M.D. v. Google LLC

Opinion

M.D., et al., Case No. 24-cv-06369-AMO

Plaintiffs, ORDER GRANTING DEFENDANTS’ v. MOTIONS TO DISMISS

GOOGLE LLC, et al., Re: Dkt. Nos. 37, 40 Defendants.

This is a putative data privacy class action against two tech behemoths. Plaintiffs allege that Defendants Google, LLC (“Google”) and Meta Platforms, Inc. (“Meta”) improperly gleaned their personal health data, including erectile dysfunction prescriptions, from a website. Google and Meta’s motions to dismiss were heard before this Court on July 10, 2025. Having read the papers filed by the parties and carefully considered their arguments therein and those made at the hearing, as well as the relevant legal authority, and good cause appearing, the Court hereby GRANTS the motions to dismiss for the following reasons. I. BACKGROUND1 Non-party Dermacare, LLC d/b/a BlueChew (“BlueChew”) operates www.bluechew.com (the “Website”) and provides “a technology platform which enables registered users to connect with physicians and other health care providers for the diagnosis and treatment of erectile dysfunction.” FAC ¶ 2. Plaintiff M.D. is a California citizen who, on December 6, 2022, and January 4, 2023, was prescribed and ordered erectile dysfunction medication through the Website.

1 This factual background is taken from the allegations in the operative complaint, which the Court First Am. Compl. (“FAC,” Dkt. No. 34) ¶ 7. Plaintiff O.F., a Pennsylvania citizen, purchased erectile dysfunction medication through the Website in January 2022. FAC ¶ 9. Plaintiff J.P., a Maryland citizen, purchased erectile dysfunction medication through the Website in August 2024. FAC ¶ 11. In using the Website, Plaintiffs and class members provided protected health information to BlueChew for the purpose of obtaining medical treatment, including providing responses to a “medical profile” questionnaire to determine whether they qualify for erectile dysfunction medication. FAC ¶¶ 20-24, Figures 1-4. Defendants intercepted Plaintiffs’ sensitive health information conveyed through the Website using the Facebook Tracking Pixel, Google Analytics tool, and other similar software. FAC ¶ 32. The data transferred by BlueChew to Google and Meta included a Website user’s name, birthday, email address, and a pseudonymous identifier created and assigned to them by BlueChew. FAC ¶¶ 44, 68-69. The data intercepted and collected also included de-anonymized, prescription erectile dysfunction medications purchased by Plaintiffs and class members on the Website. FAC ¶¶ 3-4, 35, 39 (illustrating how the Facebook Tracking Pixel functions to intercept private health information from the Website); id. ¶¶ 61-75 (same as to Google’s tracking technologies). Examples of Defendants’ interceptions from the Website show that Defendants intercepted personally identifying information such as name, state of residence, email address, and various forms of protected health information. For example, Google intercepted information showing that a BlueChew user registered on the Website, added a medication to their cart, and ultimately purchased the medication. FAC ¶ 67-69, Figures 8 and 9. Meta accomplished the same using its technology. FAC ¶ 40, Figures 4 and 5; see also id. ¶ 41 (“Through the Facebook Tracking Pixel, Defendant Facebook intercepted and recorded ‘AddToCart’ and ‘CompleteRegistration’ events, which detail information about which prescription the patient was purchasing on the Website.”); id. ¶¶ 42-44. Plaintiffs’ protected health information intercepted by Defendants was personally identifiable, and Defendants used Plaintiffs’ and class members’ intercepted health information for the purpose of targeted advertising. FAC ¶¶ 5, 36, 57, 73-74. At some point after Plaintiffs’ respective purchases on medications,” but they do not allege whether those ads were served by Meta, Google, or another entity. FAC ¶¶ 8, 10, 12. Plaintiffs advance the following claims in the FAC: • (1) violation of the California Invasion of Privacy Act (“CIPA”), California Penal Code section 631 (Claim I); • (2) violation of CIPA, California Penal Code section 632 (Claim II); and • (3) invasion of privacy under the California Constitution (Claim III). • (4) Plaintiff O.F.’s claim for a violation of the Pennsylvania Wiretapping Act (“WESCA”), 18 Pa. Cons. Stat. § 5701 et seq., on behalf of a putative Pennsylvania class (FAC ¶¶ 120- 28); and • (5) Plaintiff J.P.’s claim for a violation of the Maryland Wiretapping and Electronic Surveillance Act (“MWESA”), Md. Cts. & Jud. Proc. Code Sec. 10-401 et seq. on behalf of a putative Maryland class (FAC ¶¶ 129-40). M.D seeks to represent a putative California class including “all natural persons in California who, during the class period, purchased medication on www.bluechew.com.” FAC ¶ 78. Plaintiff O.F. brings claims on behalf of himself and an identical class of persons in Pennsylvania. FAC ¶ 79. Plaintiff J.P. brings claims on behalf of himself and an identical class of persons in Maryland. FAC ¶ 80. Defendants both move to dismiss the Complaint for failure to state a claim. See Dkt. Nos. 37, 40. The Court begins by taking up Defendants’ requests for judicial notice, the contents of which inform the subsequent analysis of the motions to dismiss. A. Request for Judicial Notice Each Defendant filed their own request for judicial notice. See Dkt. No. 39 (Meta); Dkt. No. 41 (Google). A district court may take judicial notice of facts that are “not subject to reasonable dispute” because they are (1) “generally known within the trial court’s territorial jurisdiction,” or (2) “can be accurately and readily determined from sources whose accuracy F.2d 331, 333 (9th Cir. 1993). “Accordingly, ‘[a] court may take judicial notice of matters of public record.’ ” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 999 (9th Cir. 2018) (quoting Lee, 250 F.3d at 688). A court cannot, however, “take judicial notice of disputed facts contained in such public records.” Id. “Unlike rule-established judicial notice, incorporation-by-reference is a judicially created doctrine that treats certain documents as though they are part of the complaint itself. The doctrine prevents plaintiffs from selecting only portions of documents that support their claims, while omitting portions of those very documents that weaken – or doom – their claims.” Khoja, 899 F.3d at 1002. “Although the incorporation-by-reference doctrine is designed to prevent artful pleading by plaintiffs, the doctrine is not a tool for defendants to short-circuit the resolution of a well-pleaded claim.” Id. at 1003. Google requests the Court take judicial notice of several documents, including screenshots of webpages as well as iterations of Google’s and BlueChew’s terms, all of them with differing effective dates. See McKinley Corbo Decl. (Dkt. No. 41-1). Google avers that all of these materials are incorporated by reference into the Complaint and that all of these materials, consisting of publicly available webpages, are not subject to reasonable dispute and are capable of accurate and ready determination. See Google RJN (Dkt. No. 41). Similarly, Meta requests the Court take judicial notice of several categories of materials, including screenshots of webpages as well as Meta’s and BlueChew’s terms. See Blunschi Decl., Exs. 1-21 (Dkt. No. 38). Meta avers that all of these materials are incorporated by reference into the Complaint and that all of these materials, consisting of publicly available webpages, are not subject to reasonable dispute and are capable of accurate and ready determination. See Meta RJN (Dkt. No. 39). Though Plaintiffs argue in their brief that the Court should disregard the materials as insufficiently authenticated and too attenuated to the dates of Plaintiffs’ access of the website, see, e.g., Opp. to Meta (Dkt. No. 42) at 10-12, Plaintiffs’ counsel made clear at the hearing that they did not object to the Court considering the materials submitted for judicial notice in its assessment see Hrg. Tr. (Dkt. No. 55) at 15. The Court therefore GRANTS the request for judicial notice of the existence of the various terms and policies at issue, and it considers the materials incorporated by reference. B. Motions to Dismiss 1. Legal Standard A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) tests for the legal sufficiency of the claims alleged in the complaint. Ileto v. Glock, 349 F.3d 1191, 1199-1200 (9th Cir. 2003). Under Federal Rule of Civil Procedure 8, which requires that a complaint include a “short and plain statement of the claim showing that the pleader is entitled to relief,” Fed. R. Civ. P. 8(a)(2), a complaint may be dismissed under Rule 12(b)(6) if the plaintiff fails to state a cognizable legal theory, or has not alleged sufficient facts to support a cognizable legal theory. Somers v. Apple, Inc., 729 F.3d 953, 959 (9th Cir. 2013). While the court is to accept as true all the factual allegations in the complaint, it need not accept legally conclusory statements unsupported by factual allegations. Ashcroft v. Iqbal, 556 U.S. 662, 678-79 (2009). The complaint must proffer sufficient facts to state a claim for relief that is plausible on its face. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 558-59 (2007) (citations and quotations omitted). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678 (citation omitted). “[W]here the well-pleaded facts do not permit the court to infer more than the mere possibility of misconduct, the complaint has alleged – but it has not ‘show[n]’ – that the pleader is entitled to relief.” Id. at 679. Review is generally limited to the contents of the complaint, although the court can also consider a document on which the complaint relies if the document is central to the claims asserted in the complaint, and no party questions the authenticity of the document. See Sanders v. Brown, 504 F.3d 903, 910 (9th Cir. 2007). The court may consider matters that are properly the subject of judicial notice, Knievel v. ESPN, 393 F.3d 1068, 1076 (9th Cir. 2005); Lee v. City of Los Angeles, 250 F.3d 668, 688-89 (9th Cir. 2001), and may also consider documents referenced extensively in Teamster Jt. Council Pension Tr. Fund v. Am. W. Holding Corp., 320 F.3d 920, 925 n.2 (9th Cir. 2003). If dismissal is warranted, it is generally without prejudice, unless it is clear that the complaint cannot be saved by any amendment. Sparling v. Daou, 411 F.3d 1006, 1013 (9th Cir. 2005). 2. Consent Among the several arguments raised by Google and Meta, Defendants move to dismiss on the grounds that Plaintiffs consented to having their information collected on BlueChew’s website and shared with Defendants. “Consent generally defeats privacy claims.” Javier v. Assurance IQ, LLC, No. 4:20-CV-02860-JSW, 2021 WL 940319, at *2 (N.D. Cal. Mar. 9, 2021). “On a motion to dismiss, the burden of proof to show consent rests with defendants.” Doe v. FullStory, Inc., 712 F. Supp. 3d 1244, 1253 (N.D. Cal. 2024); Doe v. Meta Platforms, Inc., 690 F. Supp. 3d 1064, 1077-78 (N.D. Cal. 2023) (“On this motion to dismiss, the issue of consent is front and center and the burden of proof to show this exemption applies is on Meta.”). Under CIPA, WESCA, and MWESA, a plaintiff must plausibly allege that the complained-of interception occurred without consent. To state claims under CIPA sections 631 and 632, Plaintiff M.D. must plausibly allege, among other things, that he did not consent to the alleged interception or recording. See Cal. Penal Code §§ 631(a) and 632(a). Like CIPA, Plaintiff O.F.’s WESCA claim requires a plaintiff to plausibly allege a lack of consent – it “contains an exception to its prohibition on the interception of electronic communications ‘where all parties to the communication have given prior consent to such interception.’ ” Vonbergen v. Liberty Mut. Ins. Co., 705 F. Supp. 3d 440, 458 (E.D. Pa. 2023) (quoting 18 Pa. Cons. Stat. § 5704(4)). Plaintiff J.P.’s MWESA claim likewise requires a plaintiff to plausibly allege a lack of consent – it protects only “those who do not consent to the interception of their private conversations.” Agnew v. State, 197 A.3d 27, 33 (Md. Ct. App. 2018). Even the sole non-statutory cause of action, Plaintiff M.D.’s invasion of privacy claim under California law, falters if Defendants demonstrate consent because a plaintiff cannot have a reasonable expectation of privacy if they consented to the intrusion. Hill v. Nat’l Collegiate Athletic Assn., 7 Cal. 4th 1, 26 (1994) (“The plaintiff in an invasion of privacy case privacy, i.e., he or she must not have manifested by his or her conduct a voluntary consent to the invasive actions of defendant.”); see also Opperman v. Path, Inc., 205 F. Supp. 3d 1064, 1072 (N.D. Cal. 2016). All claims thus rely on the absence of Plaintiffs’ consent to the challenged data interception. Here, Plaintiffs allege they did not consent to Defendant’s interception of their personal information conveyed to BlueChew. FAC ¶ 6; see also id. ¶ 13 (Defendants “committed the interceptions at issue without Plaintiffs’ knowledge, consent, or express written authorization.”), id. ¶¶ 58, 93. Defendants argue that Plaintiffs consented to BlueChew’s transmission of information about their activity on its website to service providers like Meta and Google, pointing to BlueChew’s sign-up process. After a visitor navigates to BlueChew’s website and clicks “choose plan,” see FAC ¶ 21 (Fig. 2), the visitor is asked to sign up for an account, see, e.g., Blunschi Decl., Exs. 5-9 at 1. To sign up, a visitor must affirmatively “agree to [the] Terms & Conditions,” which are hyperlinked and which incorporate the Privacy Policy. Blunschi Decl., Exs. 5-9 at 1. The visitor cannot proceed to enter personal information or order medication without logging into a preexisting account or signing up for a new one. Id. Both Defendants contend that BlueChew’s Privacy Policy disclosed throughout the relevant time period (2022 to 2024, when Plaintiffs allege they used the BlueChew website, see FAC ¶¶ 7-11) both that BlueChew may collect and use information about users’ activity on its website and that BlueChew may share that information. Defendants argue that BlueChew’s Privacy Policy discloses its use of vended analytics technologies, expressly using Google Analytics as an example, to collect and analyze user data. See, e.g., Google Mot. at 9 (citing RJN Exs. 5-C, 5-D, and 5-E and excerpting (“We may also use automated devices and applications, such as Google Analytics . . . . We use these tools to help us improve our Services, performance and user experiences. These entities may use cookies and other tracking technologies to perform their services.”; “As you browse our Websites, advertising cookies may be placed on your computer so that we can understand what you are interested in. We may work with display advertising partners . . . that enable us to present you with retargeted advertising on other sites Reference to these excerpts within the previous iterations of BlueChew’s Privacy Policy does not establish consent, however, because the Privacy Policy did not “explicitly notify” Plaintiffs of the practice at issue. See Calhoun v. Google LLC, 526 F. Supp. 3d 605, 620 (N.D. Cal. 2021) (“In order for consent to be actual, the disclosures must ‘explicitly notify’ users of the practice at issue.”); In re Google Inc., 2013 WL 5423918, at *13 (N.D. Cal. Sept. 26, 2013) (“Google points to its Terms of Service and Privacy Policies, to which all Gmail and Google Apps users agreed, to contend that these users explicitly consented to the interceptions at issue. The Court finds, however, that those policies did not explicitly notify Plaintiffs that Google would intercept users’ emails for the purposes of creating user profiles or providing targeted advertising.”); Campbell v. Facebook Inc., 77 F. Supp. 3d 836, 848 (N.D. Cal. 2014) (“any consent with respect to the processing and sending of messages itself does not necessarily constitute consent to the specific practice alleged in this case – that is, the scanning of message content for use in targeted advertising.”). In fact, these older versions of BlueChew’s Privacy Policy do not establish consent because they espouse that BlueChew safeguards sensitive health information and only shares it with certain third parties for certain purposes that do not include online advertising. In the very section relied upon by Defendants (“Use of Cookies and Other Technologies on the Websites”), the Privacy Policy explicitly states: “[w]e do not share your personal information with these third parties their own direct marketing purposes.” Blunschi Decl., Ex. 17 at 6 (BlueChew Privacy Policy in effect on October 8, 2022). BlueChew users may have consented to the disclosure of certain information to Meta and Google by using the BlueChew Website, but they did not agree to the disclosure of their private health information under those earlier Privacy Policies. At minimum, the majority of the BlueChew Privacy Policy iterations reproduced by Defendants are ambiguous as to the purported consent Defendants claim here, particularly where the Privacy Policies make no reference to disclosure of private health information to Meta or Google for the purposes of online advertising. The older BlueChew Privacy Policies fall short of providing explicit notification of the conduct at issue, and Defendants fall short of demonstrating consent that would defeat Plaintiffs’ claims at this stage. Sometime in 2024, however, BlueChew changed its Privacy Policy. In contrast to the earlier versions, the version of BlueChew’s Privacy Policy that appeared on August 16, 2024, clearly stated that BlueChew would use the “Meta Pixel” to “keep track of what users do after they see or click on a Facebook or Instagram advertisement” on BlueChew’s website and “keep track of users who access our Website or advertisements from different devices[.]” Blunschi Decl., Ex. 19 (Dkt. No. 38-19, the “August 2024 Policy”) at 3. The August 2024 Policy explained that such user data would be “processed by Facebook and Instagram.” Id. Relatedly, the August 2024 Policy described how BlueChew employed “Google Analytics” to track users’ interactions with the website, providing several links regarding Google’s ability to receive and use data obtained from the website. Id. at 3. The August 2024 Policy also disclosed that BlueChew collects “Personal Information consisting of health information,” and that it shares such “Personal Information” “with third parties,” including for advertising and data analysis. Id. at 3-4. Most notably, the August 2024 Policy omits a key assertion by BlueChew that appeared in earlier versions, that “[w]e do not share your personal information with these third parties their own direct marketing purposes.” See, e.g., Blunschi Decl., Ex. 17 at 6 (BlueChew Privacy Policy as it appeared on October 8, 2022). The August 2024 Policy thus makes clear that BlueChew would share data about users’ activity on BlueChew’s site with both Meta and Google and without any limitation regarding the sharing of personal information as had been included in the previous iterations of the Privacy Policy. At the hearing, Plaintiffs’ counsel conceded that the August 2024 Policy establishes users’ consent to the data collection practices. See Hrg. Tr. (Dkt. No. 55) at 15. Plaintiffs’ claims accordingly may only survive for the period prior to the adoption of the August 2024 Privacy Policy. More fundamentally, Plaintiffs claims fail because they have not averred that the challenged data sharing practices were in place before Defendants’ obtained Plaintiffs’ consent to employ them. Plaintiffs became aware that Defendants intercepted their personal information in September 2024, following the August 2024 Privacy Policy’s grant of consent for Defendants’ conduct. See Compl. ¶¶ 7, 9, 11. Though they seek to challenge the interception of data reaching users consented in August 2024 were previously undertaken. As presently alleged, Plaintiffs’ claims fail for want of factual support. Accordingly, Plaintiffs “have not nudged their claims across the line from conceivable to plausible,” and their claims, which all rely on the absence of consent, all must face dismissal. Twombly, 550 U.S. at 570. The Court DISMISSES Plaintiffs’ Complaint. 3. Leave to Amend “Generally, Rule 15 advises the court that leave shall be freely given when justice so requires. This policy is to be applied with extreme liberality.” Eminence Cap., LLC v. Aspeon, Inc., 316 F.3d 1048, 1051 (9th Cir. 2003) (internal quotations and citations omitted). Courts may deny leave to amend “only if there is strong evidence of undue delay, bad faith or dilatory motive on the part of the movant, repeated failure to cure deficiencies by amendments previously allowed, undue prejudice to the opposing party by virtue of allowance of the amendment, [or] futility of amendment, etc.” Sonoma Cnty. Ass’n of Retired Emps. v. Sonoma Cnty., 708 F.3d 1109, 1117 (9th Cir. 2013) (quoting Foman v. Davis, 371 U.S. 178, 182 (1962)) (modification in original). At this stage, the Court cannot determine as a matter of law that amendment would prove futile. Plaintiffs may still be able to proffer factual allegations that support their claims of privacy violations for the period preceding the adoption of the August 2024 Privacy Policy. In light of this potential as well as the extreme liberality with which the Court must apply Rule 15, the Court will grant Plaintiffs leave to file an amended complaint. For the foregoing reasons, the Court GRANTS Defendants’ requests for judicial notice and GRANTS Defendants’ motions to dismiss the Complaint. Plaintiffs may file any amended // // // // // 1 complaint by no later than October 24, 2025. No parties or claims may be added without leave of 2 Court or stipulation of Defendants. 4 5 Dated: September 23, 2025 6 = 7 . ARACELI MARTINEZ-OLGUIN 8 United States District Judge 9 10 11 12

© 15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28