• by Wendy Davis  @wendyndavis, October 19, 2023

A federal judge has declined to issue an injunction that would have prohibited Google from collecting analytics data from health care providers' websites.

In a ruling made available Wednesday, U.S. District Court Judge Vince Chhabria said there were “serious questions” about whether Google's alleged data collection violated any laws.

The ruling came in a battle dating to May, when several web users alleged in separate complaints that Google collected sensitive health data from online sites. The first complaint was brought by an anonymous “Jane Doe” who alleged that she used Planned Parenthood's site to search for an abortion provider, and received treatment at the reproductive health care center's affiliate in Burbank, California.

The complaint in that case referred to an investigation by the app Lockdown Privacy, which reported last year that Planned Parenthood's site used third-party analytics tools leaked “extremely sensitive data" to third parties including Google, Meta and TikTok.

Other anonymous plaintiffs later alleged in a separate lawsuit that Google collected health information from a variety of health care sites.

The matters were consolidated earlier this year and are pending in front of Chhabria.

The complaint includes claims that Google violated federal and California wiretap laws, and that it engaged in “highly offensive” privacy violations.

In July, the plaintiffs sought an injunction banning Google from collecting data from several specific health sites, and requiring the company refrain from using that data for advertising.

Google opposed that request, arguing that it's likely to defeat the claims on the grounds that it's simply a vendor of lawful analytics tools.

The company said Google Analytics “only provide developers with information about how users use the developers’ own properties.”

Google also said healthcare sites don't send it personally identifying information, or “health details about any person in particular,” and that it doesn't allow the use of sensitive health data for ad targeting.

Chhabria said in his ruling that the allegations, even if proven true, wouldn't show that Google violated the federal wiretap law -- which prohibits companies from intercepting communications without the consent of at least one party.

He wrote that even though the plaintiffs didn't consent to share health information, the health care providers did.

Chhabria also said the plaintiffs strongest claim might be their contention that Google violated California's wiretap law -- which prohibits the interception of communications unless all parties consent.

But he said it wasn't clear whether Google's alleged interceptions would be covered by that law, given the company's position that it was merely a vendor of software services.

“Courts have drawn a distinction ... between 'independent parties who mined information from other websites and sold it' versus vendors who provide 'a software service that captures its clients’ data, hosts it on [its] servers, and allows the clients to analyze their data,'” Chhabria wrote.

“Based on the evidence presented in connection with this motion, it seems possible that Google could fall into either category, but the answer is far from obvious,” he added.

Chhabria said the plaintiffs could seek to beef up their complaint and file an amended version within seven days.