UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

JOHN DOE I, et al., Case No. 23-cv-02431-VC

Plaintiffs,

ORDER REQUESTING FURTHER

v. BRIEFING

GOOGLE LLC, Re: Dkt. No. 164 Defendant.

The Court apologizes for the delay. This is a difficult case. The Court is very tentatively inclined to reach the following conclusions and requests that the parties file supplemental briefs addressing them: 1. One of the things that makes this case so tricky is the lack of a clear overlap between the conduct the plaintiffs complain about in this case and some of the statutes they invoke. As the Court understands it, this lawsuit is and always has been focused on Google’s receipt of private health information that can be linked to an identifiable person. Dkt. No. 159, Second Amend. Compl. ¶¶1, 21. But some of the statutory provisions invoked by the plaintiffs are broader—they cover the intentional interception of any communication without the consent of one party (or both parties) to the communication. It was probably a wise choice for the plaintiffs to focus their lawsuit in this fashion, but it makes it difficult to apply concepts like intent from statutes like the Federal Wiretap Act and CIPA (and from the case law interpreting those statutes). In any event, given the subject matter of the lawsuit, the focus here must be on whether the plaintiffs have adequately alleged that Google has obtained their private health information in a way that enables Google to actually identify them and link the information to them. 2. On the Court’s current understanding of the allegations in the SAC and related documents, the products at issue here work as follows: The health providers decide which Google products they would like on their webpages and configure those products according to their preferences. One way those products can collect information is by using cookies. Cookies collect certain pieces of information that are then sent to Google and the health providers. Those data can then be used by the health providers to determine how users interact with their websites. The data transmitted by the cookies might not always, or even usually, contain health information, but depending on what is collected by the cookies, material that could be considered health information may be transmitted via the cookies on a specific webpage. See, e.g., Dkt. No. 159-4 at 5 (appearing to send information that a specific user ID attempted to book an appointment with a specific doctor). At least one cookie—the gid cookie—seems to collect information that, when a website interaction involves Google account holders, can link that website interaction to those account holders in a way that identifies them. The plaintiffs allege that this cookie generates and then transmits a unique identifier assigned to a website user when that user is logged into a Google service on the same browser. The plaintiffs further allege that this identifier can be tied to that user’s Google account. Based on this, it appears reasonable to infer that Google, which obviously knows the personal information that users input to create their Google accounts, can use the gid cookie to tie information that came from the health providers’ webpages to a specific person. On the Court’s understanding, when a specific action happens on a webpage with these cookies enabled, there will be several types of cookies that contain different data. Some of those cookies may end up sending health information, and when that transmission also includes the gid cookie with a specific gid identifier attached, Google is collecting health information about a particular, identifiable Google account holder. The plaintiffs allege that this health information then becomes included in Google’s “digital dossier” on that person. If this cannot be inferred from the allegations in the SAC, Google should explain why, with reference to the SAC and materials that can properly be considered at this stage. By contrast, the plaintiffs do not appear to have adequately alleged that Google collects private health information on non-Google account holders that can be linked to them in an identifiable way. In contrast to the gid cookie, the cid cookie seems to be a synonymized cookie, i.e., one that is assigned to a particular user but does not collect any information that could be used to identify a person in the real world. For example, on the Court’s understanding, the data package connected to a particular cid identifier would look something like this: the user or browser that has been assigned this particular cid identifier has looked at information about the Kansas City Chiefs, shops at Banana Republic, and has searched for “anxiety” and “bill pay” on the Gunderson Health website. What the plaintiffs seem to be missing is an allegation that Google is able to tie the cid cookie to any personally identifying information. To the extent that information is in the SAC, where is it, and if there are inferences that must be drawn to determine that Google is able to make information connected to the cid cookie personally identifiable, what are those inferences? 3. Breach of Contract: For the reasons discussed above, it appears that the plaintiffs may have stated a claim based on allegations that Google collected communications about private health information between patients and providers that could be linked to Google account holders through the cookies tied to users’ accounts, after promising to collect only health information that Google account holders chose to provide. See Second Amend. Compl. ¶¶ 96– 101; Dkt. No. 159-4 at 5; Dkt. No. 159-5. It appears that a reasonable person reading Google’s Privacy Policy could conclude that Google promised to only collect health information after consent by users and that the health information at issue here was covered by that promise. Dkt. No. 158-14 at 19. 4. Intent: The Federal Wiretap Act applies when a person “intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication.” 18 U.S.C. § 2511. The intent element of the Federal Wiretap Act requires a defendant to act “purposefully and deliberately and not as a result of accident or mistake.” United States v. Christensen, 828 F.3d 763, 774 (9th Cir. 2015). Although no “evil” motive is required, the defendant must have “acted consciously and deliberately with the goal of intercepting wire communications.” Id. at 774. Section 631 of CIPA applies when someone “willfully and without the consent of all parties to the communication . . . reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit.” Cal. Penal Code § 631. The intent inquiry under section 631 is identical to the intent inquiry under the Federal Wiretap Act. See Doe v. Meta Platforms, Inc., 690 F. Supp. 3d 1064, 1079 (N.D. Cal. 2023), motion to certify appeal denied, No. 22-CV-03580-WHO, 2024 WL 4375776 (N.D. Cal. Oct. 2, 2024) (“Intent under CIPA is determined consistently with intent under ECPA.”).1 As mentioned at the outset, this lawsuit seeks to hold Google liable for intercepting communications about private health information that Google can link to a particular, identifiable individual. Therefore, it doesn’t matter (at least for purposes of this lawsuit) whether Google intended to intercept other types of communications. If Google intended to intercept communications that contained no private health information, that wouldn’t matter. And even if Google intended to intercept communications about private health information (which it denies), that wouldn’t matter for purposes of this suit if Google couldn’t link the information to a particular, identifiable person. The plaintiffs may indeed have adequately alleged that Google, prior to publication of its 2023 HIPAA disclosure, intended to receive private health information that it could link to individual Google account holders. We know, of course, that Google intended to receive communications between website visitors to health provider pages and health providers

1 For section 632, the intent inquiry is narrower and centers on whether the person intended to record a confidential communication. See Rojas v. HSBC Card Services Inc., 20 Cal. App. 5th 427, 434–35 (2018) (“[I]t is not the purpose of the statute to punish a person who intends to make a recording but only a person who intends to make a recording of a confidential communication.” (quoting People v. Superior Court of Los Angeles County, 70 Cal. 2d 123, 133 (1969)). But that inquiry would likely be the same as the inquiry under the Federal Wiretap Act and section 631 (at least at this stage) given the allegations offered as to Google’s intent to collect personal health information. generally. It was obvious that some of these communications would be between patients and providers; it therefore was obvious that some of them would disclose private health information. Thus, unless Google took some measure to prevent itself from receiving communications about private health information and/or took some measure to prevent itself from being able to link those communications to an identifiable Google account holder, it would be reasonable to infer that Google intended to receive communications between patient and provider that were linkable to an identifiable Google account holder. In light of the plaintiffs’ allegations about the gid cookie, and in light of the allegation (based on the 2018 HIPAA disclosure) that Google did not explain to providers how to avoid sharing private health information about identifiable Google account holders through the gid cookie, it’s plausible to infer that Google intended to receive these communications. The Court is somewhat skeptical that the plaintiffs will be able to prove that at the end of the day, but it seems like it could be a reasonable inference to be drawn from the allegations in the SAC and the supporting documents. In contrast, following Google’s new HIPAA disclosure in 2023, it would not be reasonable to infer from the allegations in the SAC that Google intended to receive personal health information that could be linked to identifiable Google account holders. In that disclosure, Google told providers not to use Google’s products on any page that may be related to the provision of health care services and are likely to be covered by HIPAA. This, as the Court understands it, would prevent the gid cookie from sending personal health information in a way that would allow Google to link it to identifiable Google account holders because the cookie would not be on any page containing personal health information. Although at times the plaintiffs seem to suggest that the new 2023 disclosure was just part of a plot by Google to keep getting the type of health information that is the focus of this lawsuit, that allegation would be governed by Rule 9(b), and the plaintiffs have not come close to satisfying the Rule 9(b) standard. Indeed, as mentioned above, it seems questionable that the plaintiffs will be able to prove that Google intended to receive these types of communications even before 2023. Google’s primary job in its supplemental brief, then, is to explain why the above analysis is wrong as it relates to the pre-2023 period. The plaintiffs’ primary job is to explain why it’s right, although they are free also to try to explain why the Court is wrong as to people who don’t have Google accounts, or as to Google’s post-2023 HIPAA disclosure conduct with respect to people who do have Google accounts. Google’s brief should be filed no later than 7 days from this order, the plaintiffs response should be filed no later than 14 days from this order, and Google may reply no later than 21 days from this order. The parties’ initial submissions should not exceed fifteen pages, and Google’s reply should not exceed 10 pages.

IT IS SO ORDERED.

Dated: March 20, 2025

VINCE CHHABRIA

United States District Judge