologies, expressly using Google 21 Analytics as an example, to collect and analyze user data. See, e.g., Google Mot. at 9 (citing RJN 22 Exs. 5-C, 5-D, and 5-E and excerpting (“We may also use automated devices and applications, 23 such as Google Analytics . . . . We use these tools to help us improve our Services, performance 24 and user experiences. These entities may use cookies and other tracking technologies to perform 25 their services.”; “As you browse our Websites, advertising cookies may be placed on your 26 computer so that we can understand what you are interested in. We may work with display 27 advertising partners . . . that enable us to present you with retargeted advertising on other sites 1 Reference to these excerpts within the previous iterations of BlueChew’s Privacy Policy 2 does not establish consent, however, because the Privacy Policy did not “explicitly notify” 3 Plaintiffs of the practice at issue. See Calhoun v. Google LLC, 526 F. Supp. 3d 605, 620 (N.D. 4 Cal. 2021) (“In order for consent to be actual, the disclosures must ‘explicitly notify’ users of the 5 practice at issue.”); In re Google Inc., 2013 WL 5423918, at *13 (N.D. Cal. Sept. 26, 2013) 6 (“Google points to its Terms of Service and Privacy Policies, to which all Gmail and Google Apps 7 users agreed, to contend that these users explicitly consented to the interceptions at issue. The 8 Court finds, however, that those policies did not explicitly notify Plaintiffs that Google would 9 intercept users’ emails for the purposes of creating user profiles or providing targeted 10 advertising.”); Campbell v. Facebook Inc., 77 F. Supp. 3d 836, 848 (N.D. Cal. 2014) (“any 11 consent with respect to the processing and sending of messages itself does not necessarily 12 constitute consent to the specific practice alleged in this case – that is, the scanning of message 13 content for use in targeted advertising.”). In fact, these older versions of BlueChew’s Privacy 14 Policy do not establish consent because they espouse that BlueChew safeguards sensitive health 15 information and only shares it with certain third parties for certain purposes that do not include 16 online advertising. In the very section relied upon by Defendants (“Use of Cookies and Other 17 Technologies on the Websites”), the Privacy Policy explicitly states: “[w]e do not share your 18 personal information with these third parties their own direct marketing purposes.” Blunschi 19 Decl., Ex. 17 at 6 (BlueChew Privacy Policy in effect on October 8, 2022). BlueChew users may 20 have consented to the disclosure of certain information to Meta and Google by using the 21 BlueChew Website, but they did not agree to the disclosure of their private health information 22 under those earlier Privacy Policies. At minimum, the majority of the BlueChew Privacy Policy 23 iterations reproduced by Defendants are ambiguous as to the purported consent Defendants claim 24 here, particularly where the Privacy Policies make no reference to disclosure of private health 25 information to Meta or Google for the purposes of online advertising. The older BlueChew 26 Privacy Policies fall short of providing explicit notification of the conduct at issue, and Defendants 27 fall short of demonstrating consent that would defeat Plaintiffs’ claims at this stage. 1 Sometime in 2024, however, BlueChew changed its Privacy Policy. In contrast to the 2 earlier versions, the version of BlueChew’s Privacy Policy that appeared on August 16, 2024, 3 clearly stated that BlueChew would use the “Meta Pixel” to “keep track of what users do after they 4 see or click on a Facebook or Instagram advertisement” on BlueChew’s website and “keep track 5 of users who access our Website or advertisements from different devices[.]” Blunschi Decl., 6 Ex. 19 (Dkt. No. 38-19, the “August 2024 Policy”) at 3. The August 2024 Policy explained that 7 such user data would be “processed by Facebook and Instagram.” Id. Relatedly, the August 2024 8 Policy described how BlueChew employed “Google Analytics” to track users’ interactions with 9 the website, providing several links regarding Google’s ability to receive and use data obtained 10 from the website. Id. at 3. The August 2024 Policy also disclosed that BlueChew collects 11 “Personal Information consisting of health information,” and that it shares such “Personal 12 Information” “with third parties,” including for advertising and data analysis. Id. at 3-4. Most 13 notably, the August 2024 Policy omits a key assertion by BlueChew that appeared in earlier 14 versions, that “[w]e do not share your personal information with these third parties their own 15 direct marketing purposes.” See, e.g., Blunschi Decl., Ex. 17 at 6 (BlueChew Privacy Policy as it 16 appeared on October 8, 2022). The August 2024 Policy thus makes clear that BlueChew would 17 share data about users’ activity on BlueChew’s site with both Meta and Google and without any 18 limitation regarding the sharing of personal information as had been included in the previous 19 iterations of the Privacy Policy. At the hearing, Plaintiffs’ counsel conceded that the August 2024 20 Policy establishes users’ consent to the data collection practices. See Hrg. Tr. (Dkt. No. 55) at 15. 21 Plaintiffs’ claims accordingly may only survive for the period prior to the adoption of the August 22 2024 Privacy Policy. 23 More fundamentally, Plaintiffs claims fail because they have not averred that the 24 challenged data sharing practices were in place before Defendants’ obtained Plaintiffs’ consent to 25 employ them. Plaintiffs became aware that Defendants intercepted their personal information in 26 September 2024, following the August 2024 Privacy Policy’s grant of consent for Defendants’ 27 conduct. See Compl. ¶¶ 7, 9, 11. Though they seek to challenge the interception of data reaching 1 users consented in August 2024 were previously undertaken. As presently alleged, Plaintiffs’ 2 claims fail for want of factual support. Accordingly, Plaintiffs “have not nudged their claims 3 across the line from conceivable to plausible,” and their claims, which all rely on the absence of 4 consent, all must face dismissal. Twombly, 550 U.S. at 570. The Court DISMISSES Plaintiffs’ 5 Complaint. 6 3. Leave to Amend 7 “Generally, Rule 15 advises the court that leave shall be freely given when justice so 8 requires. This policy is to be applied with extreme liberality.” Eminence Cap., LLC v. Aspeon, 9 Inc., 316 F.3d 1048, 1051 (9th Cir. 2003) (internal quotations and citations omitted). Courts may 10 deny leave to amend “only if there is strong evidence of undue delay, bad faith or dilatory motive 11 on the part of the movant, repeated failure to cure deficiencies by amendments previously allowed, 12 undue prejudice to the opposing party by virtue of allowance of the amendment, [or] futility of 13 amendment, etc.” Sonoma Cnty. Ass’n of Retired Emps. v. Sonoma Cnty., 708 F.3d 1109, 1117 14 (9th Cir. 2013) (quoting Foman v. Davis, 371 U.S. 178, 182 (1962)) (modification in original). 15 At this stage, the Court cannot determine as a matter of law that amendment would prove 16 futile. Plaintiffs may still be able to proffer factual allegations that support their claims of privacy 17 violations for the period preceding the adoption of the August 2024 Privacy Policy. In light of this 18 potential as well as the extreme liberality with which the Court must apply Rule 15, the Court will 19 grant Plaintiffs leave to file an amended complaint. 20 III. CONCLUSION 21 For the foregoing reasons, the Court GRANTS Defendants’ requests for judicial notice 22 and GRANTS Defendants’ motions to dismiss the Complaint. Plaintiffs may file any amended 23 // 24 // 25 // 26 // 27 // 1 complaint by no later than October 24, 2025. No parties or claims may be added without leave of 2 || Court or stipulation of Defendants. 3 IT IS SO ORDERED. 4 5 Dated: September 23, 2025 6 = 7 . ARACELI MARTINEZ-OLGUIN 8 United States District Judge 9 10 11 12

© 15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28