Rebecca Hickey, individually and on behalf of all others similarly situated v. Futurehealth, Inc.

Opinion

REBECCA HICKEY, individually and on Case No.: 25-cv-03051-H-DDL behalf of all others similarly situated, ORDER GRANTING DEFENDANT’S Plaintiff, v. PLAINTIFF’S COMPLAINT WITH LEAVE TO AMEND FUTUREHEALTH, INC., Defendant. [Doc. No. 10.]

On January 16, 2026, Defendant Futurehealth, Inc. filed a motion to dismiss Plaintiff Rebecca Hickey’s complaint pursuant to Federal Rule of Civil Procedure 12(b)(1) for lack of subject matter jurisdiction and Rule 12(b)(6) for failure to state a claim, or, in the alternative, to compel arbitration. (Doc. No. 10.) On March 20, 2026, Plaintiff filed a response in opposition to Defendant’s motion. (Doc. No. 19.) On April 3, 2026, Defendant filed a reply in support of its motion. (Doc. No. 20.) On May 4, 2026, the Court took the matter under submission. (Doc. No. 22.) For the reasons below, the Court grants Defendant’s Rule 12(b)(1) motion to dismiss for lack of subject matter jurisdiction with leave to amend. / / / / / / Background The following background is based on the allegations in Plaintiff’s complaint. Defendant owns and operates a website as a telehealth platform that provides virtual weight loss consultations and prescription services for weight management medications. (Doc. No. 1, Compl. ¶ 32.) The website allegedly requires users to submit detailed health information through comprehensive onboarding quizzes before the user can create an account, review any privacy policies, or access services. (Id. ¶ 36.) The website allegedly contains numerous first- and third-party tracking implementations that measure and record user data, including tracking pixels from third-party digital advertiser Taboola, Inc. (“Taboola”). (Id. ¶¶ 37–38). Plaintiff alleges that when a user finishes an intake quiz on the website and proceeds to purchase a product, Defendant transmits the user’s responses to each of the questions in the intake quiz to Taboola. (Id. ¶ 66.) Plaintiff, a resident of New York, New York, accessed Defendant’s website to seek weight loss treatment in or around October 2024. (See id. ¶¶ 72–73.) Plaintiff alleges that she “completed the initial qualification survey, which required her to input answer[sic] sensitive questions about her health, including questions regarding previous surgeries, weight loss goals, preexisting health conditions. She also entered her name, email address, and personal[sic].” (Id. ¶ 74.) Plaintiff alleges that Defendant’s conduct violated her privacy rights and she suffered harm. (Id. ¶ 80.) On November 7, 2025, Plaintiff filed a complaint against Defendant, alleging claims for: (1) violations of the California Invasion of Privacy Act (“CIPA”), Cal. Penal Code § 631 et seq; (2) violation of CIPA, Cal. Penal Code § 632 et seq; (3) violations of the Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. § 2510 et seq; (4) violations of the New York Deceptive Trade Practices Act (“NYDTPA”), New York Gen. Bus. Law § 349 et seq; and (5) unjust enrichment. (See Doc. No. 1, Compl. ¶¶ 91–159.) By the present motion, Defendant moves pursuant to Federal Rule of Civil Procedure 12(b)(1) to dismiss Plaintiff’s complaint for lack of subject matter jurisdiction, and Defendant moves pursuant to Federal Rule of Civil Procedure 12(b)(6) to dismiss Plaintiff’s complaint for failure to state a claim. (Doc. No. 10-1 at 3–17.) Further, in the event the Court does not dismiss the complaint in its entirety, Defendant moves to compel arbitration of all surviving claims. (Id. at 17–22.) Discussion Defendant moves pursuant to Rule 12(b)(1) to dismiss Plaintiff’s complaint for lack of subject matter jurisdiction. (Doc. No. 10-1 at 3.) Specifically, Defendant argues that the Court should dismiss the complaint because Plaintiff has failed to plausibly allege an injury-in-fact sufficient to confer Article III standing. (Id.) I. Legal Standards for a Rule 12(b)(1) Motion to Dismiss Federal Rule of Civil Procedure 12(b)(1) authorizes a court to dismiss claims for lack of subject matter jurisdiction. “Rule 12(b)(1) jurisdictional attacks can be either facial or factual.” White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000). “In a facial attack, the challenger asserts that the allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction. By contrast, in a factual attack, the challenger disputes the truth of the allegations that, by themselves, would otherwise invoke federal jurisdiction.” Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). Here, Defendant’s Rule 12(b)(1) motion to dismiss focuses solely on the allegations in Plaintiff’s complaint, and, thus, Defendant makes a facial attack under Rule 12(b)(1). (See Doc. No. 10-1 at 3–8.) “In deciding a Rule 12(b)(1) facial attack motion, a court must assume the facts alleged in the complaint to be true and construe them in the light most favorable to the nonmoving party.” Strojnik v. Kapalua Land Co. Ltd., 379 F. Supp. 3d 1078, 1082 (D. Haw. 2019) (citing Warren v. Fox Family Worldwide, Inc., 328 F.3d 1136, 1139 (9th Cir. 2003)); see Savage v. Glendale Union High Sch., Dist. No. 205, Maricopa Cty., 343 F.3d 1036, 1039 (9th Cir. 2003); Rimac v. Duncan, 319 F. App’x 535, 536 (9th Cir. 2009). But a court need not accept as true conclusory allegations. See Winsor v. Sequoia Benefits & Ins. Servs., LLC, 62 F.4th 517, 525 (9th Cir. 2023). / / / / / / II. Analysis Defendant argues that the Court should dismiss the complaint because Plaintiff has failed to plausibly allege an injury-in-fact sufficient to confer Article III standing. (Doc. No. 10-1 at 3.) Article III of the Constitution “confines the federal judicial power to the resolution of ‘Cases’ and ‘Controversies.’” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021). “For there to be a case or controversy under Article III, the plaintiff must have a personal stake in the case—in other words, standing.” Id. “[T]he ‘irreducible constitutional minimum’ of standing consists of three elements.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)). To establish standing, “a plaintiff must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” TransUnion, 594 U.S. at 423 (citing Lujan, 504 U.S. at 560–61). “The plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these elements.” Spokeo, 578 U.S. at 338; accord Popa v. Microsoft Corp., 153 F.4th 784, 788 (9th Cir. 2025). Further, “‘[t]hat a suit may be a class action . . . adds nothing to the question of standing, for even named plaintiffs who represent a class must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong.’” Spokeo, 578 U.S. at 338 n. 6 (quoting Simon v. Eastern Ky. Welfare Rights Organization, 426 U.S. 26, 40, n.20 (1976)); accord Lewis v. Casey, 518 U.S. 343, 357 (1996). To establish the first element of standing, “injury in fact,” “a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Spokeo, 578 U.S. at 339 (citing Lujan, 504 U.S. at 560). “A “concrete” injury must be ‘de facto’; that is, it must actually exist.” Id. at 340. A concrete injury must be “real” and not “abstract.” Id. “[C]ertain harms readily qualify as concrete injuries under Article III. The most obvious are traditional tangible harms, such as physical harms and monetary harms.” TransUnion, 594 U.S. at 425. “Various intangible harms can also be concrete.” Id.; see Spokeo, 578 U.S. at 340. “Chief among them are injuries with a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts[,] . . . for example, reputational harms, disclosure of private information, and intrusion upon seclusion.” TransUnion, 594 U.S. at 425. Importantly, “‘Article III standing requires a concrete injury even in the context of a statutory violation.’” TransUnion, 594 U.S. at 426 (quoting Spokeo, 578 U.S. at 341). The Supreme Court “has rejected the proposition that ‘a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.’” Id. A legislature’s creation of a statutory prohibition or obligation and a cause of action does not relieve courts of their responsibility to independently decide whether a plaintiff has suffered a concrete harm under Article III. Id.; see also Popa, 153 F.4th at 792 (“TransUnion clearly cautions courts not to treat an injury as concrete for Article III purposes based only on Congress’s say- so.”). “[U]nder Article III, an injury in law is not an injury in fact.” TransUnion, 594 U.S. at 427. Here, Plaintiff alleges several privacy act claims against Defendant. (See generally Doc. No. 1, Compl. ¶¶ 91–159.) In TransUnion, the Supreme Court explained that “disclosure of private information” type harms can be sufficiently concrete to confer Article III standing. 594 U.S. at 425. Further, in a recent case, Popa v. Microsoft, the Ninth Circuit explained what kind of harm is similar to the types of harm recognized by common law privacy torts. To show intrusion upon seclusion, a plaintiff must show an intentional interference with his interest in solitude or seclusion, either as to his person or as to his private affairs or concerns, of a kind that would be highly offensive to a reasonable man. Similarly, a claim for public disclosure of private facts requires that a defendant gives publicity to a matter that concerns the private life of another, that the information is highly offensive to a reasonable person, and that the information is not of legitimate public concern. Popa, 153 F.4th at 791; see also, e.g., Khamooshi v. Politico LLC, No. 24-CV-07836-SK, 2025 WL 2822879, at *3 (N.D. Cal. Oct. 2, 2025) (applying Popa to an Article III standing analysis of privacy claims brought under CIPA). Here, Plaintiff asserts that the unauthorized disclosure of medical information is highly offensive to a reasonable person and is sufficient to constitute a concrete privacy- based injury-in-fact under the Ninth Circuit’s decision in Popa. The Court agrees that the unauthorized disclosure of medical information is sufficient to constitute an injury-in-fact under Popa. See, e.g., Semien v. PubMatic Inc., 2026 WL 216333, at *4 (N.D. Cal. Jan. 27, 2026) (finding Article III standing where the defendant allegedly intercepted communications that included “health status and treatment, travel plans, political affiliation, sexual orientation, and more”); see also Garcia v. Blackhawk Network, Inc., No. 2:25-CV-07550-JLS-SSC, 2026 WL 925028, at *5 (C.D. Cal. Apr. 1, 2026) (explaining that use of a tracking technology “may result in highly offensive conduct” where “the information collected could be especially sensitive, for example health or financial information”). But the allegations in the complaint are insufficient to adequately allege that Defendant disclosed Plaintiff’s medical information to a third-party. In explaining how Defendant’s website works, Plaintiff alleges: “When a user finishes [the] intake quiz and proceeds to purchase a product, Defendant transmits the user’s responses to each of these questions to Taboola in a JSON Web Token (JWT) embedded within the checkout page URL.” (Doc. No. 1, Compl. ¶ 66.) Here, Plaintiff alleges that the information at issue is only transmitted to third-party Taboola once the user proceeds to purchase a product. This is of consequence here because, in the complaint, Plaintiff only alleges that she accessed the website and “completed the initial qualification survey.” (Doc. No. 1, Compl. ¶¶ 73– 74.) Plaintiff never alleges that she proceeded to purchase a product from Defendant’s website. (See generally id. ¶¶ 72–80.) As such, Plaintiff’s allegations are insufficient to allege that Defendant disclosed her medical information to Taboola or anyone else, meaning Plaintiff has failed to adequately allege a privacy-based harm sufficient to confer Article III standing. In sum, Plaintiff has failed to adequately allege sufficient facts demonstrating that she has suffered a “concrete” injury in fact. Because Plaintiff has failed to adequately allege that she has Article III standing, the Court must dismiss her complaint for lack of subject matter jurisdiction.! See Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. }2011) (“[L]ack of Article III standing requires dismissal for lack of subject matter jurisdiction.”). Conclusion For the reasons above, the Court grants Defendant’s motion to dismiss Plaintiffs complaint for lack of subject matter jurisdiction. The Court’s dismissal of □□□□□□□□□□□ complaint is without prejudice and with leave to amend. See Telesaurus, 623 F.3d at 1003. Plaintiff may file a first amended complaint consistent with the analysis set forth in this order within 30 days from the date this order is filed. || DATED: May 14, 2026 | | wal | | | MARILYN W. HUFF, Distri ge UNITED STATES DISTRICT COURT Mio Because the Court dismisses Plaintiff s complaint for lack of subject matter jurisdiction based on lack of Article III standing, the Court declines to address the other grounds for dismissal raised in Defendant’s Rule 12(b)(6) motion to dismiss, and the Court weeunes 5 address Defendant’s motion to compel arbitration. (See generally Doc. No. 10-