Nguyen v. Abbott Laboratories, Inc.

• Court: District Court, N.D. Illinois
• Decided: August 8, 2025
• Docket: 1:24-cv-08289
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

LILY NGUYEN, EMZORA MITCHELL, and FRANK ORTEGA,

Plaintiffs, No. 24 CV 8289

v. Judge Manish S. Shah

ABBOTT LABORATORIES, INC.,

Defendant.

MEMORANDUM OPINION AND ORDER

Defendant Abbott Laboratories manufactures and sells continuous glucose monitoring devices for diabetes management. Plaintiffs Lily Nguyen, Emzora Mitchell, and Frank Ortega requested free trials of the FreeStyle Libre brand products on Abbott’s website. Plaintiffs allege that Abbott installed tracking tools on its website—essentially planting bugs—that shared sensitive information with third parties like Meta and Google. Plaintiffs bring claims against Abbott for violating the Electronic Communications Privacy Act, the California Invasion of Privacy Act, and for negligence under Illinois law. Defendant moves to dismiss the complaint. For the reasons discussed below, the motion is granted. I. Legal Standards A complaint must contain “a short and plain statement” showing that the plaintiff is entitled to relief. Fed. R. Civ. P. 8(a)(2); Ashcroft v. Iqbal, 556 U.S. 662, 677–78 (2009). To survive a Rule 12(b)(6) motion to dismiss, the plaintiff must allege facts that “raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555 (citation omitted). At this stage, I accept all factual allegations in the complaint as true and draw all reasonable inferences in the plaintiff’s favor, disregarding legal conclusions or “[t]hreadbare recitals” supported by only “conclusory statements.”

Iqbal, 556 U.S. at 678. Timeliness is an affirmative defense, and dismissal under Rule 12(b)(6) is appropriate only when “the complaint pleads facts that conclusively establish that the plaintiff’s claim is time-barred.” Reilly v. Will Cnty. Sheriff’s Off., 142 F.4th 924, 930 (7th Cir. 2025). II. Background Defendant Abbott Laboratories manufactures and sells continuous glucose monitoring products under its FreeStyle Libre brand. [1] ¶¶ 7, 100.1 Abbott offers free

trials for interested customers on its website Id. ¶ 102. Plaintiffs Lily Nguyen, Emzora Mitchell, and Frank Ortega requested the FreeStyle Libre products to help manage their diabetes. Id. ¶¶ 193, 210, 227. Abbott allegedly installed “tracking tools” on its website that collected plaintiffs’ data and transmitted it in real time to unauthorized third parties like Meta (formerly known as Facebook) and Google. [1] ¶¶ 4, 9–10. The tracking tools included

1 Bracketed numbers refer to entries on the district court docket. Referenced page numbers are taken from the CM/ECF header placed at the top of filings. The facts are taken from plaintiffs’ complaint, [1]. This court has federal-question jurisdiction over plaintiffs’ claims under the Electronic Communications Privacy Act and supplemental jurisdiction over the state-law claims for negligence and plaintiff Ortega’s claim under the California Invasion of Privacy Act. See 28 U.S.C. §§ 1331, 1367(a). Plaintiffs also invoke jurisdiction under the Class Action Fairness Act, id. § 1332(d)(2), but they do not adequately allege their citizenship for purposes of establishing minimal diversity. [1] ¶¶ 39–41 (plaintiffs are individuals “residing in” Georgia, Illinois, and California); Heinen v. Northrop Grumman Corp., 671 F.3d 669, 670 (7th Cir. 2012) (allegations of residency are insufficient to establish domicile); Roppo v. Travelers Com. Ins. Co., 869 F.3d 568, 578 (7th Cir. 2017) (at least one putative class member must be diverse from at least one defendant). the Meta Pixel, Google Analytics, Google DoubleClick, and Google Tag Manager. Id. ¶ 9. There are differences in how each tool functions, but the gist is the same: Abbott embeds Meta’s and Google’s tracking tools on its website; the tracking tools “co-opt”

a user’s browser and transmit information to Meta and Google; Meta and Google connect that information to an individual user’s Facebook ID or Google accounts; and Meta and Google utilize or sell the information to third-party companies to generate targeted advertisements for those users. Id. ¶¶ 13–18 (tracking tools generally); ¶¶ 19–20 (Meta Conversions Application Programming Interface); ¶¶ 57–66 (Meta Pixel); ¶¶ 75, 96 (Google). In addition to collecting a user’s IP addresses and various

account identifiers, the tools can collect information about how a user interacts with a website: searches entered, specific pages viewed, and “buttons” clicked. Id. ¶¶ 81– 84. Here’s an example of what Abbott’s webpage looked like for a user printing a voucher, [1] 111:2 + (ofS hitoswenadfreestyle □□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□ /fl-sensor-wowcher-confirrmation him r+ ho □ : by rec tO ee eee — □□

* x P Pewee Reape : Coulis Let's get your free" sensor in 3 easy steps oe ae “auery fing Paramatere en ssn Perens

Get your voucher noe ane niles i es ves, IreaityLe.abbott ius evisyfrecstyle freestyle. Libre 5.hem

en. EB eee |

The left side shows what was visible to a user: a button to “Print Voucher” and an image of a “Free Sample Card” for FreeStyle Libre 3. The right side shows the information transmitted via Meta Pixel. For example, if a user clicked the “Get your free* sensor” button, the action could be sent to Meta via the “SubscribedButtonClick” event along with information like the webpage title “FreeStyle Libre Continuous Glucose Monitoring.” Id. § 113.

2 Plaintiffs cite to an archived link of Abbott’s privacy policy as of December 2022. [1] 4 128 n.41. Only screenshots are available of the webpages at issue.

Here’s another example of Abbott’s sign-up page for the “MyFreestyle Program,” [1] § 124:

Ready to get started? Let's sign up! 3 fees ae vebanne Who are you signing up for the MyFreastyle program? ee er

The left is what was visible to users: two options to identify who the sign-up is for (“Myself or “Someone I care for’) and fill-in sections for First Name, Last Name, Email Address, Date of Birth, and Gender. The right shows the information transmitted to Google, including “Form Field Completion” and “Gender_Female.” Id. 125. Plaintiffs generally allege that Abbott’s tracking tools sent “non-public Private Information” including: (1) status as medical customers, (2) specific health conditions, i.e., diabetes, and (3) the specific diabetes management device used or sought. [1] { 93. Plaintiff Nguyen, a Georgia resident, requested free trials of the FreeStyle Libre devices on several occasions; her last request was in May 2023. [1] 4 193. She accessed Abbott’s website “to review and request FreeStyle Libre products for herself

as well as search for and communicate information related to her diabetes, insurance, and other Private Information.” Id. ¶ 196. She visited specific webpages and made searches (via the website search bar) that disclosed specific phrases related to her

medical condition, searches related to insurance coverage for diabetes monitoring systems, and “the details of her requests for Abbott’s diabetes monitoring products.” Id. ¶ 197. In addition to disclosing specific searches, Nguyen alleges Abbott “intercepted communications about [her] past or present medical condition (such as her diabetes), communications concerning her insurance coverage, and specific diabetes monitoring devices sought.” Id. ¶ 198. Nguyen holds Facebook and Google

accounts. Id. ¶ 199. She began receiving targeted ads on Facebook and Instagram for FreeStyle Libre 3, diabetes management programs from the brand Noom, and other diabetes-related ads. Id. ¶ 206. Plaintiff Mitchell, an Illinois resident, requested free trials of the FreeStyle Libre devices, most recently in August 2021. [1] ¶ 210. Mitchell alleges the same disclosures as Nguyen: navigating specific webpages, searching specific phrases via search bar, and “intercepted communications about [her] past or present medical

condition (such as her diabetes), communications concerning her insurance coverage, and specific diabetes monitoring devices sought.” Id. ¶¶ 214–15. Mitchell began receiving targeted ads on Facebook and Instagram related to diabetes monitoring and management, including ads for FreeStyle Libre products. Id. ¶ 223. Plaintiff Frank Ortega, a California resident, requested free trials of the FreeStyle Libre products, most recently in July 2023. [1] ¶ 227. He reviewed “cost and coverage information as well as other parts of the Website FAQ section” and signed up for Abbott’s newsletter. Id. ¶¶ 227, 231. Ortega began receiving targeted ads on Facebook and Instagram related to diabetes monitoring and management,

including ads for FreeStyle Libre products. Id. ¶ 240. Plaintiffs filed this lawsuit in September 2024. [1]. All plaintiffs allege violations under the Electronic Communications Privacy Act for unauthorized interception, use, and disclosure of their communications. Id. ¶¶ 269–306. Plaintiffs allege negligence, invoking duty under Illinois’s Personal Information Protection Act. Id. ¶¶ 307–314 (citing 815 ILCS 530/45(a)). Plaintiff Ortega alleges a violation of the

California Invasion of Privacy Act. Id. ¶¶ 315–26. III. Analysis A. Statute of Limitations The Electronic Communications Privacy Act provides a two-year statute of limitations. 18 U.S.C. § 2520(e). A cause of action accrues “after the date upon which the claimant first has a reasonable opportunity to discover the violation.” Id. Negligence claims under Illinois law are subject to a two-year statute of limitations. 735 ILCS 5/13-202 (“Actions for damages for an injury to the person… shall be

commenced within 2 years next after the cause of action.”). The California Invasion of Privacy Act provides a one-year statute of limitations. Brodsky v. Apple Inc., 445 F.Supp.3d 110, 134 (N.D. Cal. 2020). Both Illinois and California courts recognize a “delayed discovery” rule tolling a limitations period. See Knox Coll. v. Celotex Corp., 88 Ill.2d 407, 415 (1981) (statute of limitations is triggered “when a person knows or reasonably should know of his injury and also knows or reasonably should know that it was wrongfully caused”), and Fox v. Ethicon Endo-Surgery, Inc., 35 Cal. 4th 797, 803 (2005) (plaintiff must “prove[] that a reasonable investigation at that time would not have revealed a

factual basis for that particular cause of action”).3 Nguyen has been using Abbott’s FreeStyle Libre products since at least August 2021 and as recently as May 2023 when she requested a free trial. [1] ¶¶ 193–94, 197. Mitchell has been a customer since August 2021, when she last requested a free trial. Id. ¶¶ 210–11. Ortega has been using Abbott’s FreeStyle Libre product since at least July 2023, when he last requested a free trial. Id. ¶¶ 227–28. Abbott says the statutes

of limitations would bar all but Ortega’s ECPA and negligence claims. [30] at 6. Plaintiffs invoke the delayed discovery rule and fraudulent-concealment doctrine because they had no reason to suspect Abbott’s illegal disclosures until counsel contacted them about potential claims in May 2024. [29] at 9. That view is untenable. See Knox Coll. v. Celotex Corp., 88 Ill.2d 407, 415 (1981) (“[T]he event which triggers the running of the statutory period is not the first knowledge the injured person has of his injury, and, at the other extreme… it is not the acquisition

of knowledge that one has a cause of action against another for an injury he has

3 The parties do not distinguish between applicable tolling rules, focusing instead on the delayed discovery doctrine under California law. See [29] at 9–10, and [30] at 5–6; see McCoy v. Iberdrola Renewables, Inc., 760 F.3d 674, 684 (7th Cir. 2014) (“Federal courts hearing state law claims under diversity or supplemental jurisdiction apply the forum state’s choice of law rules to select the applicable state substantive law… When no party raises the choice of law issue, the federal court may simply apply the forum state’s substantive law.”); Malone v. Corr. Corp. of Am., 553 F.3d 540, 542 (7th Cir. 2009) (a court sitting in diversity jurisdiction borrowing a statute of limitations “must take all related doctrines, such as those that specify tolling, revival, and details of application”). The parties don’t raise a choice-of-law issue, and the issue of notice of injury is a factual dispute that cannot be resolved for any claims. suffered.”); Fox v. Ethicon Endo-Surgery, Inc., 35 Cal.4th 797, 808 (2005) (requiring “a potential plaintiff who suspects that an injury has been wrongfully caused to conduct a reasonable investigation of all potential causes of that injury”) (emphasis

included). But plaintiffs argue that the hidden nature of tracking technologies prevented their earlier discovery. [29] at 10 (citing Doe v. FullStory, Inc., 712 F.Supp.3d 1244, 1255–56 (N.D. Cal. 2024) (finding public articles about tracking technologies or platform’s privacy policies did not preclude application of discovery rule)). Abbott points to its privacy policy, which should have put plaintiffs on notice of the tracking technologies. [30] at 6. That’s not enough to suggest plaintiffs have

pleaded themselves out of court. Abbott’s privacy policy states that when third-party companies receive information through tracking technologies on its website, the companies “receive information about your interaction with our websites that is associated with your browser or device and may use that data to serve you relevant ads on our websites or others. Except for this kind of disclosure, we do not sell any of your Personal Information.” [1] ¶ 133. Whether Abbott’s data disclosures exceeded the scope of that notice is up for debate.

Nor does the existence of articles reporting on the prevalence of hidden tracking tools suggest plaintiffs should have been on notice of Abbott’s particular data disclosures to third parties. The notice inquiry is specific to each plaintiff, and there aren’t enough facts in the record to determine when plaintiffs became aware of what facts. (For example, plaintiffs do not allege when they began receiving targeted advertisements from third parties about diabetes-management products.) Dismissal based on the statute of limitations is premature. See Reilly, 142 F.4th at 930 (dismissal is inappropriate so “long as there is a conceivable set of facts, consistent with the complaint, that would defeat a statute-of-limitations defense”).

B. Electronic Communications Privacy Act The Electronic Communications Privacy Act prohibits the interception and disclosure of “wire, oral, and electronic communications.” 18 U.S.C. § 2511; John K. Maciver Inst. for Pub. Pol’y, Inc. v. Schmitz, 885 F.3d 1004, 1009 (7th Cir. 2018) (referring to Title I of the ECPA as the “Wiretap Act”). Violations are subject to criminal and civil liability. 18 U.S.C. § 2511(5)(a)(ii). To state a claim, plaintiffs must plausibly allege that Abbott “(1) intentionally (2) intercepted, endeavored to intercept

or procured another person to intercept or endeavor to intercept (3) the contents of (4) an electronic communication, (5) using a device.” In re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125, 135 (3d Cir. 2015). The statute recognizes a one-party consent exception. An interceptor isn’t liable if they are “a party to the communication or where one of the parties to the communication has given prior consent to such interception.” 18 U.S.C. § 2511(2)(d).

The exception doesn’t apply “if such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.” Id. A “defendant must have the intent to use the illicit recording to commit a tort or crime beyond the act of recording itself.” Caro v. Weintraub, 618 F.3d 94, 98 (2d Cir. 2010). Plaintiffs concede that Abbott was a party to the communications, but the crime-tort exemption “overrides” the one-party consent rule. [29] at 15. Plaintiffs claim that Abbott intercepted the communications “for the purpose of committing [a] criminal or tortious act,” here, a violation of the Health Insurance Portability and Accountability Act. [29] at 16.

HIPAA makes it a crime for a person to “knowingly… disclose[] individually identifiable health information to another person.”4 42 U.S.C. § 1320d-6(a)(3); cf. Carpenter v. Phillips, 419 Fed. App’x 658, 659 (7th Cir. 2011) (no private right of action under HIPAA). Individually identifiable health information includes: any information, including demographic information collected from an individual, that—(A) is created or received by a health care provider… and (B) relates to the past, present, or future physical or mental health or condition of an individual… and—(i) identifies the individual; or (ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual. 42 U.S.C. § 1320d(6) (emphasis added. To invoke the crime-tort exception, plaintiffs must plausibly allege that Abbott illegally disclosed their individually identifiable health information to Meta or Google (or any other third party). There are two layers of data disclosure at issue. First, whether plaintiffs disclosed HIPAA-protected information to Abbott through their web activities. Then, whether Abbott “knowingly” disclosed HIPAA-protected information to Meta or Google. As defendant points out, what a user “discloses” or “communicates” to Abbott’s website is not the same information transmitted to third parties. [24] at 10; see, e.g., [1] ¶ 111 (user clicking “Get your free* sensor” button transmits event data

4 “Person” includes a corporation. 42 U.S.C. § 1301(a)(3). At this stage of the case, there’s no dispute whether information was “created or received by a health care provider.” Id. § 1320(d)(6)(A). “SubscribedButtonClick” via Meta Pixel). Because plaintiffs don’t sufficiently allege the disclosure of HIPAA-protected information to Abbott in the first place, plaintiffs fail to allege that the crime-tort exception applies.

Plaintiffs explain the technology behind the tracking tools in great detail, but their hypothetical examples don’t shed light on whether each plaintiff’s disclosures plausibly amount to “individually identifiable health information.” Nguyen and Mitchell allege visiting specific webpages and conducting searches using “specific phrases related to [their] medical condition”; searches “related to insurance coverage for diabetes monitoring systems”; and searches communicating “the details of [their]

requests for Abbott’s diabetes monitoring products.” [1] ¶¶ 197, 214. Ortega used the search function on the website’s FAQ section. Id. ¶ 231. Merely browsing and searching Abbott’s website doesn’t amount to a disclosure of individually identifiable health information to Abbott. “Information available on publicly accessible websites stands in stark contrast to the personally identifiable patient records and medical histories protected by [HIPAA]—information that unequivocally provides a window into an individual’s personal medical history… Put simply the connection between a

person’s browsing history and his or her own state of health is too tenuous to support [the] contention that the disclosure requirements of HIPAA” apply. Smith v. Facebook, Inc., 745 Fed. App’x 8, 9 (9th Cir. 2018) (internal citations omitted). Here, plaintiffs’ browsing and search activities conveyed an interest in Abbott’s product, but it’s not reasonable to infer these activities conveyed personal medical histories. Plaintiffs assert that their requests for the continuous-glucose monitoring devices “alone establish that Abbott disclosed information regarding their personal health conditions and treatments to third parties.” [29] at 12. That’s an inference

unsupported by the allegations. Nguyen and Mitchell allege that, in addition to browsing and search activity, Abbott “intercepted communications about [their] past or present medical condition (such as [their] diabetes), communications concerning [their] insurance coverage, and specific diabetes monitoring devices sought.” [1] ¶¶ 198, 215. Ortega alleges the same “intercepted communications” but without reference to his insurance coverage. Id. ¶ 232. Apart from stating legal conclusions,

the individual plaintiffs don’t allege what information they disclosed when requesting a free trial. It’s possible, for example, that Nguyen and Mitchell disclosed their individual medical insurance information to enroll in the MyFreeStyle Program. It may also be that plaintiffs disclosed their insurance provider’s name to explore eligibility without disclosing any of their individual information. Without allegations about what individual disclosures were made to Abbott, plaintiffs fail to plausibly allege that Abbott received HIPAA-protected information.

Plaintiffs say that every court in this district has found “virtually identical allegations involving disclosures of medical information… to constitute IIHI.” [29] at 12–13. The cited cases all involve plaintiffs accessing websites as medical patients of a hospital or medical practice. See Hartley v. Univ. of Chicago Med. Ctr., No. 22-cv- 5891, 2024 WL 1886909, at *2 (N.D. Ill. Apr. 30, 2024) (plaintiff plausibly alleged that university hospital disclosed her health information when she used website to seek specific medical specialists, obtain prescriptions, and seek information about sexually transmitted diseases); A.D. v. Aspen Dental Mgmt., Inc., No. 24-cv-1404, 2024 WL 4119153, at *3 (N.D. Ill. Sept. 9, 2024) (same where dental service organization

“transmitted [plaintiffs’] patient status, medical conditions, information about their medical appointments and treatments, specific medical providers, and other sensitive health information to third parties”); Smith v. Loyola Univ. Med. Ctr., No. 23-cv- 15828, 2024 WL 3338941, at *6 (N.D. Ill. July 9, 2024) (same where medical center “transmitted the plaintiffs’ status as medical patients, the content of their communications with [defendant’s] webpage, information about their medical

appointments, location of treatments, specific medical providers, [and] specific medical conditions and treatments”). Here, plaintiffs navigated Abbott’s website as consumers interested in a free trial of a product. That’s a step removed from the kind of medical information disclosed between a patient and their healthcare provider. For now, the connection between plaintiffs’ web activities and disclosure of individually identifiable health information is “too tenuous” to support an inference that Abbott violated HIPAA.

Smith, 745 Fed. App’x at 9. Defendant’s motion to dismiss the ECPA claim is granted.5

5 If plaintiffs adequately allege that Abbott knowingly disclosed protected health information in violation of HIPAA, the next question to answer would be whether under the ECPA, Abbott’s interception was committed for the purpose of violating HIPAA. Although briefed by the parties, I don’t reach that question here. C. State-Law Claims Because plaintiffs do not adequately allege citizenship to invoke subject-matter jurisdiction under the Class Action Fairness Act, I decline to exercise supplemental jurisdiction over the remaining state-law claims. See footnote 1; 28 U.S.C. § 1867(c)(3); Royal Canin U.S.A., Inc. v. Wullschleger, 604 U.S. 22, 31-82 (2025) (a district court may “and ordinarily should” decline to exercise supplemental jurisdiction if the court “has dismissed all claims over which it has original jurisdiction”). IV. Conclusion Defendant's motion to dismiss, [23], is granted. Dismissal is without prejudice.® If plaintiffs do not file an amended complaint by September 5, 2025, the dismissal will automatically convert to a dismissal with prejudice of the federal-law claims and judgment will enter. Discovery remains stayed pending the filing of an amended complaint.

ENTER: fads 5S. Shah United States District Judge Date: August 8, 2025

6 “Ordinarily... a plaintiff whose original complaint has been dismissed under Rule 12(b)(6) should be given at least one opportunity to try to amend her complaint before the entire action is dismissed.” See Runnion ex rel. Runnion v. Girl Scouts of Greater Chicago & Nw. Indiana, 786 F.3d 510, 519 (7th Cir. 2015). 15